Victory Point Race Rules

Overview

Victory Point Race (VPR) is a competitive card game for 2 or more players using the Vulnerability Vibes 2026 (VV26) card set. Each player brings 3 cards into play and takes turns activating them to attack opponents or defend themselves. The goal is to be the first player to earn 3 Victory Points (VP).

Setup

1. Shuffle the card pool and deal 4 cards to each player
2. Each player keeps 2 cards and discards 1 (3 cards remaining in hand)
3. Cards are passed one at a time clockwise around the table (player on your right), and each player receives 1 card
4. Each player now has 3 cards in play
5. Starting VC for each card: its printed starting VC

Turn Structure

1. Roll for activations: Roll 1d4 to determine how many card activations you can make this turn
2. Activate cards: Choose any of your 3 cards in any order and activate them (same card can activate multiple times if you have activations remaining, unless the card forbids it)
3. Declare attack targets before dice: Choose every required attack target before any activation dice, including preliminary defense and conditional rolls. Automatic targets need no selection. Autocomplete Disaster and Software Supply Chain retain their roll-then-select or allocate sequence; victim responses occur when the card requests them.
4. End turn: Pass to the next player

Win Conditions

Event	VP Earned
Your card reaches 0 VC	You earn 1 VP
Your attack deletes an opponent's card at 35 VC	You earn 1 VP
Your attack deletes your own or a friendly card at 35 VC	No VP is awarded
First player to 3 VP	Wins the game

Key Mechanics

• Attack actions: Deal damage to an opponent's card (move their VC toward 35)
• Defend actions: Reduce an opponent's card VC toward 0 (earning them VP when it reaches 0) or defend your own card
• Card activations: Most cards can activate multiple times per turn if you have activations remaining (exception: some cards forbid this)
• Self-damage: Some cards attack themselves or include themselves as targets when activated

Multiplayer Notes

• 3+ player games: Attacks that split across all players divide damage equally; remainder is lost
• Alliances: Players may temporarily cooperate to eliminate a threat, but only one player wins
• Card passing: Cards are passed clockwise (to your left); be strategic about which card you pass
• Optimal player count: 2-4 players for the best balance of strategy and interaction

Targets and action order

Weak Link declares its victim before defending; if that defense removes Weak Link at zero VC, its attack stops. Honey Pot and Shadow IT roll one d4 before checking their outcome branch. Script Kitty uses ordinary d4 minus one arithmetic.

Rubber Ducky lets the victim choose the original target or another card they control after a 1–2. Irresponsible Disclosure rolls for every card, including friendly cards; each six attacks the card currently being rolled for. SOC Analyst declares its attack victim and a different friendly defense card before dice.

Incident Response Team shows the number of remaining defense rolls, then repeats choose one card, roll, defend. Oversharer allows a second distinct card belonging to the same victim on eight, or skips that extra attack. It skips automatically if no second card exists.

Player-wide attacks and rescue effects

The Blackout first chooses where to add one d4: defend 3d4 and attack 2d6, or defend 2d4 and attack 2d6+1d4. It performs both actions. Divide the attack total evenly among all players and discard any remainder; each victim chooses one of their own cards to receive their entire share. The first time each Blackout reaches 35 VC, its owner may use a self-only 4d6 emergency defense.

Silver Bullet's first defense to zero, including defense from another card, instead triggers its rescue attack. Roll 3d4 once; every player receives the full total and chooses one of their own cards for all of it. Victims see the dice before choosing. This replacement triggers once per card per game.

Software Supply Chain rolls before the attacker allocates attack points among opponent players. Each victim then splits their allocated points among cards they control. On 11–12, automatically attack the highest-VC opposing card for the total plus two.

Traps, tokens and optional actions

Watering Hole traps stack without a limit and activate on another player's attack declaration. Defense and other non-attack actions do not trigger them. Each trap excludes its creator's cards; all eligible trap damage adds together in creation order. If traps cause deletion, award one deletion VP to the creator whose trap crosses the threshold, subject to the rule against friendly deletion VP.

Fedora Salesman gains one token per individual attack action. One attack hitting multiple cards grants one token; Autocomplete Disaster's separate card attacks grant separate tokens. Senate Hearing may add tokens and optionally cash out 60 for two VP in the same activation, once per game.

Sales Manager resolves attack damage first. Only if the victim survives may its owner choose to roll the victim's defense. Rolling Brownouts and Quality Assurance Tester never earn VP for deleting friendly cards.

Defense and split choices

Security Awareness Training requires an opponent among selected cards only when an opponent exists. 3rd-Party Risk Register divides damage evenly and discards an odd extra point.

Vulnerability Scanner rolls one d4 for the number of d6, then rolls all those d6 before selecting targets. Assign each chosen result to a separate card. If fewer cards remain, choose which dice to use and leave the rest unused.

Hacker chooses two different action types in either order. Attack, self-defense and ally-defense targets may overlap when each target is legal; ally-defense still requires another friendly card.