The City Hacks The State · Three-hour purple-team exercise
Hack The BuildingKeep LA Flowing
Three hours. One building's water. Zero blind disconnects. Find the asset. Prove why it is connected. Contain it without breaking fire water. Then get an expert on the glasses before the condition becomes an incident.
Operating thesis
The first line of OT defense is field discovery: find the asset, determine why it is connected, capture the evidence, apply the obligation, and get an expert on the glasses before the condition becomes an incident.
01 / The anchor
Why water. Why Los Angeles.
Water is the right anchor because a cyber condition becomes a physical building decision immediately: can the team trust the pressure reading, identify the controller, preserve fire-water service, isolate the correct connection, and recover without creating a larger loss? In Los Angeles, wildfire, drought, seismic risk, aging assets, power dependency and constrained field staffing make this a resilience problem — not merely an IT problem.
Recommended conceptMixed teams discover a deliberately imperfect building-water OT estate, turn observations into cited facts, contain a simulated exposure, dispatch expert help over Meta glasses, and prove recovery in CriticalAsset.
- Prove that asset inventory and connectivity discovery are the first OT controls.
- Convert field observations into evidence-backed, obligation-linked facts — not a spreadsheet of guesses.
- Exercise safe decision-making when containment could affect pumps, fire water, sanitation, pressure or water quality.
- Show expert-led field deployment: a technician calls home through Meta glasses and gets hands-on guidance.
- Measure detection, containment, recovery, evidence quality and human challenge of AI.
- Leave every team with a reusable OTSEC discovery and SOP pattern.
Water is the fast fuse
A cyber condition becomes a physical building decision in seconds — pressure, pumps, sanitation and fire water all at once.
Discovery is control #1
You cannot patch, isolate, monitor or recover an asset you cannot name. Field discovery is the first OT defense.
Call home through the glasses
Remote experts see what the technician sees, coach the procedure and attest the competency.
Facts, not guesses
CriticalAsset only promotes a claim when evidence, judgment and the deterministic verifier all line up.
02 / Concept of operations
Noise → Evidence → Judgment → Fact
Every team climbs the same four scales. Nothing enters the authoritative record until it survives all four.
What is actually here?
OTSEC field discovery captures labels, ports, paths, screens, drawings and operator statements.
Exit: Observation has time, place, source and custodian.
Can another person verify it?
CriticalAsset preserves media, provenance, device context and chain of custody.
Exit: Evidence is attributable, legible and relevant.
What does it mean and what should happen?
CLEO structures and cites; MAX judges; the field expert guides; verifier recomputes.
Exit: A human-approved disposition exists.
What may enter the authoritative record?
CriticalAsset promotes verified assets, relationships, obligations, controls and findings into the graph.
Exit: Every fact resolves to stored evidence.
03 / Participant journey
Seven moves in three hours
- 01
Discover
Locate the staged water OT assets and every path that can reach them.
- 02
Explain
Answer “Why is this pump online?” — business owner, remote-support need, process consequence.
- 03
Prove
Capture acceptable evidence and match device, version and configuration to the relevant CISA advisory, KEV entry or internal obligation.
- 04
Contain
Select the least disruptive approved control and obtain safety-authority approval.
- 05
Call home
Use Meta glasses so an expert sees what the technician sees and coaches the procedure.
- 06
Recover
Restore trusted state, validate local operation and document the rollback.
- 07
Verify
MAX grades the evidence, deterministic checks confirm the math, the graph records the result.
04 / The stack
Six systems and one referee
If the AI and the rules disagree, the deterministic verifier wins.
| System | Event job | What you see |
|---|---|---|
| CriticalAsset | Operational Infrastructure Graph, obligations, missions, evidence chain and authoritative facts | The building, assets, dependencies, vulnerabilities, SOPs, evidence and judgments in one graph |
| OTSEC | Threat-surface discovery plus expert-led field remediation | Field surveys, connected-asset questions, known-issue checks, approved containment and recovery |
| Amazon Quick | Command and collaboration work surface | Incident view, task queue, evidence status, team progress and scoreboard |
| CLEO | Plan-room and obligation specialist | Cited extraction from drawings, O&M manuals, SOPs and records; explicit gaps and no-assumption findings |
| MAX | Chief Inspector / mission assurance | Accepts or rejects evidence and professional conclusions; requests resubmission |
| Deterministic verifier | Recomputes rules, scores and state transitions | A visible verified / not-verified result — it wins if AI and rules disagree |
05 / Guardrails
Three action classes. One gate.
Safety is a gate, not a point category. A prohibited action disqualifies a team regardless of speed or score.
Observation and interaction with synthetic or dead training assets
Read labels; trace a mock cable; inspect a staged HMI; query the graph; submit evidence; execute simulator controls
Preapproved physical or network isolation after checklist and safety-authority approval
Disconnect the training PLC network lead; disable the simulated switch port; restore a gold configuration
Any contact with venue or building production systems
Scanning venue networks; logging into live BAS/PLC/HMI; changing setpoints; closing live valves; unplugging a working pump
The unplug rule
“Just unplug it” becomes a disciplined control: isolate only the network path — not electrical power, not the process — after confirming asset identity, operational consequence, redundancy, fire and life-safety status, water-quality impact, authority and rollback. If those facts are unknown, stop and escalate.
No blind disconnect. Speed without topology is not resilience.
06 / Who belongs on a team
Mixed teams win this one
Twelve teams. Purple, not red versus blue. The best team is the one that can prove what it claims.
OT & ICS security
Bring your discovery instincts. Prove applicability instead of asserting it.
Building engineers & MEP trades
You already know the pump room. Turn that into cited, durable facts.
Blue-team & IR
Detect drift and loss of view with an ICS-aware timeline under a live clock.
AI & data builders
Watch CLEO, MAX and a deterministic verifier disagree — then decide who wins.
Water & public-safety operators
Practice containment that never threatens fire water or water quality.
Founders & investors
See resilience tooling run against a real problem, not a slide.
Why is your pump online?
The booster package, the vendor path nobody approved, the HMI that stops updating — state by state.
Open →Ten conditions, eight injects
The CISA-aligned priority list teams hunt, plus the controlled adversary catalog running against them.
Open →Workflow, obligations, range
Nine field steps, ten obligation families, the isolated event stack and the standards it maps to.
Open →07 / Straight answers
Before you register
- Do I need OT or ICS experience?
- No. Teams are mixed on purpose — trades, IT security, developers and operators. The exercise rewards teams that can prove what they claim, not teams with the most acronyms.
- Will anyone touch a real building system?
- Never. Every asset is synthetic or a dead training unit, labeled TRAINING / SYNTHETIC and mapped to an asset ID. The range has zero routable path to venue production networks.
- What do I bring?
- A laptop and shoes you can stand in for three hours. Range access, staged assets, documents, Meta glasses sessions and the CriticalAsset graph are provided.
- What do I leave with?
- An after-action package for your team — timeline, evidence, detections, decisions, gaps and scores — plus a reusable OTSEC discovery and SOP pattern.
- How are teams scored?
- Eight weighted dimensions across discovery, detection, safe containment, recovery, obligations and human challenge of AI. Safety is a gate, not a point category: a prohibited action disqualifies regardless of speed.
Presented by & partners
Presented by the makers of
Hosted by InsureMEP, the makers of CriticalAsset — the Operational Infrastructure Graph that remembers every verified asset, obligation and piece of evidence produced on the day — with live experts on the glasses beside every team.
With support from
- OTSEC
- Amazon Quick
- Meta
- AWS
- LA Tech Week
- + more to come
Partner slots are open for the October 15 exercise — civic water, cloud, OT and trade sponsors welcome.
OCT 15 · 2:00 – 5:00 PM · Los Angeles, CA
Keep LA flowing.Bring a team.
12 teams on the range. Registration is free and closes when the range fills.
Controlled simulation only. No participant scans, accesses, alters, disconnects or operates a live building system. Any physical isolation is performed only by an authorized person under an approved SOP after process-safety and life-safety checks.