Threat Simulations

What are threat simulations?

Threat simulations are controlled exercises in which an organisation emulates realistic cyberattacks to test how well its people, processes and systems can detect, analyse and handle a threat. Whereas a penetration test mainly looks for vulnerabilities, a threat simulation measures whether the defence works: does the SOC see the attack, does the team know what to do, and are the right people involved in time? In OT environments this must happen without putting production at risk, using scenarios based on real attacks on industrial installations.

🧠 How do threat simulations work?

Every threat simulation follows the same cycle, whatever its form:

1. Define the goal and scope - what question should the exercise answer? For example: do we detect misuse of a legitimate account on an engineering station?
2. Draw up a scenario - based on real techniques from MITRE ATT&CK for ICS or MITRE ATT&CK and on threat intelligence about the TTPs of relevant threat actors
3. Execute - by internal teams or external parties, such as a red team
4. Detect and respond - the blue team and the SOC must recognise and analyse the attack and handle it according to the incident response plan
5. Evaluate (debrief) - what was seen, what was missed, and how fast? The findings lead to new detection rules, adjusted procedures and training

Simulations range from a tabletop exercise around the table to live tests in a segregated test environment and purple team exercises in which attack and defence work together.

Threat simulations are an essential part of security maturity and of readiness for incident response.

🔍 What types of threat simulations are there?

Discussion-based and operations-based exercises complement each other. The US Homeland Security Exercise and Evaluation Program (HSEEP) and NIST SP 800-84 from 2006 draw the same line: a tabletop exercise uses no equipment, while in a functional exercise participants actually perform their tasks.

🔄 How do threat simulations differ from a pentest and a red team?

A pentest answers the question “can an attacker get in?”, a threat simulation the question “does our security work once they are in?“. A red team test is one form of threat simulation, but not the only one.

Threat simulations thus expose weaknesses that stay invisible in an audit or pentest, such as an alarm that does fire but is followed up by nobody.

🏭 How are threat simulations applied in industrial networks?

OT scenarios focus on the route from the office network to the physical process. Examples:

• Misuse of legitimate accounts - an attacker logs in to an engineering station with stolen credentials and changes PLC logic
• Ransomware spread - encryption jumps from IT to the OT network via shared servers
• Lateral movement - testing the segmentation between the SCADA system and field level (PLC, drives) according to the Purdue Model
• Living off the land - using standard Windows tools, as Volt Typhoon does, to see whether logging and alerting in the SIEM pick this up
• Process manipulation via Modbus - a scenario based on FrostyGoop, which left more than 600 apartment buildings in Lviv without heating in January 2024
• Escalation between IT and OT - who decides to shut down an installation, and how quickly is that decision made?

In an OT context, live simulations are almost always run on an offline test rig, a digital twin or with read-only monitoring of the production environment. Since September 2023 there has been Caldera for OT: open-source plugins from MITRE and CISA that execute MITRE ATT&CK for ICS techniques over BACnet, Modbus and DNP3, later extended with IEC 61850 and PROFINET.

🔧 How do you set up an OT threat simulation step by step?

1. Choose a realistic scenario - start from the cyber kill chain or the ICS matrix and from incidents in your own sector, not from the most spectacular attack story
2. Agree the rules of engagement - which systems are in scope, which are off limits (always the SIS), who may stop the exercise and with which code word?
3. Coordinate with the process owner - a process engineer belongs at every live exercise, and maintenance shutdowns are the safest moment
4. Have an abort procedure - the incident response plan does not prevent disruption; a pre-agreed stop criterion does
5. Measure the defence - record per technique whether NDR, EDR or the OT IDS raised an alert, and how much time passed between action and detection
6. Record everything - log every step and keep the SIEM data separate, so that a real attack is not dismissed as part of the exercise; SOAR playbooks can be tested during the exercise
7. Debrief within a week - turn the findings into concrete actions with an owner, and repeat the scenario after the improvements

A common cadence is one tabletop exercise a year for management and the crisis organisation, plus one or more technical exercises a year for the SOC and the OT administrators.

🧱 Which rules and frameworks apply in the Netherlands and the EU?

• NIS2 and the Dutch Cybersecurity Act - Article 21 of NIS2 requires policies and procedures to assess the effectiveness of cybersecurity measures; exercising is the most direct way to demonstrate this. The Dutch Cyberbeveiligingswet entered into force on 15 August 2026.
• IEC 62443 - IEC 62443-3-3 asks, among other things, for security functionality verification (SR 3.3), which combines well with a targeted simulation
• DORA and TIBER-EU - under DORA, which has applied since 17 January 2025, designated financial entities must commission a threat-led penetration test at least once every three years. The technical rules (Delegated Regulation (EU) 2025/1190, applicable since July 2025) require an active red team phase of at least twelve weeks. The ECB’s TIBER-EU (2018, revised in February 2025) builds on TIBER-NL from De Nederlandsche Bank.
• National exercises - the Dutch NCSC and the NCTV organise the cyber exercise ISIDOOR; ISIDOOR IV in November 2023 involved more than 3,000 participants from 120 organisations
• International examples - the North American electricity sector exercises every two years with GridEx; more than 370 organisations took part in GridEx VIII in November 2025. Locked Shields, run by the NATO centre of excellence CCDCOE in Tallinn, has been held since 2010.

Exercising also touches on business continuity and the crisis communication plan: a good simulation tests not only the technology but also who informs the press, customers and the regulator.

❓ Frequently asked questions

What is the difference between a threat simulation and a tabletop exercise?

A tabletop exercise is one form of threat simulation, in which participants discuss an attack scenario around the table without touching any systems. Other threat simulations, such as purple teaming or a red team test, actually execute attack techniques. Many organisations start with a tabletop exercise and then move on to technical simulations.

Is a threat simulation in an OT environment safe?

A threat simulation in OT is safe as long as live attack techniques are only executed on a test rig or digital twin and the production environment is at most monitored passively. Rules of engagement, a stop criterion and a process engineer at the exercise are essential. Safety systems such as the SIS should always be out of scope.

How often should an organisation run threat simulations?

A common cadence is at least one tabletop exercise a year plus one or more technical threat simulations, with an extra exercise after major changes to the network or the organisation. Financial entities designated under DORA must carry out a threat-led penetration test at least once every three years. Automated breach and attack simulation can even run continuously in IT.

What is breach and attack simulation (BAS)?

Breach and attack simulation is software that executes known attack techniques automatically and repeatably to check whether security controls block or detect them. BAS complements human red teams because it keeps measuring between manual tests, but it does not invent new attack paths. In OT, BAS is almost only used on test rigs because of the risk.

Which tools do you use for threat simulations?

Threat simulations often use MITRE Caldera and Atomic Red Team, with the MITRE ATT&CK and ATT&CK for ICS matrices as a common language. Caldera for OT adds industrial protocols such as Modbus, DNP3 and BACnet. For tabletop exercises, CISA offers free Tabletop Exercise Packages, including scenarios for industrial control systems.

Who takes part in a threat simulation?

A threat simulation involves the blue team or SOC, the OT administrators, a process engineer and the crisis organisation, supplemented by a red team or external party that carries out the attack. A small control team guards the rules of engagement and can stop the exercise. In tabletop exercises management also takes part, because that is where decisions on shutdowns and communication are made.

📌 In summary

Threat simulations test whether detection and response work by emulating realistic attacks in a controlled way, from a tabletop exercise around the table to a red team test or purple teaming on a test rig. In OT that means scenarios based on real attacks, the SIS kept out of scope, live techniques only in a test environment and a debrief that leads to concrete improvements.