Val-d’Ondine — an OT/ICS cyber defense simulator you play in your browser
A fictional hydroelectric dam is under a coordinated intrusion. As incident commander, you have three teams and 72 simulated hours to contain the attacker and keep the reservoir under control while the valley downstream is evacuated. Free, no account, no download.
The scenario
The attack starts from abused remote access and can reach the engineering workstation, supervision, the controller and the gates. Upstream inflow arrives in pulses announced by bulletins; their timing and strength change from one mission to the next. When the gates stop following their setpoint, you must find out why before you repair anything.
What you practise
Tracing an intrusion across the layers of an industrial network, from remote access down to the physical process.
Containing it: closing the paths the attacker needs, revoking access, filtering writes at a boundary.
Deciding on evidence: every observation has a source, a time and a limit. A quiet workstation is not proof of a clean one.
Recovering control: comparing controller logic, testing it, falling back to independent local control with limited crew time.
Choosing what matters most: investigation, containment, recovery and field operations compete for the same teams and hours.
Who it is for
Cybersecurity and industrial engineering students, IT security professionals discovering operational technology, automation and process engineers, and trainers looking for a short decision exercise.
Questions
Is it free?
Yes. It runs entirely in your browser, with no account and no installation.
How long is a mission?
At the slowest speed the simulated clock takes about 15 minutes. Reading and planning happen while the game is paused.
How hard is it?
Extreme. On 3,000 reserved missions, a player who reads the evidence held the site every time. The best fixed sequence of orders found among 16,000 candidate plans held 30 %. Random play never held.
Is it a real dam?
No. The site, its network and its procedures are fictional. It is not an operating procedure or a safety assessment. The Purdue model, IEC 62443 and MITRE ATT&CK for ICS are used as vocabulary, not as certification.
Does it collect data?
No cookies, no browser storage, no tracking. After loading, the game makes no network request.