---
title: See how attacks reach a power station | Waterfall Security
description: An interactive reference power station, from the internet down to the protective relays. Switch each crossing from firewall to hardware and watch the attack paths close. Request access.
---

[Request access](https://go.waterfall-security.com/purdue-explorer#access)

# See how attacks reach a power station, and what stops them

An interactive reference power station, from the internet down to the protective relays. Switch each crossing from firewall to hardware and watch the attack paths close. Then answer five questions to score your own station.

- 28 systems across six Purdue levels, drawn the way generating stations are built.
- 6 attacks from the public record, each traced on the diagram with its sources.
- Free, runs in your browser, nothing to install.

## Request access

We’ll email you the access link within a few minutes.

![Every crossing on a firewall: attack paths reach the plant levels](https://go.waterfall-security.com/hs-fs/hubfs/Purdue%20explorer/explorer-attack-paths.jpg?width=1400&height=1293&name=explorer-attack-paths.jpg) ![Every crossing on hardware: no path reaches the plant](https://go.waterfall-security.com/hs-fs/hubfs/Purdue%20explorer/explorer-hardened.jpg?width=1400&height=1293&name=explorer-hardened.jpg)

Ways into the plant

90

All four crossings on hardwareAll four crossings on firewalls

## One switch changes the answer

A firewall permits a session, and a permitted session runs both ways. Hardware sends the plant data out and builds no way back in. Switch the crossings between the DMZ and the plant and the attack paths into Levels 3 to 1 disappear.

Real screens from the explorer. The count is the explorer's own attack-tree score.

## Three things to do in ten minutes

Step 1

### See how the plant works

Every system from the internet to the protective relays, and the data that has to leave the plant on an ordinary day.

**4** crossings carry it out

Step 2

### Follow the attack

Start where most incidents on the record began, in enterprise IT, and count the ways an attacker reaches Level 3 or below.

**9** ways in, all firewalls

Step 3

### Harden a crossing

Switch a crossing to hardware. Plant data still flows out, and the way in is gone. Do all four and cut the vendor line.

**0** ways in, all hardware

## Built from the public record

Six attacks, each traced on the same diagram from its published investigation. Where the record does not say how an attacker got in, the explorer says so instead of guessing.

**Ukraine distribution utilities**December 2015

Stolen credentials on permitted remote access. Breakers opened by hand.

**Industroyer, Kyiv transmission**December 2016

Malware that spoke the substation protocols and switched on its own.

**Colonial Pipeline**May 2021

An OT shutdown with no OT breach, forced by uncertainty.

**Oldsmar water treatment**February 2021

Remote access straight to an operator screen and a setpoint.

**Volt Typhoon**Advisory, February 2024

Years of standing access in US critical infrastructure.

**Davis-Besse nuclear station**January 2003

A contractor line the plant firewall never saw.

**Reviewed in the field by Andrew Ginter**, VP Industrial Security at Waterfall. Every claim links to its source, and the reading list contains no Waterfall pages.

## What is inside

### A real station layout

Turbine control, the unit DCS, protective relays and the grid dispatch link, each drawn as its own system.

### Live attack paths

Every way in is counted and scored by how hard it is, and the score moves as you change a control.

### Firewall or hardware

Four crossings, each switchable, so the difference between filtering a path and removing it is one click.

### Your own score

Five questions about your station, and its score on the same engine.

## Then score your own station

Tell the explorer what guards each crossing at your plant. "Not sure" counts as the worst case. You see your result straight away, with no names and no email needed.

Station score

**Your station: 7 ways in**

| Historian data | Hardware |
| --- | --- |
| Remote access | Firewall |
| Batch updates | Firewall |
| Dispatch setpoints | Firewall |
| Unauthorised vendor router | Not sure |

Ways in**7**

Risk index**78 of 100**

## Request access

Ten minutes, in your browser. Built for OT and ICS security engineers at generating utilities.

[Request access](https://go.waterfall-security.com/purdue-explorer#access)

© 2026 Waterfall Security Solutions The explorer is a reference architecture, not a survey of any real site. Scores are relative, not a probability of attack.