OT Security Lab for ICS networks

GRFICSv3 is a FREE and open source OT security lab with realistic networking and a 3D process simulation for training and learning ICS security

ICS security resources

Documentation and guidance to practice secure coding for various PLC vendors

AI-powered SOC for OT/ICS networks — 6 autonomous agents, MITRE ATT&CK mapping, Suricata/Zeek ingestion, human-in-the-loop response, 330+ tests. Open-source alternative to Claroty/Dragos for SMBs.

ICS Incident Response Automation Framework Python framework for executing automated incident response playbooks in ICS/SCADA environments. Supports network isolation, forensic preservation, logic restoration, and safety system interventions. Designed for defenders, researchers, and red team simulations in operational technology networks.

All-in-one ICS/SCADA hacking, red teaming, malware analysis, detection, and lab architecture cheat sheet

Comprehensive methodology, checklists, and hardening guides for ICS/OT Cybersecurity Audits based on IEC 62443 & NIST SP 800-82. Focus on defensive security practices and risk mitigation in industrial environments.

ICS IoT OT Hardening Framework — Industrial Cybersecurity Platform featuring an asset discovery scanner, SNMP monitor, incident timeline, vulnerability scanner, compliant with IEC 62443, NIST 800-82, NERC CIP, and MITRE ATT&CK ICS, includes 20 demo devices and a settings panel

OPC UA Security Scanner

Multi-protocol ICS security scanner detecting vulnerabilities in Modbus, S7, DNP3, BACnet, MQTT & SNMP. Features configurable scan intensities, safe-by-default operation & comprehensive reporting. Identifies misconfigurations & security flaws in industrial environments.

Templates and tools to enable continuous OT security threat modeling

The most comprehensive open-source mapping of OWASP GenAI risks to industry frameworks - 70 mapping files, 25 frameworks, 1,016 controls, 125 incidents, ML classifier pipeline. Source lists: LLM Top 10, Agentic Top 10, DSGAI 2026. EU AI Act, NIST, ISO, SOC 2, FedRAMP, DORA, OT/ICS, MITRE ATLAS.

MCP_HACK//26 — Industrial Zero-Trust AI: T-IA Connect + AgentGateway for Siemens TIA Portal

Modular ICS/OT cybersecurity toolkit for Modbus/TCP, Siemens S7Comm, and DNP3. Generates JSON/HTML reports and executive dashboards from PCAPs and safe Modbus scans. Includes sample PCAPs and ModbusPal for testing.

The World's Largest OT/ICS/SCADA Security Assessment Framework. Python-First. 976+ modules, 150+ vendors, 50 protocols, MITRE ATT&CK for ICS 82%, SAST/LLM, 26 ICS malware TTPs.

Evasion-focused IDS evaluation: IT/OT CTF testbed with open datasets (PCAPs, logs, alerts, writeups) from event day

NTCIP 1202 traffic-signal attack lab: emulated controller + SUMO intersection. snmpset commands drive a live SUMO-GUI window.

OT cybersecurity compliance explorer — IEC 62443, NIST SP 800-82, MITRE ATT&CK for ICS, NACSA Act 854 for NCII operators

Perimeter security exploitation framework — 164 modules covering FW, NGFW, UTM, WAF, VPN, NAC, LB, and OT/ICS firewalls (Fortinet, Cisco, Palo Alto, F5, Citrix, Check Point, SonicWall, Ivanti, Siemens, Moxa, +13 vendors). GPU-accelerated, ML-driven, async concurrency, Rich TUI.