Mastering the Response Before the Alarm Sounds
When a cyber incident hits an industrial environment, the decisions made in the first two hours determine whether you recover in days or weeks. The worst time to discover that your incident response plan has gaps is during an actual incident. Table top exercises find those gaps safely — without production risk, without real consequences.
NEXUS designs and facilitates scenario-based exercises built specifically for OT environments. We draw on real-world ICS attack patterns — ransomware campaigns targeting industrial operators, supply chain compromises, and nation-state intrusion scenarios — to create exercises that feel real and produce actionable lessons.
Exercise Scenarios We Run
- Ransomware encryption of historian and engineering workstations
- PLC firmware modification via compromised vendor remote access
- Insider threat — disgruntled employee with SCADA access
- Supply chain compromise via software update
- Nation-state pre-positioning detected in OT network
- IT/OT boundary crossing — corporate breach spreading into OT
Exercise Formats
- Operational TTX — Engineering and operations team focus. Who calls whom, what gets isolated, when does production stop?
- Strategic TTX — Leadership and management focus. Decision-making under uncertainty, regulatory notification, stakeholder communication.
- Full-Stack TTX — Engineering, operations, IT/OT security, and management together. Tests the interfaces between layers.
- Red Cell Injection — NEXUS provides a live adversary role, introducing new injects throughout to stress-test your response.
Our Exercise Process
The measure of a good exercise is not the report. It is whether your team responds differently next time — faster escalation, clearer decision authority, fewer communication gaps under pressure. The after-action report is the record. The behavioural change is the outcome.