New simulation platform allows energy companies to train against realistic cyber attacks – SPE

March 12, 2026
Emiliano Bellini

Researchers from Germany’s Fraunhofer FKIE Institute have developed a virtual simulation platform to help power grid operators defend against cyber attacks by testing security strategies in realistic, controlled scenarios.

“PowerRange is designed as a flexible and scalable cyber range for power grids,” the study’s corresponding author Martin Serror said. pv magazine. “It supports both the simulation and emulation of traditional centralized electricity networks and future-oriented decentralized electricity networks with a high share of renewable energy sources and energy storage.”

According to Serror, renewable energy sources are more exposed to cyber threats than conventional power plants easier to ‘air-gape’ from communications networks.

“In contrast, renewable energy systems and bidirectional energy flows rely more heavily on digital coordination and communications, exposing them to a broader attack surface, especially in the absence of proper security measures.” he continued, noting that typical vulnerabilities affecting renewable energy systems or battery storage units include insecure remote access, interfaces used for monitoring, control or maintenance, as well as insecure over-the-air firmware updates, especially when authentication or integrity protection is weak or missing.

“Implementing state-of-the-art mechanisms for authentication and integrity protection in remote access and update procedures can therefore significantly improve system security,” Serror said.

Presented in the study “PowerRange: an immersive cyber range for electricity grid operators”, published in the International Journal of Critical Infrastructure ProtectionThe PowerRange virtual simulation platform is built on the open-source Wattson testbed, which enables secure execution of multi-phase cyber attacks and countermeasures in configurable power grid scenarios, integrating both operational technology (OT) and information technology (IT) networks with power generation and distribution processes.

PowerRange extends this to a realistic, immersive training environment tailored to the needs of operators, the academics said. It enables the practical application of security measures, helps identify usability weaknesses and involves all organizational levels, from management to IT and control room staff. Two pilot training sessions provide preliminary feedback, emphasizing the importance of communication and coordination.

The scientists explained that designing cyber ranges for cyber-physical systems (CPSs), such as power grids, requires modeling not only IT infrastructure, but also control centers, field equipment and physical processes, with modular, extensible architectures and orchestration modules that ensure flexibility and seamless integration.

They also noted that effective training should be suitable for a variety of users, from IT specialists to management, and support both individual and collaborative exercises. Cyber ​​ranges must replicate standard IT protocols alongside domain-specific OT protocols, and training environments must be realistic and comprehensive, encompassing offensive and defensive strategies and encompassing all organizational roles.

The platform also relies on a Virtual Control Center (VCC) that provides operators with intuitive interfaces, synchronized across multiple users, visualizing grid status, issuing control commands and integrating status estimation. The platform supports real-world cyber attacks, including reconnaissance, lateral movement, privilege escalation, denial-of-service (DoS), man-in-the-middle (MITM) and false data injection, with modular, configurable attack blocks.

Trainers can dynamically adjust scenarios, combining attacks based on participant actions and defensive measures. Together, these features create a controlled yet highly immersive environment for practicing detection, response and coordination during cyber incidents, the researchers pointed out.

Additionally, the platform models raster elements such as nodes and edges, captures assets, connections and annotations, and updates measurements through streamflow calculations. Users can adjust the controllability, observability and complexity of scenarios through rules-based configurations, with derived scenarios exportable as Wattson-compatible configurations.

The research team also conducted two pilot sessions with professional operators and said the trainees initially struggled with information flow and familiarity with the tools, but gradually coordinated effective responses. Feedback also emphasized the value of practical experience, realistic scenarios and cross-team communication.

“Regularly provided training improves the practical application of cybersecurity measures and promotes better communication and coordination among key stakeholders,” the research team said. “These insights highlight the need to address the human factor in addition to technological advancements to strengthen the overall resilience of network operations.”

“Overall, the distributed nature of renewable assets tends to improve the overall resilience of energy systems against targeted cyber attacks, as compromising a few assets usually does not impact overall system stability,” Serror added. “However, the widespread deployment of similar hardware and software components, such as identical inverters, can create systemic vulnerabilities. In such cases, a coordinated cyber attack can exploit a shared weakness to compromise many assets simultaneously and potentially affect overall system stability.”

“We expect a continued increase in the number of cyber attacks targeting energy systems as the number of incidents in the energy sector has gradually increased over the past year,” he concluded. “However, physical attacks and sabotage, such as those unfortunately taking place in Ukraine, remain even more disruptive to energy supplies, especially when combined with coordinated cyber attacks.”