NetSimOT v1.0 — ICS/OT Attack Simulator

INCOMING

No action required. The clock is paused.

RESPONSE OPTIONS

An action only counts if it finishes before the attacker reaches this asset, so slow options need real lead time. Acting on Level 1 or Level 0 assets disrupts the physical process — that cost is charged immediately, whether or not the attack ever arrives.

Facilitator Console

SESSION SETUP & SCENARIO AUTHORING

DECISION TIMER

When the clock expires the phase resolves automatically as a breach, exactly as an unmade decision would. Turn it off for teaching sessions where you want discussion time.

IMMERSION

OPENING CONDITIONS

A pre-existing weakness rolled before the attack begins, so the same playbook does not start from the same hand twice. Pin a specific one to run a controlled comparison.

CAMPAIGN MODE

Consequences persist between runs. You earn operating budget for surviving, spend it on controls, and carry reputational damage forward. Resetting the simulator does not clear a campaign.