New simulation platform lets energy operators train against realistic cyberattacks

“Implementing state‑of‑the‑art mechanisms for authentication and integrity protection in remote access and update procedures can therefore significantly enhance system security,” Serror stated.

Presented in the study “PowerRange: An immersive cyber range for power grid operators,” published in the International Journal of Critical Infrastructure Protection, the PowerRange virtual simulation platform is built on the open-source Wattson testbed, which allows safe execution of multi-stage cyberattacks and countermeasures in configurable power grid scenarios, integrating both operational technology (OT) and information technology (IT) networks with power generation and distribution processes.

PowerRange extends this into a realistic, immersive training environment tailored to operators’ needs, the academics said. It enables practical application of security measures, helps identify usability weaknesses, and engages all organizational levels, from management to IT and control room staff. Two pilot training sessions provides preliminary feedback, highlighting the importance of communication and coordination.

The scientists explained that designing cyber ranges for cyber-physical systems (CPSs), like power grids, requires modeling not only IT infrastructure but also control centers, field devices, and physical processes, with modular, extensible architectures and orchestration modules ensuring flexibility and seamless integration.

They also noted that effective training must accommodate diverse users, from IT specialists to management, and support both individual and collaborative exercises. Cyber ranges should replicate standard IT protocols alongside domain-specific OT protocols and training environments must be realistic and comprehensive, covering offensive and defensive strategies while engaging all organizational roles.

The platform also relies on a Virtual Control Center (VCC) that provides operators with intuitive interfaces, synchronized across multiple users, visualizing grid state, issuing control commands, and incorporating state estimation. The platform supports real-world cyberattacks, including reconnaissance, lateral movement, privilege escalation, denial-of-service (DoS), man-in-the-middle (MITM), and false data injection, with modular, configurable attack blocks.

Trainers can adapt scenarios dynamically, combining attacks based on participant actions and defensive measures. Together, these features create a controlled yet highly immersive environment for practicing detection, response, and coordination during cyber incidents, the researchers stressed.

Furthermore, the platform models grid elements as nodes and edges, capturing assets, connections, and annotations, and updates measurements through power flow computations. Users can customize controllability, observability, and scenario complexity through rule-based configurations, with derived scenarios being exportable as Wattson-compatible configurations.

The research team also conducted two pilot sessions with professional operators and said the trainees initially struggled with information flow and tool familiarity, but gradually coordinated effective responses. Feedback also emphasized the value of hands-on experience, realistic scenarios, and cross-team communication.

“Regularly conducted training improves the practical application of cybersecurity measures and fosters better communication and coordination among key stakeholders,” the research team said. “These insights highlight the necessity of addressing the human factor alongside technological advancements to strengthen the overall resilience of grid operations.”

“In general, the distributed nature of renewable assets tends to improve the overall resilience of power systems against targeted cyberattacks, since compromising a few assets usually does not affect the overall system stability,” Serror added. “However, the widespread deployment of similar hardware and software components, such as identical inverters, may create systemic vulnerabilities. In such cases, a coordinated cyberattack could exploit a shared weakness to compromise many assets simultaneously and potentially affecting overall system stability.”

“We anticipate a continued rise in cyber attacks targeting energy systems, as incidents in the energy sector have been gradually increasing over recent year,” he concluded. “However, physical attacks and sabotage, such as those unfortunately occurring in Ukraine, my remain even more disruptive to energy supply, particularly when combined with coordinated cyber attacks.”