World of Labshock — By Industry
Your Sector.
Your Systems.
A water utility does not look like a rail control system, and a 6 kV substation does not look like either. Generic OT training teaches generic skills. These are the environments and failure modes specific to the industry you actually work in — with a lab for each one.
Want to see how teams actually use Labshock? Read the use cases. For the four directions — see the World page.
Industry 01
Oil & Gas
Flat networks, remote sites, and telemetry nobody reads.
The operational reality
Upstream and midstream sites were built for uptime in places where a service truck arrives twice a week. Control networks are frequently flat by necessity rather than by oversight — every device on one segment, every packet visible to every node, because that was the only architecture that could be maintained remotely.
The result is an estate where the process is reliable, the logs go nowhere, and nobody has characterised what normal traffic looks like.
What goes wrong
- No segmentation between the control network and anything upstream of it
- Compressor and pump logic reachable from any host on the same segment
- Telemetry generated continuously but never baselined or forwarded
- Turbine and compressor trains with deep interdependencies across safety subsystems
What you do in Labshock
- Map a flat OT network and see exactly what full exposure looks like
- Baseline Modbus TCP and S7comm traffic from a running process
- Pipe real PLC and SCADA telemetry into Splunk or ELK and build the first dashboards
- Run turbine-scale topologies with local controllers under a central SCADA
Labs in this sector
Industry 02
Water & Utilities
Small teams, distributed assets, and the lowest barrier to compromise in OT.
The operational reality
Water and district heating operators run distribution across many small sites with a handful of engineers. Control logic is often simple, well understood by one or two people, and completely undocumented for everyone else.
These are also the environments where publicly reported intrusions have needed the least sophistication — an exposed interface and a default credential have repeatedly been enough.
What goes wrong
- Flow, pressure and quality control reachable with minimal effort
- Control logic understood by one engineer and documented nowhere
- Boiler and circulation sequencing that fails in ways operators cannot see quickly
- Little to no capability to prove whether an alert corresponds to real process impact
What you do in Labshock
- Read process values from a live SCADA interface and identify every asset on the segment
- Open a real PLC project, read the scan cycle, and modify ladder logic for a boiler process
- Deploy changed logic to a runtime and verify the result through HMI feedback
- Trigger a log event and follow it from the workstation into the collector
Labs in this sector
Industry 03
Power & Energy
Substations where a valid command and an authorised command are not the same thing.
The operational reality
Substation automation runs on DNP3 and IEC 60870-5-104 — protocols designed for a network that was physically separated from everything else. Base DNP3 carries no authentication, Secure Authentication is optional and rarely deployed, and an event ties to a point index rather than to whoever caused it.
Most monitoring stops at the port. Watching TCP 20000 answers who connected. It does not answer who read what, or who operated what.
What goes wrong
- Control commands that are protocol-valid but operationally unauthorised
- Monitoring that alerts on connections rather than on function codes and point indexes
- Event buffer overflows that silently remove evidence from the record
- Detection rules that have never been fired by a real breaker operation
What you do in Labshock
- Capture live DNP3 and IEC 104 sessions and read the fields that carry meaning
- Map addresses and points across RTUs, feeders and breakers
- Operate an approved command through SELECT then OPERATE and watch the breaker move
- Check what the IDS reported — and whether your production rules would have caught it
Labs in this sector
Industry 04
Manufacturing
The most targeted sector, and the one where damage lands furthest from where it entered.
The operational reality
Manufacturing has been the most targeted industry for years running. The pattern across public incidents is consistent: the intrusion enters through IT — a phishing email, an exposed account, a default password — and the damage lands in production.
In most of those cases segmentation existed on paper. Paper stopped nothing, because nobody was watching what actually crossed the boundary.
What goes wrong
- IT-to-OT boundary crossings that nobody monitors in practice
- ICS-aware ransomware that stops historian and HMI processes before encryption is visible
- IIoT devices in an ownership gap — not managed as IT assets, not treated as OT assets
- Register-level changes that cascade through a synchronised production line
What you do in Labshock
- Interact with Modbus at register and coil level on a running assembly line
- Analyse Siemens S7 control behaviour on a CNC machining process
- Rebuild the detection for a real incident technique against live protocol traffic
- Observe how a single mistimed signal propagates through multi-stage production
Labs in this sector
Industry 05
Rail & Transport
Distributed control where dependencies span physical and logical boundaries.
The operational reality
Rail control coordinates signalling, switching and barrier operation across segments separated by real distance. A central controller drives remote track segments, each responsible for local signalling and safety enforcement.
These architectures are rarely replaced. They are extended — layer by layer, upgrade by upgrade — until control dependencies span boundaries no single diagram covers.
What goes wrong
- Master-slave topologies where compromise of the master reaches every segment
- Segmentation between OT and DMZ layers that has never been tested with real traffic
- Safety enforcement distributed across systems with different owners
- Change history spread across partial upgrades nobody has reconciled
What you do in Labshock
- Operate a distributed master-slave PLC topology controlling track routing and signalling
- Manipulate switches and observe signalling behaviour across segments in real time
- Trace data flow from OT through DMZ collectors into centralised logging
- Test whether the DMZ boundary actually holds when you send traffic at it
Labs in this sector
Common questions
Before you start
Which industries does Labshock cover?
Labshock ships labs for oil & gas, water and district heating utilities, power substations, discrete manufacturing, and rail transport. Each sector has environments running the protocols that sector actually uses — Modbus TCP and Siemens S7comm for process and manufacturing, DNP3 and IEC 60870-5-104 for substations.
Can I test my own IDS or SIEM against these environments?
Yes. Tidal Collector streams real OT events — SCADA actions, PLC state changes, process signals — into any external SIEM, and Surge Router forwards raw industrial traffic as mirrored flows to external IDS systems or hardware appliances. Wazuh, Splunk and ELK run as labs inside the platform.
Is this a simulator or are the systems real?
The control systems are real software running real logic. PLC runtimes execute programs you write, SCADA interfaces read live tags, and the industrial protocols on the wire are genuine protocol implementations rather than replayed captures. What is simulated is the physical process the controllers are driving.
Do I need an existing OT background to start?
No. The progression starts from automation fundamentals — the automation stack, the PLC scan cycle, industrial data flow — before moving into protocol work and detection. Engineers coming from automation and engineers coming from security both enter the same environments from different sides.
Can Labshock run without cloud access?
Yes. Labs run locally under Docker, and Organization licenses deploy fully on-premise with no cloud dependency and no shared infrastructure.
OT security must be testable, not documented.
Start in the free zone, then move to the sector that matches your estate.