CyberICS Demo Library

The largest purpose-built OT/ICS tabletop library available. Browse by sector, difficulty, compliance framework, or MITRE ATT&CK technique. Filter, preview, and launch in seconds.

Run a structured tabletop with any number of participants joining from a browser via session code — no accounts or installs needed. Host controls pacing, collects responses, and scores in real time.

Build custom tabletop scenarios from scratch using the 5-step wizard, or let the AI generate a complete multi-module exercise from a single prompt. Clone, share with your team, or import from JSON.

Upload your OT/ICS network topology in 5 formats (Nmap XML, CSV, Zeek logs, Suricata EVE, or JSON). CAAT auto-classifies assets to the Purdue Model, detects architecture gaps, maps each gap to specific OT IR skills with MITRE D3FEND countermeasures, and deep-links directly to the matching exercise — all from a single topology scan.

Generate a carrier-specific 7-page underwriting report built from your actual exercise data. Each report includes executive summary, exercise evidence log, gap analysis, risk quantification, and a signed attestation page.

After an exercise ends, the AI analyzes step notes, participant responses, gap scores, and MTTD/MTTR data to produce a structured narrative AAR — covering strengths, gaps, and prioritized recommendations.

The AI coach monitors discussion quality during live exercises and surfaces probing questions, timing adjustments, and gap-capture prompts in real time — keeping facilitators sharp and discussions productive.

Add an unexpected scenario twist mid-exercise — the AI generates a contextual inject based on the current scenario, sector, and participant roles. Broadcasts instantly to all participants via Supabase Realtime.

Six standalone AI tools for deeper analysis: Board Report Generator produces executive-ready risk summaries, Gap Forecast predicts which gaps go critical in 90 days, Inject Library generates reusable scenario content on demand.

Generate a 6-page audit-ready PDF for any compliance framework in one click. Each package includes a cover page, controls mapping, exercise log, gap analysis, remediation timeline, and a signed attestation page — built from your real exercise history.

Four tools that convert CISA data exports directly into tabletop exercises: import Crossfeed attack surface scans, RedEye red team campaigns, Malcolm/Zeek network logs, or CSET assessments — and generate targeted exercises from each.

Run tabletop exercises based on 12 real, CISA-documented OT/ICS incidents — Colonial Pipeline, Oldsmar Water, Ukraine Grid, TRITON/TRISIS, Volt Typhoon, and more. Each includes a real-incident sidebar, CISA advisory links, and ATT&CK tags.

Translate exercise gaps into estimated annual financial exposure using IBM and Ponemon ICS benchmark data. Customize breach notification costs, legal fines, and downtime rates — export to Excel or include in your compliance PDF.

Upload your existing incident response plan (PDF or Word) and the AI scores it across four dimensions: OT scenario coverage, detection and escalation procedures, cross-team coordination, and regulatory notification. Every gap maps to specific exercises.

Interactive full ICS ATT&CK matrix with all 12 tactics and 78 techniques. Technique cells light up based on your exercise history. Click any technique to see which exercises cover it — then export your coverage layer as an ATT&CK Navigator JSON file.

A dedicated portal for MSSPs and consultancies to manage multiple client organizations — each with their own branded exercise environment, scenario history, compliance dashboard, and white-label PDF exports.

Two CISA CTEP-aligned certification tracks for tabletop facilitators. Complete the required exercises, pass the 25-question knowledge assessment at 80%, and download a PDF certificate with a unique verifiable ID — all in the platform.

Connect your identity provider (Okta, Azure AD, Google Workspace, or any SAML 2.0 IdP) in minutes. Domain verification via DNS TXT record ensures only your org's users can access the platform.

Connect CyberICS to your existing security toolchain. REST API for scenario and session data, native ServiceNow/Jira ticketing for gap remediation, Slack/Teams notifications, SIEM webhooks, and xAPI/SCORM for LMS integration.

Define a recurring exercise program — frequency, scenario rotation, participant groups, and compliance targets — and the platform schedules, reminds, and tracks completion automatically across your team or client roster.