Discuss an engagement
Menu

Adversary Simulation

OT/ICS Adversary Simulation

Simulate adversarial attempts to breach IT environments and pivot into OT/ICS systems to assess the resilience of your critical infrastructure.

Discuss an engagement
Objective
Hold the IT-OT boundary
Maturity
IT-OT converged estate
Approach
IT-to-OT pivoting, safely
Result
Segmentation evidence

Protecting critical infrastructure

Operational Technology (OT) environments, including SCADA, ICS, and industrial systems, are increasingly interconnected with IT networks, exposing them to new threats. Adversaries targeting critical infrastructure seek to exploit this convergence, breaching IT environments to pivot into OT systems with the goal of disrupting or manipulating industrial processes.

SilentGrid's OT/ICS Adversary Simulation replicates these attack paths, testing how effectively your organisation's segmentation, monitoring, and response capabilities prevent adversaries from bridging into OT environments. Our engagements uncover segmentation weaknesses, misconfigured firewalls, and insufficient network controls that expose OT to external compromise.

Why OT/ICS security matters

Traditionally isolated OT systems are now integrated with IT networks to enable efficiency, automation, and remote monitoring. This creates new attack surfaces for adversaries capable of pivoting from the IT side.

IT-OT convergence

Creates new attack surfaces for adversaries

Ransomware groups

Increasingly target OT environments for operational disruption

Nation-state actors

Seek to manipulate ICS protocols and gain persistence

Operational impact

Breaches can lead to production halts, physical damage, and safety incidents

Is OT/ICS adversary simulation the right fit?

The exercise is built around the IT-OT boundary, so it assumes there is industrial process to protect and a corporate network connected to it. Where the environment is corporate IT alone, assumed breach or red teaming covers the same ground without the industrial scope.

This service is ideal for organisations that

  • Operate ICS, SCADA, or industrial networks managing critical infrastructure
  • Have IT-OT converged environments but lack visibility into lateral movement risks
  • Need to assess firewall and segmentation controls at the IT-OT boundary
  • Are concerned about nation-state threats or targeted ransomware disrupting operations

OT adversary simulation methodology

SilentGrid employs a structured adversarial engagement that mirrors the lifecycle of real-world OT-focused attacks.

  1. 01

    Reconnaissance and target profiling

    • Map the IT-OT boundary and interaction points
    • Perform OSINT and network enumeration to locate exposed remote access, HMIs, and ICS interfaces
  2. 02

    Initial compromise (IT environment)

    • Simulate initial IT compromise through phishing, credential theft, or endpoint exploitation
    • Establish footholds in IT environments with the goal of reaching ICS assets
  3. 03

    Lateral movement to OT networks

    • Attempt to bypass segmentation through dual-homed devices, misconfigured firewalls
    • Leverage RDP, SSH, SMB, and industrial protocols (Modbus, DNP3, OPC UA) to move laterally
  4. 04

    Persistence and control escalation

    • Deploy custom ICS-focused malware or simulate implanting rogue scripts in PLCs
    • Attempt to modify ladder logic, SCADA parameters, or issue rogue actuator commands in testing
  5. 05

    Critical impact and safety testing

    • Simulate manipulation of critical assets without disrupting live operations
    • Validate that safety instrumentation systems (SIS) and fail-safes engage properly

Key engagement objectives

Our OT/ICS simulations reflect the tactics of advanced persistent threats, ransomware actors, and insider threats:

Identify IT-to-OT pivoting paths

Discover how adversaries can move from corporate networks to industrial systems

Simulate SCADA and PLC attacks

Test resilience of control systems against targeted manipulation

Test segmentation controls

Validate effectiveness of firewalls and network separation

Assess incident response

Evaluate readiness for OT-specific security incidents

Key benefits of OT adversary simulation

Identify segmentation gaps

Test the effectiveness of firewalls, VLANs, and segmentation rules

Expose dual-homed devices

Discover insecure engineering laptops, remote access solutions, and bridging devices

Validate OT incident response

Evaluate your ability to detect, respond to, and contain OT-targeted attacks

Protect critical operations

Ensure industrial processes and safety mechanisms are resilient against compromise

Run it continuously

Test the IT-OT boundary once, or all year.

A single OT/ICS simulation shows whether an attacker on the IT side can pivot into SCADA and control systems. Where the boundary changes often, CAOS (Continuous Adversary Operations Service) runs adversary cycles through the year with objectives set in OT as well as IT.

Explore CAOS

Deliverables and reporting

SilentGrid delivers reports that offer both technical depth and strategic insights for protecting industrial environments:

Attack path documentation

Full breakdown of how adversaries moved from IT to OT environments

OT segmentation analysis

Identification of firewall misconfigurations, dual-homed devices, and network paths

Critical vulnerability report

ICS-specific misconfigurations, insecure protocols, and device-level weaknesses

Incident response evaluation

Assessment of your team's ability to detect and contain OT-targeted attacks

Why SilentGrid

SilentGrid's consultants are hand-picked, and between them they have delivered red team engagements globally over decades, including CBEST for UK financial institutions and CORIE engagements in Australia. Their sector experience covers banking and financial services, insurance, government, critical infrastructure and healthcare.

Consultants find 0-day vulnerabilities in commercial software and speak or teach at security conferences. That research produces the custom tooling used to bypass EDR and network controls, and keeps techniques current with the threat actor being simulated. The methodology follows concepts set out in NIST, OWASP, PTES and OSSTMM.

CREST ANZApproved company

Individual credentials across our team include

  • OSEE
  • OSCE3
  • OSED
  • OSEP
  • OSWE
  • GXPN
  • CRTO
  • CRTE
  • CRTP
  • OSCP
Meet the team

From our research

What we have found doing this.

All research

Common questions

What is OT/ICS adversary simulation?

OT/ICS adversary simulation tests critical infrastructure the way an attacker targeting industrial operations would: it starts with a compromise of the corporate IT network and tries to cross into OT over RDP, SSH, SMB and industrial protocols such as Modbus, DNP3 and OPC UA. Manipulation of SCADA and PLC assets is simulated without disrupting live operations.

What does an OT/ICS adversary simulation test?

It replicates the attack paths adversaries use to breach an IT environment and pivot into OT, testing how effectively your segmentation, monitoring and response capabilities prevent that bridge from being crossed.

Will testing disrupt live operations?

No. Manipulation of critical assets is simulated without disrupting live operations, and part of the exercise is validating that safety instrumentation systems and fail-safes engage properly.

Where does the simulation start?

In the IT environment, with a simulated initial compromise through phishing, credential theft or endpoint exploitation. Footholds are established with the goal of reaching ICS assets, after which segmentation at the IT-OT boundary is tested.

Which industrial protocols and systems are covered?

Lateral movement is attempted over RDP, SSH, SMB and industrial protocols including Modbus, DNP3 and OPC UA, and the exercise covers SCADA parameters, PLC logic, HMIs and exposed remote access.

Why does OT need testing if it used to be isolated?

Traditionally isolated OT systems are now integrated with IT networks to enable efficiency, automation and remote monitoring. That convergence creates new attack surfaces for adversaries capable of pivoting from the IT side.

Does the exercise test our detection and response?

Yes. Readiness for OT-specific security incidents is assessed, including your team's ability to detect, respond to and contain attacks that target industrial systems.

What do we receive at the end?

Attack path documentation covering the move from IT to OT, an OT segmentation analysis identifying firewall misconfigurations and dual-homed devices, a critical vulnerability report on ICS-specific weaknesses, and an incident response evaluation.

Secure your industrial networks

Get started with OT/ICS adversary simulation

Protect critical infrastructure against sophisticated industrial threats

SilentGrid helps secure industrial networks against adversaries targeting critical infrastructure through realistic attack simulations.

Discuss an engagement Explore adversary simulation