Request access

See how attacks reach a power station, and what stops them

An interactive reference power station, from the internet down to the protective relays. Switch each crossing from firewall to hardware and watch the attack paths close. Then answer five questions to score your own station.

  • 28 systems across six Purdue levels, drawn the way generating stations are built.
  • 6 attacks from the public record, each traced on the diagram with its sources.
  • Free, runs in your browser, nothing to install.

Request access

We’ll email you the access link within a few minutes.

Every crossing on a firewall: attack paths reach the plant levels Every crossing on hardware: no path reaches the plant

One switch changes the answer

A firewall permits a session, and a permitted session runs both ways. Hardware sends the plant data out and builds no way back in. Switch the crossings between the DMZ and the plant and the attack paths into Levels 3 to 1 disappear.

Real screens from the explorer. The count is the explorer's own attack-tree score.

Three things to do in ten minutes

Step 1

See how the plant works

Every system from the internet to the protective relays, and the data that has to leave the plant on an ordinary day.

4 crossings carry it out

Step 2

Follow the attack

Start where most incidents on the record began, in enterprise IT, and count the ways an attacker reaches Level 3 or below.

9 ways in, all firewalls

Step 3

Harden a crossing

Switch a crossing to hardware. Plant data still flows out, and the way in is gone. Do all four and cut the vendor line.

0 ways in, all hardware

Built from the public record

Six attacks, each traced on the same diagram from its published investigation. Where the record does not say how an attacker got in, the explorer says so instead of guessing.

Ukraine distribution utilitiesDecember 2015

Stolen credentials on permitted remote access. Breakers opened by hand.

Industroyer, Kyiv transmissionDecember 2016

Malware that spoke the substation protocols and switched on its own.

Colonial PipelineMay 2021

An OT shutdown with no OT breach, forced by uncertainty.

Oldsmar water treatmentFebruary 2021

Remote access straight to an operator screen and a setpoint.

Volt TyphoonAdvisory, February 2024

Years of standing access in US critical infrastructure.

Davis-Besse nuclear stationJanuary 2003

A contractor line the plant firewall never saw.

Reviewed in the field by Andrew Ginter, VP Industrial Security at Waterfall. Every claim links to its source, and the reading list contains no Waterfall pages.

What is inside

A real station layout

Turbine control, the unit DCS, protective relays and the grid dispatch link, each drawn as its own system.

Live attack paths

Every way in is counted and scored by how hard it is, and the score moves as you change a control.

Firewall or hardware

Four crossings, each switchable, so the difference between filtering a path and removing it is one click.

Your own score

Five questions about your station, and its score on the same engine.

Then score your own station

Tell the explorer what guards each crossing at your plant. "Not sure" counts as the worst case. You see your result straight away, with no names and no email needed.

Request access

Ten minutes, in your browser. Built for OT and ICS security engineers at generating utilities.

Request access