There’s a point in a project where it stops feeling like a bunch of systems you’re building and starts feeling like an actual game, and I think TRACEWAKE has finally crossed that line.
When I wrote the first dev log, the project was still operating under the working title Cyber Aware. At that stage, the whole thing was really built around one question: could I make a cyber security game where the player actually learns by doing the job, instead of answering questions with a game wrapped around them? The early Blue Team prototype existed to prove that idea. You’d sit down at a fictional corporate workstation, get handed incomplete information, investigate what was happening, make a decision and deal with the consequences. It worked, and once I knew that part worked, the project started growing in directions I honestly hadn’t planned for at the beginning.
Aurelius started feeling like a workplace
The first versions of the Blue Team side were pretty focused. You had an incident, some tools to investigate it with, a few actions you could take and then a report at the end telling you how you went. Over time though, Aurelius started feeling less like a prototype interface and more like somewhere you were actually working. The desktop filled out with Sentinel, Log Viewer, Company Directory, Aurelius Chat, Devices, Aurelius Files, Service Desk, Evidence, Incident Manager and User Management. Windows could be moved around, employees could be contacted, accounts could be disabled, devices could be contained and support tickets kept turning up while you were trying to deal with something potentially much bigger.
That last part became more important than I expected. The world shouldn’t just freeze because the player is dealing with an incident. People still forget passwords, printers still stop working and someone still wants to know why their email won’t send while you’re in the middle of trying to work out whether a machine has been compromised. Once that started clicking into place, the game stopped asking only “can you find the bad thing?” and started asking “what actually matters right now?” That felt much closer to the sort of decision-making I wanted TRACEWAKE to teach.
Then everything had to actually remember what you did
Of course, once all those systems started talking to each other, the game also had to remember what the player had actually done. If you isolate a device, it needs to stay isolated. If you disable an account, every other system needs to understand that account is disabled. If you resolve a ticket, it can’t randomly wake back up because you opened another window. That sounds obvious, but it gets more interesting when you’ve got multiple applications, hidden scenario events, a simulated clock and all sorts of things happening behind the scenes.
There were plenty of moments where one part of the simulation knew what had happened and another part apparently hadn’t received the memo. Containment was probably the biggest example. If the player has successfully contained the threat, the attacker shouldn’t keep doing things afterwards just because one of those events had already been scheduled in the background. A lot of the work in this phase wasn’t about adding flashy new features. It was about making the simulation understand the difference between something that was going to happen and something that can still happen now. That work made TRACEWAKE feel dramatically more believable, and once I thought it was believable enough, I did the sensible thing and handed it to other people.
The private alpha changed the way I looked at the game
The first private alpha was a major moment for the project. Up until then, I’d obviously been testing TRACEWAKE constantly, but I also built it. I already knew what every button did, where every piece of information was hiding and what order things were probably supposed to happen in. Other people didn’t, and they immediately started doing things differently. They opened things in different orders, followed evidence I wouldn’t have followed first, interpreted parts of the interface differently and noticed things I’d stopped seeing because I’d been staring at the project for too long.
One of my favourite examples was a really small timestamp inconsistency. A tester noticed activity that appeared to occur after the threat had already been contained. It was tiny, but in an investigation game that matters. If the game tells you something happened at 10:42, then something happened at 10:42. The player needs to be able to trust the evidence. That feedback changed the way I approached development for a while. Instead of constantly thinking about what I could add next, I started asking whether I could trust what was already there. That kicked off a much bigger correctness and usability pass than I originally expected.
At some point you have to stop adding stuff
There is always another idea. Mail, more random events, more employee interactions, more applications, more environmental storytelling, more everything. I am extremely good at looking at a nearly finished system and deciding it probably needs one more system. So I eventually had to put a feature freeze on Blue Team, not because there wasn’t more I wanted to build, but because Aurelius had reached the point where the core loop actually worked. It was playable, it made sense and the next big thing wasn’t another Blue Team tool. It was finally time to build the other side.
Cyber Aware became TRACEWAKE
Around the same time, the project had also outgrown its original name. Cyber Aware did its job as a working title, but by this point it didn’t really describe what the game had become. It sounded educational, which is absolutely part of the project, but TRACEWAKE had started becoming something much more like a fictional world with its own organisations, characters, systems and consequences.
The name TRACEWAKE came from the idea of what gets left behind after something passes through: a wake, a disturbance, evidence that something happened even if whatever caused it is already gone. That clicked almost immediately, because that’s basically what both sides of the game are doing. The defender is trying to understand the wake left behind by an attacker, and the attacker is trying to work out what kind of wake they’re leaving behind themselves. Once the name landed, a lot of the rest of the project started becoming clearer too. Aurelius became more than “Blue Team.” Ghostline became more than “Red Team.” They started becoming two completely different ways of looking at the same world.
Aurelius
Aurelius is the structured side of TRACEWAKE. It’s corporate, procedural and accountable. You’re working inside an organisation where actions get recorded, decisions have consequences and eventually somebody is going to ask you to explain what happened. That’s what the Aurelius workstation had already been becoming, but we’ve pushed that idea further now. Rather than having the player finish an operation and get dumped back into a normal game menu, Aurelius is developing its own persistent operational environment.
The Aurelius Operations Hub, built around VIGIL, is effectively home between operations. That’s where future operations live, where story can continue, where characters can contact you and where the organisation can react to what has already happened. It gives Aurelius somewhere to exist outside an individual incident.
Ghostline
Ghostline was where things got really interesting. The easy version of Red Team would have been to take Aurelius, make it darker, add some red or green, rename the buttons and call it done. I really didn’t want to do that. If the player chooses Ghostline, it should feel like they have stepped into an entirely different organisation with a completely different culture.
That became BLACKWIRE. BLACKWIRE isn’t a corporate workstation. It’s an underground network built around contracts, handlers, intel, reputation, exposure, credits and loose ends you probably should have cleaned up three operations ago. The player isn’t logging into approved company software. They’re connecting to something that would prefer not to have a help desk.
More importantly, that difference isn’t just visual. Ghostline is starting to develop its own style of gameplay as well. You’re gathering intelligence on fictional people and systems, looking for opportunities, dealing with handlers and using the information you’ve collected to make decisions. Social engineering becomes part of that, but always within a fictional authored environment. I don’t want TRACEWAKE to become a guide for attacking real systems. What I do want is for the player to understand the thinking around an attack, why somebody becomes a target, why one piece of information matters more than another, why people are often part of the security problem and what gets left behind when you make a bad decision.
Two sides of the same incident
This is probably the biggest shift TRACEWAKE has undergone since development began. Aurelius and Ghostline aren’t really separate games. They’re two perspectives on the same world. A Blue Team player might see a suspicious login and spend half an operation trying to work out what caused it. A Ghostline player might know exactly what caused it because they were the person who set everything in motion. Something that looks like evidence on one side may have been a deliberate action on the other. A person who appears in one operation may turn up again later. A small decision could create a much bigger problem several operations down the road.
The more I started building around that idea, the more the campaign itself began to grow. Recurring characters, handlers, insiders, people making bad decisions for reasons that aren’t always simple, small wins, longer consequences and things that don’t magically disappear just because an operation ended. That’s where the name TRACEWAKE really started earning its place. The wake remains.
Alpha is still alpha
Getting to this point hasn’t magically made everything behave. Recent builds have still turned up plenty of issues: old contacts hanging around when they shouldn’t, state leaking between operations, navigation that made perfect sense to me and absolutely no sense to somebody seeing it for the first time, layout problems and buttons that technically worked but didn’t communicate their state clearly enough. Even the Choose a Side screen has had its own collection of tiny arguments with me. That’s alpha, and honestly this part of development has probably taught me more than the initial prototype did. Making a system work is one thing. Making it communicate what it’s doing clearly enough that somebody else trusts it is another. That’s the standard I’m trying to hold TRACEWAKE to now. The player shouldn’t need to know what I meant. The game needs to tell them.
So where is TRACEWAKE now?
TRACEWAKE is definitely still alpha. There are rough edges, systems that are still prototypes, operations that only exist on paper and an alarming amount of stuff sitting on my future-development list, but it finally feels like I can see the shape of the whole thing. This started as an experiment to see whether I could teach cyber security by letting someone actually perform simulated cyber security work. That became a Blue Team workstation, then a playable investigation, then something stable enough to survive private alpha testing. The feedback from that made the simulation stronger, and once I finally started building Ghostline, the whole project expanded again.
Ghostline forced TRACEWAKE to become bigger than the original idea. It stopped being just about responding to an incident and started becoming about seeing the same world from both sides, making decisions, living with the consequences and leaving something behind for whoever comes next.
TRACE. CONTAIN. PROTECT.
BREACH. COMPROMISE. EXPLOIT.
TRACEWAKE
Contain. Or Compromise.