Defending the Tap: How OT Organizations Can Preempt Iranian Cyber Threats with Cyber Simulation

Water and wastewater systems (WWS) form the backbone of public health and economic stability. Yet, as recent advisories from CISA and the FBI—alongside reporting in The New York Times—make clear, water utilities are increasingly in the crosshairs of sophisticated, state-sponsored cyber adversaries.

Iranian-linked threat actors, in particular, have intensified targeting of internet-facing Programmable Logic Controllers (PLCs) and Supervisory Control and Data Acquisition (SCADA) systems across the sector. To protect public safety, water utilities must shift from passive compliance to proactive, validated resilience.

The Escalating Threat: Iranian OT Attacks on Water Infrastructure

The operational technology (OT) environments powering municipal water treatment and distribution are uniquely exposed. Unlike traditional enterprise IT networks, where data theft is the primary goal, cyber attacks on industrial control systems aim for real-world operational impact.

How Iranian Threat Actors Strike

Recent alerts highlight tactics utilized by Iranian-affiliated groups (such as Cyber Av3ngers):

• Exploiting Exposed PLCs: Scanning for default passwords, unpatched firmware, and exposed administrative ports on internet-facing PLCs (e.g., Unitronics controllers).
• Manipulating Physical Processes: Overriding automated logic to disrupt water flow, alter chemical dosing ratios (such as chlorine or fluoride), or trigger physical pump/valve failures.
• Forcing Manual Failovers: Forcing plants to disconnect SCADA platforms and revert to manual operations, reducing efficiency and stretching municipal personnel thin.

When operational controls are compromised, the consequences extend far beyond digital downtime—they directly threaten community drinking water safety, fire suppression capabilities, and environmental health.

Why Traditional Defense Falls Short in OT Security

Defending critical infrastructure against nation-state actors presents unique challenges that conventional cybersecurity tools cannot solve alone:

1. IT vs. OT Friction: Security teams often lack experience with industrial protocols like Modbus or DNP3, while plant operators prioritize uninterrupted uptime over traditional patching schedules.
2. Untested Security Stacks: Detection logic tuned for standard IT endpoints often misses “living-off-the-land” techniques or subtle PLC modification attacks until operational disruptions occur.
3. Lack of Live Fire Experience: High-stakes OT environments cannot be used for live threat testing due to the risk of triggering unintended physical outages.

To stop adversaries before they manipulate physical valves, OT organizations need a safe, hyper-realistic environment to test defenses, validate tools, and rehearse incident response.

Preempting Cyber Attacks with Cyber Simulation

Rather than waiting for an alert to fire in production, forward-leaning utilities are leveraging cyber simulation platforms to build validated, preemptive resilience.

↓

1. High-Fidelity OT Environment Replication

SimSpace creates high-fidelity cyber simulation environments that mirror your utility’s exact operational architecture—spanning enterprise IT, SCADA human-machine interfaces (HMIs), legacy operating systems, and industrial controllers. With hardware-in-the-loop (HITL) integration, physical PLCs can be incorporated directly into the range to observe real hardware behavior under stress.

2. Autonomous Adversarial Emulation

Using AI-driven agents, the platform emulates real-world Iranian tactics, techniques, and procedures (TTPs). Organizations can safely run live-fire simulations featuring brute-force PLC attacks, unauthorized logic updates, and lateral movement from enterprise IT into control networks.

3. Continuous Security Tool Validation

By running simulated attacks against your production security stack (SIEM, SOAR, and OT network sensors) inside the environment, security leaders can verify whether detection rules fire correctly against nation-state tradecraft—identifying blind spots before adversaries exploit them.

4. Joint IT/OT Mission Rehearsals

Effective response requires seamless coordination between IT security specialists and plant operations teams. AI Proving Grounds provide a risk-free arena for cross-functional teams to practice containment protocols, communication handoffs, and operational recovery under realistic pressure.

Case Study: Putting Defense to the Test with Jack Voltaic

To see how cyber simulations bridge the gap between policy and operational reality, consider the multi-agency Jack Voltaic Regional Exercise conducted in May 2026 by SimSpace in partnership with Cyber Florida.

The Scenario: Jack Voltaic

The exercise simulated a complex, multi-stage cyber-physical incident impacting municipal water treatment and distribution systems serving communities and defense-adjacent operations across the Tampa Bay region.

The Execution:

• Tabletop Exercise (TTX): Regional leaders and executive stakeholders tackled strategic decision-making, policy hurdles, and public communication during an escalating crisis.
• Live-Fire Exercise (LFX): Technical practitioners—including SOC analysts and OT engineers—were plunged into a secure, instrumented SimSpace range. Hands-on threat hunting teams analyzed realistic telemetry, detected lateral movement between IT and OT networks, and executed containment protocols in real time.

The Outcome:

By combining strategic leadership discussions with technical threat hunting on live SCADA/OT range replicas, participants validated operational plans, identified critical handoff gaps between IT and OT teams, and strengthened regional mission assurance without risking physical infrastructure.

Read the Cyber Florida Customer Success Story.

From Passive Compliance to Proven Resilience

Regulatory guidance from CISA, the EPA, and the FBI underscores an urgent message: acknowledging cyber risk is no longer sufficient. Utilities must demonstrate actionable capability.

By emulating real-world Iranian OT threat campaigns in a cyber simulation environment, water and wastewater organizations transform security assertions into measurable evidence of readiness—protecting public health, preserving operational continuity, and staying miles ahead of the threat.

To learn how to validate cyber resilience for OT systems in a cyber simulation environment, talk to an OT cybersecurity expert at SimSpace.