OT & ICS Security Tools & Labs
Operational technology (OT) and industrial control systems (ICS) run the physical world — PLCs, RTUs, HMIs, SCADA, building-management and refrigeration controllers that chill food, move water and keep plants running. They prioritise availability and safety over confidentiality, often speak protocols with no authentication, and rarely get patched, so segmentation is the primary control. This hub gathers every free OT and ICS tool and lab PlayCISO makes — from modelling the Purdue architecture and scoring IEC 62443 Security Levels, to parsing internet-exposure data, auditing refrigeration configs, and rehearsing a PLC-tamper or cold-chain incident. Everything runs in your browser; nothing you paste or upload leaves your device.
In plain words
PlayCISO offers 18 free OT and ICS security tools and labs covering the Purdue model, IEC 62443 security levels, OT protocols like Modbus, DNP3 and BACnet, PLC tampering, safety-instrumented-system (SIS) defense, ICS-CERT-style advisories, and cold-chain resilience. Thirteen are reference and analysis tools — a Purdue Model Builder, an IEC 62443 SL Calculator, an ATT&CK-for-ICS builder, an OT Protocol Explorer, an OT Compliance Mapper across IEC 62443, NERC CIP and NIS2, an OT Conduit Linter, an internet-exposure analyzer, and more. Five are hands-on labs: a Cold-Chain War Room, a PLC Tamper Lab, a Modbus Attack Range, a SIS Defense Lab, and an Alarm-Flood Triage Lab. All of them are free, run entirely in the browser with no signup, and never upload what you paste. PlayCISO runs a large free tier with paid plans at $5, $10 and $40.
Reference & analysis tools
Model, score, map and inspect your OT environment — paste configs and exposure data in the browser.
Purdue Model Builder
Place OT assets into Purdue levels, draw conduits, get scored on IEC 62443 segmentation.
IEC 62443 SL Calculator
Score a zone’s achieved vs target Security Level across the 7 FRs.
ATT&CK for ICS Builder
Toggle OT components, get the ATT&CK-for-ICS matrix + prioritised mitigations.
OT Protocol Explorer
Filterable reference of 20+ OT protocols — ports, auth, weaknesses, detection.
OT Device Lookup
Defensive lookup of ICS device credential posture & CVE themes by vendor.
OT Compliance Mapper
Crosswalk OT controls across IEC 62443, NERC CIP and NIS2 with a gap heatmap.
OT Conduit Linter
Paste OT firewall rules; flag IT→OT any-any, RDP into cells, DMZ-skipping.
OT Asset Ranker
Rank PLCs/HMIs/RTUs by criticality × exposure; fix the worst first.
BMS Config Auditor
Paste a BMS/refrigeration controller config, get the exposure findings.
OT Downtime Calculator
Put a number on a cooling outage or plant-down event.
ICS Traffic Analyzer
Paste an ICS traffic log; flag unauth writes, scanning, floods.
OT Exposure Analyzer
Paste a Shodan/Censys export of your hosts; find exposed OT.
ICS Advisory Explorer
Filterable ICS-CERT-style advisories with exploited-first prioritisation.
Hands-on labs & simulations
Drill the attacks and defenses against safe, simulated OT — no real plant touched.
Cold-Chain War Room
A supermarket refrigeration ransomware sim — save the cold chain, scored.
PLC Tamper Lab
Spot the Stuxnet-style setpoint/logic tamper on the HMI before it trips.
Modbus Attack Range
Drive a simulated Modbus network, see it has no auth, then defend it.
SIS Defense Lab
Keep the safety system trustworthy against a TRITON-style attack.
Alarm-Flood Triage Lab
Find the real process upset hidden in an alarm flood, under the clock.
Related reading
Real-world OT and cold-chain incidents, broken down for security leaders.
Hackers Heated French Supermarket Fridges to 50°C: The Danfoss Attack, and Why Refrigeration Is OT
How internet-exposed Danfoss refrigeration controllers were hijacked across hundreds of French supermarkets — and why the cold chain is operational technology.
Europe’s Grocers Under Cyber Siege: Albert Heijn Goes Dark While French Fridges Cook
Two European grocery incidents days apart — one IT/logistics, one OT sabotage — both emptied fresh-food shelves. Why food retail is now critical infrastructure.
Frequently asked questions
What is the Purdue model?
The Purdue Enterprise Reference Architecture is the standard way to segment an industrial network into levels — from Level 0 physical process (sensors and actuators), up through PLCs and controllers (Level 1), supervisory control/SCADA (Level 2), site operations (Level 3), an industrial DMZ (Level 3.5), and the enterprise IT zones above it. Each level only talks to its neighbours through defined conduits, so a foothold in IT cannot reach a PLC directly. PlayCISO’s Purdue Model Builder lets you place OT assets into levels, draw the conduits, and get scored on IEC 62443 segmentation.
How do I secure a PLC?
Get it off the public internet and off any flat network shared with corporate IT or point-of-sale; put it behind a segmented OT zone with explicit conduits (the Purdue model). Change default and blank credentials, disable unused services and remote-programming modes, require authenticated or VPN access for maintenance, and monitor for setpoint and logic tampering — the Stuxnet-style attack changes the program while showing operators a normal HMI. Keep firmware current where the vendor still supports it, and maintain a manual fallback and an incident plan for a controller compromise. The PLC Tamper Lab and Modbus Attack Range let you practise spotting and defending these.
What is IEC 62443?
IEC 62443 is the international standard series for industrial automation and control system (IACS) security. Its core idea is to divide the system into zones and conduits and assign each zone a Security Level (SL) target across seven foundational requirements (FRs) — identification & authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability. You then measure the achieved SL against the target. PlayCISO’s IEC 62443 SL Calculator scores a zone’s achieved vs target SL across those 7 FRs, and the OT Compliance Mapper crosswalks it against NERC CIP and NIS2.
What is the difference between IT and OT security?
IT security protects data and prioritises confidentiality; OT (operational technology) security protects a physical process and prioritises availability and safety — a tampered setpoint can spoil food, damage equipment or hurt people, not just leak records. OT runs long-lived controllers (PLCs, RTUs, HMIs, BMS) on protocols like Modbus, DNP3 and BACnet that often have no authentication, so patching is rare and segmentation is the primary control. Treat IT and OT as one resilience problem but with different fixes.
Is refrigeration or building management really OT?
Yes. Commercial refrigeration and building-management systems are run by PLCs and dedicated controllers speaking industrial protocols (Modbus, BACnet, proprietary buses). They are cyber-physical systems with safety and spoilage consequences — exactly what operational technology means — they just live in a supermarket or warehouse instead of a factory. The October 2026 Danfoss attack on French supermarket fridges is the case study. Use the BMS Config Auditor and OT Exposure Analyzer to check your own posture.
Are these OT and ICS tools free?
Yes. All 18 OT and ICS tools and labs on this page are free and run entirely in your browser — no signup, and nothing you paste or upload leaves your device. PlayCISO has a large free tier alongside paid plans at $5, $10 and $40 for the rest of the platform.