Product Timeline

Deep within a newly formed industrial region known as Oilsprings, the first systems of Labshock came online. Designed as a controlled environment for Industrial Cybersecurity training, this early facility marked the beginning of a fully interactive Operational Technology simulation focused on real-world ICS behavior rather than abstract modeling.

At the core of the environment, a small oil pumping station was brought to life through the integration of SCADA visualization systems and OpenPLC-driven control logic. For the first time, programmable logic controllers, sensors, and industrial actuators operated together as a unified cyber-physical system, allowing users to observe live industrial processes under both normal and manipulated conditions.

Unlike conventional simulators, Oilsprings was built around industrial accuracy and system behavior. Process flow, PLC execution, and OT network communication were modeled to reflect real industrial environments, enabling hands-on exploration of SCADA systems, control logic, and ICS exposure fundamentals. As the first industrial environment inside Labshock, Oilsprings established the foundation for OT visibility, telemetry concepts, and cybersecurity-driven industrial interaction that later evolved into the broader World of Labshock ecosystem.

As the Oilsprings environment evolved, Labshock introduced the Engineering Workstation, marking the shift from observing industrial processes to actively engineering them within a controlled Operational Technology environment.

The workstation enabled direct creation, modification, and deployment of PLC logic inside simulated Industrial Control Systems. Built on a Kali Linux-based setup, it integrated OpenPLC Editor and SCADA templates, removing external tooling and centralizing industrial control engineering within Labshock.

For the first time, users could execute full PLC workflows, including logic design, deployment, and runtime analysis, allowing real-time interaction with industrial automation systems and SCADA-driven processes.

This capability established the first bridge between industrial engineering and cybersecurity analysis, introducing structured experimentation with control logic behavior, process manipulation, and cyber-physical system understanding inside Labshock.

With the introduction of the Pentest Station, Labshock expanded beyond industrial engineering into active security testing. Built on a Kali Linux-based stack, it enabled structured reconnaissance and threat simulation against realistic SCADA and PLC environments without touching real infrastructure.

Within simulated OT networks, users could discover exposed PLCs, enumerate industrial services, and interact with protocols like Modbus in a controlled environment. Early testing workflows focused on visibility into industrial communication paths and basic manipulation of control logic.

This release completed the initial Labshock security model by combining engineering (EWS), visibility, and security testing into a single ecosystem. It laid the groundwork for more advanced ICS testing and automated assessment modules in later versions.

Network Swiftness introduced full industrial network visibility inside Labshock, enabling real-time inspection of OT and ICS traffic. Instead of relying on external tools, users could now observe live communication between SCADA systems, PLCs, and field devices directly within the platform.

This release made it possible to correlate industrial process behavior with underlying network activity, revealing how control commands and telemetry move through Industrial Control Systems in real time. Packet-level inspection provided deeper understanding of protocol behavior in operational environments.

It also introduced connection tracking and deep visibility for OT protocols, with early integration patterns for IDS tools like Zeek and Suricata. This allowed industrial traffic to be analyzed and validated against detection rules in a controlled lab setting.

Network Swiftness became the foundation of Labshock’s security observability layer, connecting industrial operations with network-level monitoring and enabling structured analysis of OT traffic and system interactions.

Tidal Collector introduced structured log ingestion and telemetry collection for Industrial Control Systems inside Labshock. It enabled OT data from SCADA and PLC environments to be captured, normalized, and forwarded into security monitoring and SIEM pipelines.

For the first time, industrial events such as PLC execution changes, process state updates, and operator interactions were centralized into a single logging pipeline. This created continuous visibility across cyber-physical system behavior.

A built-in web interface allowed configuration of log routing and forwarding without external tooling, simplifying integration with security platforms. OpenPLC and SCADA-level events were collected, including operator actions and control modifications.

This release established the full OT log lifecycle in Labshock—from collection to processing and forwarding—forming the foundation for later SIEM integration, forensic analysis, and industrial threat detection workflows.

The Lab Portal unified all Labshock components into a single Industrial Cybersecurity entry point, replacing isolated engineering, SCADA, and security testing modules with one centralized access layer.

Users could now seamlessly move between PLC engineering, network visibility, and threat simulation workflows without leaving the platform. This created a consistent structure for interacting with Industrial Control System environments.

Beyond usability improvements, the Portal introduced the foundation for structured learning paths, organizing labs and tools into coherent progression-based workflows instead of standalone systems.

This release marked a shift toward a platform-oriented architecture, turning Labshock into a unified OT cybersecurity training environment designed for scalable industrial security education and scenario-based learning.

Pentest Fury introduced a dedicated security testing framework for Industrial Control Systems inside Labshock, significantly expanding structured threat simulation capabilities across OT environments.

It enabled controlled testing workflows against simulated SCADA systems, PLC networks, and industrial communication protocols, moving Labshock beyond basic penetration testing into full industrial threat modeling.

The module included ICS-focused reconnaissance, industrial network scanning, and Modbus security testing features, allowing realistic scenarios such as PLC manipulation, control logic interference, and service-level exposure analysis.

Structured threat chains were introduced to simulate end-to-end industrial threat scenarios in a repeatable way, covering reconnaissance, control-path testing, and impact phases within a safe training environment.

This release established Pentest Fury as the core security testing engine of Labshock, laying the foundation for later automation, advanced Modbus assessment, and integrated testing scenarios across Industrial Cybersecurity environments.

Industrial DMZ Architecture introduced realistic enterprise-grade network segmentation inside Labshock, dividing environments into IT, DMZ, and OT zones.

This release modeled how critical infrastructure systems isolate corporate networks from operational technology, enforcing strict separation between business systems, intermediary services, and process-controlling OT networks.

Users could study firewall rules, controlled data transfers, and restricted communication paths across zones, enabling realistic inspection of industrial security boundaries and cross-segment traffic flow.

The DMZ layer made it possible to simulate how SCADA systems, engineering workstations, and PLC networks are isolated in real deployments, reflecting modern industrial cybersecurity architecture.

It also enhanced threat modeling by demonstrating lateral movement risks between IT and OT environments and how segmentation mitigates real-world access paths in critical infrastructure systems.

First SIEM Integration connected Labshock’s industrial environments to enterprise Security Information and Event Management systems, enabling structured forwarding of OT telemetry into SOC workflows.

Simulated SCADA events, PLC logs, and industrial process data were streamed into platforms like Splunk, giving security analysts a unified view of operational technology activity using standard detection and correlation tools.

Preconfigured collectors and dashboards simplified ingestion and visualization of industrial logs, making OpenPLC operations and process changes immediately observable within a centralized SIEM interface.

This release bridged OT and IT security domains by enabling cross-domain monitoring and anomaly detection in industrial environments using correlation rules and event pipelines.

It also laid the foundation for ELK Stack integration, expanding Labshock into open-source security observability and completing the transition toward a full OT-to-SOC monitoring pipeline.

World of Labshock marked the transition from isolated industrial labs into a structured Industrial Cybersecurity learning platform focused on guided OT security progression.

It introduced a progression-based training system where users advance through zones, labs, and scenario-driven environments that simulate real-world critical infrastructure operations.

The first official zone, Loginward, and the initial guided lab, Utility Works, established the entry point into Industrial Cybersecurity fundamentals, combining SCADA interaction, PLC behavior analysis, and OT network visibility in a controlled environment.

A unified progression model was introduced, defining how users unlock labs and complete structured objectives across industrial systems, shifting Labshock into a learning ecosystem based on levels and skill development.

This release established the foundation for cyber-physical system interaction training, where SCADA systems, PLC logic, and industrial processes are studied under both normal and manipulated conditions.

World of Labshock v2.1 expanded the platform into a fully structured Industrial Cybersecurity training ecosystem with persistent progression, guided learning paths, and enterprise-grade OT environments.

The second zone, Signalspire, was introduced, extending the learning journey beyond onboarding and adding advanced industrial scenarios such as the Eastwater Facility lab, focused on SCADA systems, PLC operations, and industrial network communication.

A structured progression system was formalized with quests and interconnected labs across multiple zones, defining a complete entry-level OT cybersecurity training path with clear leveling and objectives.

Enterprise-grade simulation was expanded through the Railroad North lab, a master-slave industrial control environment featuring synchronized PLC operations and distributed process control similar to real transportation systems.

This release also introduced a redesigned portal, zone-based learning structure, and full lab lifecycle management, including start, pause, reset, and state tracking for industrial environments.

v2.1 established World of Labshock as a production-ready Industrial Cybersecurity platform for structured education and scalable OT security training.

World of Labshock v2.2 expanded into deep Industrial Control Systems protocol training with the introduction of the Netfields and Logicveil zones, focused on Modbus and Siemens S7 communication systems.

This release enabled hands-on interaction with low-level industrial protocols, including Modbus register manipulation, Siemens S7 data blocks, and real-world PLC communication workflows used in industrial automation environments.

Users could now perform structured OT security exercises involving coil control, register operations, and SCADA-to-PLC communication analysis, enabling realistic test and defence scenarios across cyber-physical systems.

A significant expansion of progression content added over 30 new quests across industrial domains, strengthening structured learning paths and reinforcing practical OT cybersecurity training.

A new badge and quiz system was introduced to validate knowledge after labs, making progression measurable and tied directly to hands-on industrial security skills.

This release established Labshock as a protocol-aware Industrial Security platform covering core ICS communication standards and industrial control logic fundamentals.

Patch 2.3 opened Thunderwatch, the PLC programming zone, moving World of Labshock from network-centric analysis into the control logic itself.

The premise behind the zone is that a PLC is not an IP address. It reads inputs, executes logic, writes outputs, and changes physical state. Before an operator can secure, monitor, or test an industrial system, they need to understand what the machine actually does with a command once it arrives.

Thunderwatch introduces a full PLC programming learning path built on automation fundamentals: the automation stack, the PLC scan cycle, industrial data flow, Ladder Logic, Structured Text, PLC memory and variables, HMI tags and bindings, timers and counters, function block architecture, program organization units, and live memory changes on a running controller.

Every topic is bound to a lab rather than a document. Users open a real project in the Engineering Workstation, trace an HMI command into PLC memory, build a variable map, write and deploy logic to the runtime, and watch the output move on the process. The Utility Works II lab anchors the zone with an expanded boiler room process where fixed logic is replaced by timers, memory bits, and process states that decide system behaviour.

The security payoff is the chain itself: HMI request, PLC memory, logic execution, output command, process feedback, operator visibility. Detection built without that chain sees traffic but misses meaning. Thunderwatch closes the gap between a valid packet and an unsafe process outcome.