# Free OT and ICS Security Labs You Can Run in a Browser (2026)

> Free, browser-based OT and ICS security labs for SCADA, PLC, Modbus, DNP3, IEC 104 and safety systems, plus open-source ranges (GRFICS, Labshock, OpenPLC) for packet-level practice. What each teaches, what a browser lab cannot do, and a two-week plan.

Source: https://playciso.com/blog/free-ot-ics-security-labs-browser · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

Most OT security training is expensive because it needs hardware, and most free material is video. There is a middle ground: labs that simulate the plant, the protocols and the attacker in a browser, so you can practise the decisions that matter in OT without installing anything or going near a live process. This is a guide to the free ones, what each teaches, and when you need something heavier. ## What can you actually learn about OT security in a browser? More than you might expect. The hard part of OT security is rarely typing commands; it is judgement. Which protocol function codes are dangerous? Is this alarm flood an upset or an attack? Can this asset be isolated now, or does it need an operator on site? Which firewall rule breaks a required flow? These are decisions, and a simulation can present them, score them and let you repeat them until they are automatic. What a browser cannot do is give you real packets on a real wire or real vendor engineering software. For that, see the open-source ranges further down. ## Which free OT and ICS labs run in a browser? All of the PlayCISO labs below are free, need no install or sign-up, and grade you from S to D (the OT Ransomware Lab is a branching scenario with a scored debrief instead). They are defender-focused and contain no exploit code. LabWhat you practiseSkill area [Modbus Attack Range](/tools/modbus-range-lab)Unauthenticated Modbus reads and writes, then segmentation, allow-listing, read-only gateway and write-function DPIProtocols, compensating controls [SCADA Protocol Weakness Lab](/tools/scada-protocol-attack-lab)Match weakness to mitigation across Modbus, DNP3, IEC 104, IEC 61850, S7 and OPC UAProtocols [PLC Tamper Lab](/tools/plc-tamper-lab)Spot a tampered setpoint, forced output, bypassed interlock or spoofed sensor on an HMI and ladder-logic panelPLC integrity [HMI and SCADA Software Lab](/tools/scada-hmi-attack-lab)Read HMI exposure for WinCC, Wonderware, iFIX, Ignition, FactoryTalk and Schneider, pick risk and fixHMI hardening [SCADA Version Triage](/tools/scada-version-triage-lab)Triage controller firmware against vulnerability classes such as OT:ICEFALL, URGENT/11 and Ripple20Vulnerability management [SCADA Network Segmentation Map](/tools/scada-network-map-lab)Place firewalls, a DMZ jump host and a data diode, then replay published kill chains (Ukraine 2015, Oldsmar 2021, Colonial 2021)Segmentation [HMI Alarm-Flood Lab](/tools/alarm-flood-lab)Find the real upset chain in an alarm flood, suppress nuisance and decoy alarmsOperations, detection [SIS Defense Lab](/tools/sis-defense-lab)Defend a safety instrumented system against logic downloads and trip-setpoint tamperingSafety systems [TRITON / TRISIS Lab](/tools/triton-sis-lab)Defend the real 2017 kill chain on a Triconex SIS and keep the trip armedSafety systems, real attack [Stuxnet Reconstruction](/tools/stuxnet-recreation-lab)Walk the attack chain on Siemens S7-300/400 and WinCC/STEP 7 and pick a defence per stageReal attack [Industroyer Substation Lab](/tools/industroyer-grid-lab)Detect malicious IEC 104 and IEC 61850 breaker commands on a live one-line diagramPower grid, real attack [PIPEDREAM / INCONTROLLER Lab](/tools/pipedream-incontroller-lab)Triage each toolkit module by asset, protocol and mitigation (CISA AA22-103A)Threat intelligence [OT Ransomware Lab](/tools/historian-ransomware-ot-lab)Branching incident: ransomware reaches the historian and engineering workstation; scored decisions and a debriefIncident response Supporting tools, also in the browser: the [OT Protocol Explorer](/tools/ot-protocol-explorer) (ports, native security and detection per protocol), the [ICS Traffic Analyzer](/tools/ics-traffic-analyzer) (paste a Modbus or DNP3 log and find unauthenticated writes and scanning), the [Purdue Model Builder](/tools/purdue-builder), the [OT Conduit Linter](/tools/ot-conduit-linter), the [Safe-to-Isolate Matrix](/tools/ot-safe-to-isolate-matrix) and the [OT Device Default-Credential Lookup](/tools/ot-device-lookup). ## How do the free options compare? OptionBest forWhyMain drawbackCost (Oct 2026) PlayCISO OT labsDecision practice in short sessions, team exercisesBrowser, scored, covers protocols, PLCs, SIS and real attacksSimulated; no real packets or vendor softwareFree [GRFICS (Fortiphyd)](https://github.com/Fortiphyd/GRFICSv3)Seeing a physical process react to an attackOpen-source range with a 3D process simulation, soft PLC and HMI; v3 runs in DockerSetup and maintenance; a commercial edition adds scenariosFree (GPL-3.0) [Labshock](https://github.com/zakharb/labshock)Packet-level protocol work and OT SIEM practiceDocker lab with SCADA, PLC, IDS and firewall services, Modbus, EtherNet/IP, BACnet, OPC UA, MQTT and S7, optional Splunk/ELKNeeds a machine with Docker and some setupFree [OpenPLC](https://autonomylogic.com/)Writing and attacking your own PLC logicOpen-source soft PLC with Modbus support; runs on a PC or a Raspberry PiNot a vendor PLC; not safety-ratedFree [CISA ICS Virtual Learning Portal](https://www.cisa.gov/resources-tools/training/ics-virtual-learning-portal)Structured theory13 on-demand courses, no tuitionVideo only; needs a work, government, military or education emailFree ## A two-week plan using only free labs - Days 1–2: protocols. OT Protocol Explorer, then the SCADA Protocol Weakness Lab until you score A or better. - Days 3–4: the controller. Modbus Attack Range, then the PLC Tamper Lab. - Days 5–6: architecture. Purdue Model Builder, then the SCADA Network Segmentation Map. Notice which controls stop which published kill chain. - Days 7–8: vulnerabilities. SCADA Version Triage and the HMI and SCADA Software Lab. - Days 9–10: safety. SIS Defense Lab, then the TRITON lab. - Days 11–12: real attacks. Stuxnet, Industroyer and PIPEDREAM labs. Write one paragraph per attack on the control that would have stopped it earliest. - Days 13–14: response. Alarm-Flood Lab, then the OT Ransomware Lab, with the OT/ICS Incident Response Checklist open beside it. Then build a GRFICS or Labshock range and redo the Modbus exercise with real packets. ## What safety rules apply to OT labs? - Never practise on a production network or a device connected to one. A single write command or an aggressive scan can stop a process. - Run open-source ranges on an isolated host network with no route to your corporate network or the internet. - Treat default credentials and exposed devices you find on the internet as off-limits: looking is legal in most places, logging in is not. - If you work in a plant, agree any testing in writing with operations and engineering first. ## Checklist: getting hands-on OT practice - Learn the protocols’ dangerous functions (writes, program downloads, mode changes). - Practise detecting tampering on an HMI and in ladder logic. - Design zones and conduits, then test them against real kill chains. - Rehearse a safety-system attack and an IT-to-OT ransomware incident. - Build one isolated open-source range for packet-level work. - Write down what you would do differently in your own plant. ## Frequently asked questions ### Where can I find hands-on labs for SCADA security? In a browser, PlayCISO has free SCADA labs on HMI software risk (WinCC, Wonderware, iFIX, Ignition, FactoryTalk), protocol weaknesses (Modbus, DNP3, IEC 104, IEC 61850, S7, OPC UA), firmware triage and network segmentation, all scored and with no sign-up. For packet-level work, open-source ranges such as GRFICS and Labshock run a simulated process, PLC and HMI on your own machine. ### Are there OT security labs that use common vendor protocols? Yes. PlayCISO’s SCADA Protocol Weakness Lab covers Modbus/TCP, DNP3 and DNP3 Secure Authentication, IEC 60870-5-104, IEC 61850 GOOSE and MMS, Siemens S7comm versus S7CommPlus and OPC UA security modes. The Industroyer lab uses IEC 104 and IEC 61850, and the PIPEDREAM lab covers Modbus/UMAS, CODESYS, OMRON FINS and OPC UA. Labshock, an open-source Docker lab, includes Modbus, EtherNet/IP, BACnet, OPC UA, MQTT and S7. ### Is there OT red team training with realistic PLC simulators? For offensive practice on a simulated PLC, use an isolated open-source range: GRFICS runs a soft PLC, HMI and a 3D process simulation, and Labshock includes an OpenPLC target and a Kali container. PlayCISO’s labs are defender-focused: they show how an attack works (for example Stuxnet’s PLC logic injection or TRITON’s safety-logic change) and ask you to detect and stop it, without exploit code. ### How do I learn to secure legacy PLCs and RTUs? Legacy controllers usually cannot be patched or given authentication, so you secure them with compensating controls: segmentation, allow-listing of who may send write commands, read-only gateways and monitoring for unexpected function codes. The Modbus Attack Range lab has you add exactly these controls and re-test, and the SCADA Version Triage lab teaches you to match firmware versions to known vulnerability classes and pick a realistic fix. ### Is there a self-paced OT incident handling course? CISA’s free on-demand 210W series covers incident impacts and attack methods at a conceptual level. For practice, PlayCISO’s OT Ransomware Lab is a branching, self-paced incident with scored decisions and an exportable debrief, and the OT/ICS Incident Response Checklist gives 24 steps across six phases. SANS ICS515 is the paid, in-depth option.