1. Cost Curve Calculator
Move the slider to choose when a bug is found and see how cost grows exponentially as fixes are delayed. This demonstrates the "shift-left" principle: the earlier bugs are found, the cheaper they are to fix (Chung et al., 2014).
Estimated fix cost (illustrative)
$1,000
Tip: choose different bug types to see relative severity and remediation effort.
Relative multiplier
x1
Cost curve across phases
Note: numbers are illustrative to emphasise the exponential relationship between discovery timing and remediation cost.
Research prompt: "Explain why defect remediation cost grows across development phases and examples of effective 'shift-left' testing practices."
2. CIA Triad Sorter
Drag each breach example into the correct pillar: Confidentiality, Integrity, or Availability.
Customer emails leaked from backup
Database records corrupted after bad migration
DDoS attack bringing site offline
Unauthorized price changes in DB
Exposed API key in public repo
Ransomware encrypted backups
Confidentiality
Integrity
Availability
Research prompt: "How do confidentiality, integrity, and availability incidents differ? Give real-world breach examples for each and mitigation strategies."
3. Security vs. Functionality Balance
Allocate a budget between 'New Features' and 'Security Audits' and run a simulated stability test.
Stability
Adjust the expected user base to see how exposure increases operational risk.
Result:
Balanced
Hint: too low security produces fragile products; too little feature investment may hurt competitiveness.
Research prompt: "Describe approaches to balance security investment and feature velocity; include cost models and org patterns (e.g., SRE, security champions)."
4. Vulnerability Quiz
Click the line that looks suspicious (example: SQL injection risk).
1: const user = req.query.user;
2: const q = `SELECT * FROM users WHERE name = '${user}'`;
3: db.query(q, (err, rows) => res.json(rows));
Research prompt: "What is SQL injection, how can it appear in Node.js code, and how do parameterized queries prevent it? Provide example fixes."
5. Case Study Analysis
Read the scenario and select which security steps the startup skipped.
Scenario
Startup Launchly shipped an MVP quickly. They stored production secrets in plaintext, delayed setting up TLS, and only had one developer with admin access. After growth, attackers accessed keys and exfiltrated customer data.