Insights ICS / OT

What a phygital ICS lab teaches that virtual can't

The case for HO-scale physical models wired to real PLCs. Simulators model what a designer thinks a plant does; a phygital range exposes what the plant actually does — timing quirks, protocol edge cases, and the operator muscle memory the screen alone never builds.

By Cyberange Phygital Labs Published 15 May 2026
  • phygital
  • PLC
  • training
  • whitepaper

Sample post — full content pending. This is the long-form companion to Why we ship real PLCs, not software emulators. Use that practice note as the source frame and expand into a 12-minute whitepaper.

The argument in one paragraph

A simulator behaves the way someone modelled a plant to behave. A phygital range behaves the way the plant actually behaves — including the parts the modeller never anticipated. The gap between those two behaviours is the part of OT defence that only shows up in the field. The phygital range puts the field on the bench.

What the whitepaper will cover

  1. What a phygital range is — HO-scale physical model, real PLCs, real protocols, real SCADA telemetry. Not a digital twin. Not a simulator. A small plant.
  2. Three things a simulator cannot teach — protocol timing under load, alarm-flood behaviour, and the SCADA HMI’s failure modes when a controller is no longer responding the way the operator expects.
  3. Three things the phygital range teaches in an afternoon — read those off the bench in front of the operator.
  4. Cost framing for the CISO — capex of a phygital range vs. the cost of an incident that the simulator-trained team didn’t recognise.
  5. What we’d build differently if starting today — and the parts we’d keep exactly the same.

Section 1 — the difference, illustrated

[Side-by-side: same attack scenario on a virtual lab vs. on the phygital range. What the operator sees, what the SCADA HMI shows, where the alarm pattern diverges.]

Section 2 — protocol timing the simulator gets wrong

[Modbus, IEC 61850, DNP3. Where the simulator’s abstraction layer hides behaviour that matters. Concrete examples.]

Section 3 — alarm-flood behaviour

[What an operator does when a real plant generates 200 alarms in 40 seconds. What they do when a simulator generates the same. The difference is the part you train on the range.]

Section 4 — the SCADA HMI under failure

[Stale readings. Frozen panels. The “still green” tile that nobody trusts but everybody acts on. The discipline of distrusting your own HMI is taught by experience — and there’s no substitute for the experience.]

Section 5 — economic framing

[The CFO version of this argument. What the range costs, what an incident costs, what insurance discounts have been negotiated by organisations running quarterly drills on a phygital range.]

What we’d change

[Author’s reflection — what the second-generation range will look like. Whether the modular city tiles stay HO-scale, or whether we move to a larger N-scale plant for the next sector.]


Authoring notes — this is a whitepaper, not a blog post. Target length is 2,500–3,000 words. Include 3–4 photographs of the range in operation. Final draft routes through engineering + the training faculty before publish.