Free OT and ICS Security Labs You Can Run in a Browser (2026)

Most OT security training is expensive because it needs hardware, and most free material is video. There is a middle ground: labs that simulate the plant, the protocols and the attacker in a browser, so you can practise the decisions that matter in OT without installing anything or going near a live process. This is a guide to the free ones, what each teaches, and when you need something heavier.

What can you actually learn about OT security in a browser?

More than you might expect. The hard part of OT security is rarely typing commands; it is judgement. Which protocol function codes are dangerous? Is this alarm flood an upset or an attack? Can this asset be isolated now, or does it need an operator on site? Which firewall rule breaks a required flow? These are decisions, and a simulation can present them, score them and let you repeat them until they are automatic.

What a browser cannot do is give you real packets on a real wire or real vendor engineering software. For that, see the open-source ranges further down.

Which free OT and ICS labs run in a browser?

All of the PlayCISO labs below are free, need no install or sign-up, and grade you from S to D (the OT Ransomware Lab is a branching scenario with a scored debrief instead). They are defender-focused and contain no exploit code.

Supporting tools, also in the browser: the OT Protocol Explorer (ports, native security and detection per protocol), the ICS Traffic Analyzer (paste a Modbus or DNP3 log and find unauthenticated writes and scanning), the Purdue Model Builder, the OT Conduit Linter, the Safe-to-Isolate Matrix and the OT Device Default-Credential Lookup.

How do the free options compare?

A two-week plan using only free labs

1. Days 1–2: protocols. OT Protocol Explorer, then the SCADA Protocol Weakness Lab until you score A or better.
2. Days 3–4: the controller. Modbus Attack Range, then the PLC Tamper Lab.
3. Days 5–6: architecture. Purdue Model Builder, then the SCADA Network Segmentation Map. Notice which controls stop which published kill chain.
4. Days 7–8: vulnerabilities. SCADA Version Triage and the HMI and SCADA Software Lab.
5. Days 9–10: safety. SIS Defense Lab, then the TRITON lab.
6. Days 11–12: real attacks. Stuxnet, Industroyer and PIPEDREAM labs. Write one paragraph per attack on the control that would have stopped it earliest.
7. Days 13–14: response. Alarm-Flood Lab, then the OT Ransomware Lab, with the OT/ICS Incident Response Checklist open beside it.

Then build a GRFICS or Labshock range and redo the Modbus exercise with real packets.

What safety rules apply to OT labs?

• Never practise on a production network or a device connected to one. A single write command or an aggressive scan can stop a process.
• Run open-source ranges on an isolated host network with no route to your corporate network or the internet.
• Treat default credentials and exposed devices you find on the internet as off-limits: looking is legal in most places, logging in is not.
• If you work in a plant, agree any testing in writing with operations and engineering first.

Checklist: getting hands-on OT practice

• Learn the protocols’ dangerous functions (writes, program downloads, mode changes).
• Practise detecting tampering on an HMI and in ladder logic.
• Design zones and conduits, then test them against real kill chains.
• Rehearse a safety-system attack and an IT-to-OT ransomware incident.
• Build one isolated open-source range for packet-level work.
• Write down what you would do differently in your own plant.

Frequently asked questions

Where can I find hands-on labs for SCADA security?

In a browser, PlayCISO has free SCADA labs on HMI software risk (WinCC, Wonderware, iFIX, Ignition, FactoryTalk), protocol weaknesses (Modbus, DNP3, IEC 104, IEC 61850, S7, OPC UA), firmware triage and network segmentation, all scored and with no sign-up. For packet-level work, open-source ranges such as GRFICS and Labshock run a simulated process, PLC and HMI on your own machine.

Are there OT security labs that use common vendor protocols?

Yes. PlayCISO’s SCADA Protocol Weakness Lab covers Modbus/TCP, DNP3 and DNP3 Secure Authentication, IEC 60870-5-104, IEC 61850 GOOSE and MMS, Siemens S7comm versus S7CommPlus and OPC UA security modes. The Industroyer lab uses IEC 104 and IEC 61850, and the PIPEDREAM lab covers Modbus/UMAS, CODESYS, OMRON FINS and OPC UA. Labshock, an open-source Docker lab, includes Modbus, EtherNet/IP, BACnet, OPC UA, MQTT and S7.

Is there OT red team training with realistic PLC simulators?

For offensive practice on a simulated PLC, use an isolated open-source range: GRFICS runs a soft PLC, HMI and a 3D process simulation, and Labshock includes an OpenPLC target and a Kali container. PlayCISO’s labs are defender-focused: they show how an attack works (for example Stuxnet’s PLC logic injection or TRITON’s safety-logic change) and ask you to detect and stop it, without exploit code.

How do I learn to secure legacy PLCs and RTUs?

Legacy controllers usually cannot be patched or given authentication, so you secure them with compensating controls: segmentation, allow-listing of who may send write commands, read-only gateways and monitoring for unexpected function codes. The Modbus Attack Range lab has you add exactly these controls and re-test, and the SCADA Version Triage lab teaches you to match firmware versions to known vulnerability classes and pick a realistic fix.

Is there a self-paced OT incident handling course?

CISA’s free on-demand 210W series covers incident impacts and attack methods at a conceptual level. For practice, PlayCISO’s OT Ransomware Lab is a branching, self-paced incident with scored decisions and an exportable debrief, and the OT/ICS Incident Response Checklist gives 24 steps across six phases. SANS ICS515 is the paid, in-depth option.