Three hours, minute by minute
Doors, briefing, discovery sprint, four injects, expert response, recovery and awards. No filler.
- 00:00–00:15
Opening, safety boundary, LA water context, partner roles.
Teams sign rules of engagement; safety gate acknowledged.
- 00:15–00:30
Quick and CriticalAsset orientation, team assignment.
Baseline scenario released.
- 00:30–01:05
OTSEC field-discovery sprint.
Unknown PLC/HMI, vendor path and incomplete SOP discovered.
- 01:05–01:20
Evidence and obligation build.
CLEO cites documents; teams create their first missions.
- 01:20–01:35
Attack inject 1: exposure plus stale identity.
Detection and containment clock starts.
- 01:35–01:55
Attack inject 2: loss of view / config drift.
Teams cross-check independent field evidence.
- 01:55–02:15
Meta-glasses expert response.
Remote expert guides approved isolation and recovery.
- 02:15–02:30
Compound LA inject.
Leak, electrical and fire-water dependency force a tradeoff.
- 02:30–02:45
Recovery and MAX review.
Gold-state validation; evidence rejection and resubmission.
- 02:45–03:00
Readout, verifier results and awards.
After-action packet and verified graph delta displayed.
Scoring
Eight weighted dimensions
Safety is a gate, not a category: a prohibited action disqualifies a team regardless of score.
Verified asset and connectivity facts
20 ptsGraph delta with evidence resolution.
Threat discovery and applicability
15 ptsCorrect exposure, identity, version and advisory match.
Detection quality
15 ptsCorrect signals, timeline and low false-positive reasoning.
Safe containment decision
15 ptsLeast-disruptive control, authority, consequence and rollback.
Expert-led field execution
10 ptsSession evidence, correct procedure, competency attestation.
Recovery and continuity
10 ptsGold state, manual/local validation and restore evidence.
Obligation and SOP completeness
10 ptsOwner, trigger, required evidence, escalation and closure.
Human challenge of AI
5 ptsTeam catches an unsupported AI claim and corrects the record.
Measured on the day
Metrics judges watch
- Mean time to discover the exposed asset or path.
- Mean time to detect unauthorized access or configuration drift.
- Mean time to approved containment and trusted recovery.
- Percent of discovered assets with verified identity, owner, connectivity and process role.
- Percent of findings linked to an applicable authority and treatment obligation.
- Evidence first-pass acceptance and resubmission rate.
Why we run it
Event outcomes
- Prove that asset inventory and connectivity discovery are the first OT controls.
- Convert field observations into evidence-backed, obligation-linked facts — not a spreadsheet of guesses.
- Exercise safe decision-making when containment could affect pumps, fire water, sanitation, pressure or water quality.
- Show expert-led field deployment: a technician calls home through Meta glasses and gets hands-on guidance.
- Measure detection, containment, recovery, evidence quality and human challenge of AI.
- Leave every team with a reusable OTSEC discovery and SOP pattern.
Team composition
Who should be on your roster
Mixed teams consistently outperform single-discipline teams on this range.
OT & ICS security
Bring your discovery instincts. Prove applicability instead of asserting it.
Building engineers & MEP trades
You already know the pump room. Turn that into cited, durable facts.
Blue-team & IR
Detect drift and loss of view with an ICS-aware timeline under a live clock.
AI & data builders
Watch CLEO, MAX and a deterministic verifier disagree — then decide who wins.
Water & public-safety operators
Practice containment that never threatens fire water or water quality.
Founders & investors
See resilience tooling run against a real problem, not a slide.
12 teams. One clock. Bring yours.
Controlled simulation only. No participant scans, accesses, alters, disconnects or operates a live building system. Any physical isolation is performed only by an authorized person under an approved SOP after process-safety and life-safety checks.