“Why is your pump online?”
One building. One water system. Seven states, each one a decision you have to defend with evidence.
A commercial high-rise has a domestic-water booster package: two VFD-driven pumps, pressure transducers, an HMI and a PLC. A vendor added remote support during commissioning. Nobody can produce the approval, the expiry, the data-flow diagram or the current owner. Mid-exercise, a synthetic actor changes a management parameter and the HMI loses view. A simulated leak threatens an electrical room — and the team cannot yet prove whether the affected pump shares power, network or controls with fire-water assets.
Scenario states
How the three hours actually unfold
The range advances only when a team produces something a second person could verify.
- State 01
Baseline
Normal synthetic telemetry, incomplete register.
Inventory the assets and the remote path.
- State 02
Exposure suspected
An external-zone connection appears.
Is the path necessary and authorized?
- State 03
Loss of view
The HMI stops updating after config drift.
Trust the screen, the field reading, or neither?
- State 04
Containment
Approved isolation choices are displayed.
Which network path can be removed safely?
- State 05
Expert assist
Technician initiates a Meta-glasses call.
Can the expert identify the port and guide the procedure?
- State 06
Recovery
Gold configuration becomes available.
Restore, validate and monitor.
- State 07
Verified
MAX reviews the submission.
Is the finding closed or compensated?
What your team does
Seven moves
Discovery first. Containment never before consequence is understood.
Discover
Locate the staged water OT assets and every path that can reach them.
Explain
Answer “Why is this pump online?” — business owner, remote-support need, process consequence.
Prove
Capture acceptable evidence and match device, version and configuration to the relevant CISA advisory, KEV entry or internal obligation.
Contain
Select the least disruptive approved control and obtain safety-authority approval.
Call home
Use Meta glasses so an expert sees what the technician sees and coaches the procedure.
Recover
Restore trusted state, validate local operation and document the rollback.
Verify
MAX grades the evidence, deterministic checks confirm the math, the graph records the result.
The unplug rule
“Just unplug it” becomes a disciplined control: isolate only the network path — not electrical power, not the process — after confirming asset identity, operational consequence, redundancy, fire and life-safety status, water-quality impact, authority and rollback. If those facts are unknown, stop and escalate.
No blind disconnect. Speed without topology is not resilience.
The climb
Noise → Evidence → Judgment → Fact
What is actually here?
OTSEC field discovery captures labels, ports, paths, screens, drawings and operator statements.
Exit: Observation has time, place, source and custodian.
Can another person verify it?
CriticalAsset preserves media, provenance, device context and chain of custody.
Exit: Evidence is attributable, legible and relevant.
What does it mean and what should happen?
CLEO structures and cites; MAX judges; the field expert guides; verifier recomputes.
Exit: A human-approved disposition exists.
What may enter the authoritative record?
CriticalAsset promotes verified assets, relationships, obligations, controls and findings into the graph.
Exit: Every fact resolves to stored evidence.
OCT 15 · 2:00 – 5:00 PM · Los Angeles, CA
12 teams on the range. Free to attend.