For OT / SCADA / SOC teams

Industrial systems you can break safely.

Physics-honest SCADA telemetry, Docker-delivered Virtual PLCs, and ground-truth labelled ICS attack datasets — all under the same cryptographically-sealed evidence chain as our synthetic-data products.

For an OT team that wants a realistic training dataset without taking the plant offline. For a SOC evaluating an IDS vendor with ground-truth labels the sales rep cannot edit. For an operator-training programme that needs a PLC your trainee can crash without a trip to site. Every run is sealed, reproducible, and byte-identical under the same seed, so benchmarks stay stable, regressions stay visible, and procurement reviews stay short.

Plant templates
67
MITRE ICS techniques
67
OT protocols
6
Outbound
0 calls
vplc / clarifier-2 · Modbus 502 · OPC-UA 4840live · 2 ms cycle
process trend · last 5 min3 tags
FT-101PT-204TT-309
FT-101 flow
342.7L/min
PT-204 pressure
5.42bar
TT-309 temp
62.1°C
LT-412 level
78.4%
AT-518 pH
6.92
MT-621 motor speed
1462rpm
MT-621 over-speed alarm · ack pending
cycle 482 911
$ rady evidence verify
✓ chain ok
  • · evidence.bundle.tar.zst47.2 MB
  • · manifest.jsonsha a4f2d8
  • · sealed contract.jsonsha 9c10ab
  • ▾ pcapng/
  • · scada-2026-04-13.pcapng42.7 MBsha 5e2c1a
  • ▾ signals/
  • · process.parquet3.4 MBsha 1b8d44
  • ▾ events/
  • · truth.ndjson11 KBsha 5e2c1a
  • · alarms.json2.1 KBsha 82a09f
  • · commands.json8.4 KBsha 31cf7e
  • · asset_inventory.json0.9 KBsha 70b1d2
  • · sbom.spdx.json14 KBsha ee04c1
  • · cryptographic hash.chain0.3 KBsha a4f2d8
9 / multi-part evidence hashed & chainedroot a4f2…d801

Three products. One physics engine. One evidence chain.

Telemetry, simulator, and attack data all share the same sealed-contract pipeline, so a Virtual SCADA run can be replayed inside an air-gapped Virtual PLC and labelled by the ICS Security engine — without leaving the platform.

Virtual SCADA

Real telemetry. Real protocols. Replayable physics.

Continuous, physics-honest sensor telemetry over Modbus/TCP, OPC-UA, BACnet, MQTT, and DNP3. Drives downstream analytics, IDS, or operator-training workloads — and feeds the same evidence chain.

  • Deep plant-template library: water, power, oil & gas, manufacturing, HVAC
  • Realistic disturbance library: storm-surge, blower failure, sensor drift
  • pcapng + signals.parquet + alarms.json sealed per run
Open product page

Virtual PLC

Air-gapped PLC simulation, Docker-delivered.

Enterprise Docker image for air-gapped training, red-team exercises, and OT vendor PoCs. Runs inside the customer's VPC — no telemetry, no logs, no model weights leave.

Open product page

ICS Security

Ground-truth attack data for SOC training.

MITRE ATT&CK ICS v15 attack datasets with per-event ground-truth labels, a full pcapng wire capture, a signals.parquet process trace, and a benign-to-attack mix you dial per scenario. Detection engineers score precision and recall mechanically against the truth file — no hand-mapping, no drift. Stand-alone for IDS / SIEM training, or chained on top of a Virtual SCADA run for a full cyber-range scenario against a live, physics-honest plant.

  • Per-event MITRE technique ID + tactic ID + payload hash + target asset
  • Configurable benign / attack ratio per scenario, seeded and byte-stable
  • pcapng + truth.ndjson + signals.parquet sealed into a single .tar.zst
  • Verifiable offline with the evidence verifier — no network, no phone-home
Open product page
scada/run-2841·truth.ndjson
14:30:00 → 14:36:00 UTC
signals.parquet · pump-3.discharge_pressurekPa
MITRE ATT&CK ICS · ground-truth events6 events
T0807Cmd inject
T0830MITM
T0832View spoof
T0836Param modify
T0878Alarm suppress
T0889Modify program
pcapng
42.7 MB · 218 411 frames
truth.ndjson
6 events · sha 5e2c1a…
cryptographic hash root
a4f2…d801

Plant templates we ship out of the box.

Each template bundles calibrated response models for every analog loop plus event-driven state machines with safety interlocks for every discrete state, mapped to a real protocol surface.

Water & Wastewater

Pump / clarifier / blower / aerator templates with realistic chemistry.

Power & Grid

Substation, breakers, RTU telemetry, SCADA/EMS integration patterns.

Manufacturing

Conveyor, stamping, robotic-cell templates with discrete-event behaviour.

Oil & Gas Midstream

Pipeline, compressor, custody-transfer skids with regulator-grade dynamics.

Building / HVAC

BACnet AHU, VAV, chiller plant; occupancy and outside-air-driven cycles.

Custom plant

Bring your P&ID — we calibrate a response model per loop and ship the pack.

Cyber-range chain

SCADA + ICS, end-to-end, in one bundle.

Step 1

Live SCADA telemetry

A realistic disturbance schedule drives process dynamics in real time.

Step 2

Attack injection

Inject command-injection, replay, MITM events on real protocol traffic.

Step 3

IDS / SOC capture

pcapng captures the wire; parquet captures the process; truth.ndjson labels both.

Step 4

Sealed evidence

cryptographic hash-chained .tar.zst — verifiable offline by your SOC platform owner.

Posture that satisfies OT security review.

Per-deployment key

Evidence chain signed locally; no licence-server phone-home.

Real protocols

5 SCADA protocols (Modbus, OPC-UA, BACnet, MQTT, DNP3); VPLC adds IEC 61850.

Physics honest

Per-tag calibrated response model; event-driven state machines with safety interlocks for discrete state.

Single Docker image

~280 MB distroless, signed with cosign, offline registry supported.

Bring your P&ID. We’ll ship a sealed cyber-range bundle.

45-minute working session: you describe a plant and one or two adversary behaviours, we generate the SCADA run and the labelled attack mix, and you keep the cryptographic hash-sealed bundle to load into your IDS/SOC pipeline.

Book a session See pricing
$ rady evidence verify
✓ chain ok
  • · evidence.bundle.tar.zst47.2 MB
  • · manifest.jsonsha a4f2d8
  • · sealed contract.jsonsha 9c10ab
  • ▾ pcapng/
  • · scada-2026-04-13.pcapng42.7 MBsha 5e2c1a
  • ▾ signals/
  • · process.parquet3.4 MBsha 1b8d44
  • ▾ events/
  • · truth.ndjson11 KBsha 5e2c1a
  • · alarms.json2.1 KBsha 82a09f
  • · commands.json8.4 KBsha 31cf7e
  • · asset_inventory.json0.9 KBsha 70b1d2
  • · sbom.spdx.json14 KBsha ee04c1
  • · cryptographic hash.chain0.3 KBsha a4f2d8
9 / multi-part evidence hashed & chainedroot a4f2…d801