Practising the decision, not only the plan
Crisis exercises for OT environments, at the table or on real controllers in our model city YekCity. We build the scenario from your plant, not from a catalogue.
The one decision no plan makes for you
Contingency plans describe procedures, and they get written in calm conditions. The situation in which they matter looks different: at three in the morning it is unclear whether the encryption has already reached the control level, and somebody has to decide whether the plant comes off the network.
That decision is more expensive in OT than in IT. A data centre can be shut down and brought back up. A furnace, a substation or a train cannot, and the damage from a hasty shutdown can exceed the damage from the attack.
That judgement can be practised, and before it arises.
Deciding without knowing all the facts
A tabletop exercise runs at the table, with the people who would decide on the day: operations management, maintenance, IT, security, communications and the management board. We set a scenario and inject a new situation every ten minutes.
The situations are deliberately incomplete. An engineer reports that an operator station has stopped responding. Ten minutes later a second site fails. After that a journalist calls. The point of the exercise is not to find the right answer but to notice which information would have been missing in order to find it.
What regularly stands out: the technology is rarely the problem. What is missing is the authority to stop a plant, or it is unclear when the reporting clock starts.
From the table to real controllers
An exercise does not have to end on paper. We have rigs on which an attack really runs, without your operation noticing anything.
Tabletop
Half a day to a full day, without technology. Tests decision paths, reporting chains and responsibilities. The usual way in, because it costs least and reveals most.
Exercise on YekCity
Our model city with real controllers, built from the analysis of real attacks on power and utility networks. Made for exactly this: the attack really runs, so does the detection, and nobody loses production.
Exercise in the plant
In an agreed window, on spare or lab rigs of your own technology, with abort criteria fixed beforehand. Only where the other two formats are not enough.
How a crisis exercise is prepared
The preparation decides the value of the exercise, not the day itself.
A scenario from your plant
Not a standard case. We take your topology, your protocols and an attack route that would actually be possible at your site. A preliminary conversation and a look at the transitions is enough for that.
Roles and observers
Who sits at the table, who plays the outside world, who records. Observers do not intervene; they note when which decision was made and on what basis.
The day itself
The situation develops on a beat, with injects from the press, the regulator and suppliers. No winning, no losing, and expressly no assessment of individuals.
Write-up
Verbally the same day, in writing afterwards: which decision hung on which missing information, and what should change in the contingency plan as a result.
From research, demonstrators and real plants
The scenarios come out of the same work as our OT monitoring: substations, control rooms and interlocking landscapes, and the analysis of documented attacks on supply networks and rail systems.
The rigs come out of our research. YekCity was built from the analysis of real attacks on power and utility networks and represents a model city with real controllers. For crisis exercises at utilities and municipalities it is the rig on which a scenario can be played through completely: from the first telegram that stands out to the question of whether to shut down.
The scenario itself we build for you. An exercise that works with somebody else's topology and somebody else's protocols tests nothing that could happen at your site. We take your plant as the template and put the attack route on it, even when the exercise runs on YekCity.
Common questions about OT exercises
The tabletop exercise yes, it touches no plant. Exercises with a real attack run on our demonstrators or on your spare rigs. In the production plant only in an agreed window and with abort criteria fixed in writing beforehand.
Not only IT. The exercises that produce something have operations management, maintenance, communications and somebody with decision-making authority at the table. The gaps sit exactly at that seam.
Once a year as a tabletop, plus a technical exercise when something substantial has changed: a new plant, a new service provider, a new control system. NIS2 requires regular review but names no interval.
Then the exercise is the better way in than the writing. A plan that comes out of a situation played through is shorter in the end, and it gets used.
Certifications and memberships.
Talk to us.
A first conversation usually takes 30 minutes. We look at where you stand and tell you frankly whether we are the right partner.