Val-d’Ondine — an OT/ICS cyber defense simulator you play in your browser
A fictional hydroelectric dam is under a coordinated intrusion. As incident commander, you have three teams and 72 simulated hours to contain the attacker and keep the reservoir under control while the valley downstream is evacuated. Free, no account, no download.
The scenario
The attack starts from abused remote access and can reach the engineering workstation, supervision, the controller and the gates. Upstream inflow arrives in pulses announced by bulletins; their timing and strength change from one mission to the next. When the gates stop following their setpoint, you must find out why before you repair anything.
What you practise
Tracing an intrusion across the layers of an industrial network, from remote access down to the physical process.
Containing it: closing the paths the attacker needs, revoking access, filtering writes at a boundary.
Deciding on evidence: every observation has a source, a time and a limit. A quiet workstation is not proof of a clean one.
Recovering control: comparing controller logic, testing it, falling back to independent local control with limited crew time.
Choosing what matters most: investigation, containment, recovery and field operations compete for the same teams and hours.
Who it is for
Cybersecurity and industrial engineering students, IT security professionals discovering operational technology, automation and process engineers, and trainers looking for a short decision exercise.
Questions
Is it free?
Yes. It runs entirely in your browser, with no account and no installation.
How long is a mission?
At the slowest speed the simulated clock takes about 15 minutes. Reading and planning happen while the game is paused.
How hard is it?
Extreme. On 3,000 reserved missions, a player who reads the evidence held the site every time. The best fixed sequence of orders found among 16,000 candidate plans held 9 % on 10,000 other missions. Random play never held.
Can it be used to raise a team’s awareness of industrial cybersecurity?
Yes, as a basis for discussion around a mission. The game introduces the security of industrial control systems (OT/ICS), including SCADA supervision, and lets a group discuss crisis decisions. It does not replace an exercise built on your organization’s own procedures.
Is it a real dam?
No. The site, its network and its procedures are fictional. It is not an operating procedure or a safety assessment. The Purdue model, IEC 62443 and MITRE ATT&CK for ICS are used as vocabulary, not as certification. It is not a certified training course and does not demonstrate compliance with NIS2 or any other regulation.
Does it collect data?
No cookies, no browser storage, no tracking. After loading, the game makes no network request.
Is it available in French?
Yes. The game and its presentation are also available in French at cybersecurity.industries/fr/.