Roleplay setups¶
Guides for running fictional scenarios that explore threat models, attacker behaviour, and what happens when things go sideways
These roleplay guides are designed to help workshop participants explore what digital threats look like in practice. They’re fictional, anonymised, and flexible—but they’re built from real patterns seen in cases of intimate partner abuse. Each scenario introduces:
A situation (someone in trouble)
A threat model (what’s at risk, from whom)
A challenge (what went wrong or is about to)
Choices (what might make things better or worse)
They’re meant to be talked through, acted out, argued over, and rebuilt. You don’t need drama school qualifications—just curiosity, a willingness to imagine what it feels like to be in someone else’s digital skin, and respect for the emotional weight of the material.
How to use roleplay in workshops¶
Choose your format¶
Quickfire decision trees – present a scenario and pause at key decisions. What would you do next? Why?
Split groups – one side roleplays “defenders”, the other “attackers” (or the abuser’s tactics). Debate strategy.
Timeline breakdowns – map out what happened over time. Where were the red flags? Where could action have helped?
Full improvisation – ideal for confident groups: act out the scenario live, with a facilitator moderating the flow.
Prep the ground¶
Remind everyone: these are fictional scenarios, but they reflect real risks. Participants are free to step out or opt out at any time.
Set ground rules: respect, confidentiality, no laughing at anyone’s discomfort.
If possible, have a peer support worker or mental health contact on hand.
Debrief like it matters¶
Always follow with a group discussion.
Ask what surprised people. What felt real? What would they do differently next time?
Let people air emotions, frustrations, and connections to their own experiences—but don’t push for disclosures.
Scenario ideas (examples)¶
“He set up my new phone.”¶
Threat model: The abuser installed remote access tools on the target’s new phone under the guise of “helping.”
Challenge: They’ve since left, but the phone battery drains quickly, random pop-ups occur, and GPS is always mysteriously on.
Roleplay angle: Defenders brainstorm how to detect and remove spyware without tipping off the attacker (who still has shared custody of a child).
“She knew what I googled.”¶
Threat model: A friend-turned-aggressor has access to browsing habits, possibly via a compromised router or synced Google account.
Challenge: The person notices conversations and ads reflect private searches.
Roleplay angle: Map the potential leaks. Assign attackers to plan surveillance routes; defenders to cut them off.
“Deepfake at the door.”¶
Threat model: The target receives a convincing video appearing to show them in a compromising situation.
Challenge: It’s fake—but others believe it.
Roleplay angle: What are the response options? (Legal, emotional, technical.) Is it better to engage or go dark?
“Good malware, bad intentions.”¶
Threat model: A team is asked to analyse a piece of malware left on a shared machine. It doesn’t cause harm—but it does track, screenshot, and signal back to a server.
Challenge: Should it be reverse-engineered, reported, or preserved as evidence?
Roleplay angle: Encourage different reactions: defender, legal advocate, technician, survivor. Debate the consequences.
Notes for facilitators¶
Don’t assume everyone’s coming in with a tech background. Offer cheat sheets or simple explainers alongside.
If your group is quiet, ask “what would make this situation worse?” before pivoting to solutions. People often find it easier to start with worst-case thinking.
Take breaks. Dark humour helps. Tea helps more.
Roleplay is a safe way to practise unsafe worlds. Survivors are already threat analysts by necessity—these sessions help formalise that knowledge into something shareable, buildable, and powerful.
Let me know if you want printable versions, worksheets, or editable templates for these.