Sans Institute Preps Live Systems for Nato Cyber Exercise

Why It Matters

By exposing defenders to live, physical impacts on critical infrastructure, the exercise accelerates readiness for nation‑state cyber threats targeting energy systems, a priority for both NATO and the private sector.

Key Takeaways

• Sans builds first real‑world power‑grid cyber range for Locked Shields
• 70 physical ICS devices and 100 VMs simulate national grid
• Blue teams must protect generation while under live cyber attacks
• Exercise highlights need for IT/OT integration and public‑private partnership

Pulse Analysis

Locked Shields, NATO’s flagship cyber‑defence drill, has evolved from tabletop simulations to a live‑fire scenario that mirrors the stakes of modern energy warfare. The 2024 edition arrives as Europe grapples with an energy crisis sparked by the war in Ukraine and broader geopolitical tensions, making the protection of power grids a strategic imperative. By placing 16 multinational blue teams in a realistic environment where every cyber decision can throttle turbines or open breakers, the exercise underscores how cyber‑physical convergence now defines national security.

The SANS Institute’s involvement marks a watershed moment for cyber‑training realism. Its hybrid range combines roughly 70 physical industrial‑control devices—PLCs, HMIs, workstations—with 100 virtual machines, creating an IT/OT architecture that behaves like a live national grid. Participants must not only detect threats but also maintain uninterrupted generation, forcing them to think like operators rather than pure defenders. This shift from sandboxed labs to tangible, high‑impact systems bridges the long‑standing gap between certification curricula and the operational challenges faced by utilities and grid operators.

The broader implications extend beyond the exercise itself. As private‑sector owners dominate critical‑infrastructure assets, public‑private collaboration becomes essential for resilience. The realistic pressure testing of defenses prepares organizations for AI‑driven, machine‑speed attacks that could destabilize power supplies in seconds. Lessons learned will likely filter into industry standards, influencing how utilities design cyber‑risk frameworks and train staff. In an era where a single cyber breach can ripple into national‑level outages, the Locked Shields partnership with SANS sets a new benchmark for preparedness across the global energy ecosystem.