SimSpace launches EWI Radar to test OT cyber defences

SimSpace has launched EWI Radar, a research tool for testing cyber defences against emerging attacks before deployment in production. It is aimed at operational technology teams.

The launch was accompanied by a controlled experiment in which SimSpace recreated an Iran-attributed campaign targeting internet-exposed IP cameras. It then tested whether behavioural detection could identify malicious activity without relying on known attack signatures.

EWI Radar sits within SimSpace's cyber range platform and lets defenders reproduce threat activity inside a simulated version of their own environments. This allows security teams to develop and validate detection methods before introducing them into live systems, where poorly tested controls can disrupt operations.

That focus reflects a broader challenge in industrial and operational technology networks, where security teams often have less room to experiment than in conventional IT settings. In those environments, a failed security change can affect physical processes as well as digital systems.

In its latest research, SimSpace used a 12-device simulated camera fleet built on multi-homed cyber range hardware, with firmware interfaces and device-level transport layer security configured to mirror real devices. Researchers first created a baseline of normal behaviour, then launched what SimSpace described as a five-phase adversary campaign based on disclosed exploit structures linked to five vulnerabilities associated with the original incident.

Test case

The campaign recreated activity documented by outside security researchers, who had reported intensified targeting of Hikvision and Dahua IP cameras by Iran-linked threat actors across several countries. SimSpace said the episode showed how compromised cameras could be used for reconnaissance and assessment activity, and how monitoring that traffic could provide an early sign of broader operations.

In the experiment, SimSpace tested a behavioural detection method that combined an unsupervised Isolation Forest model with a deterministic latency-ratio check. The model was trained on baseline device behaviour, chiefly response latency and response size, and was not given attack signatures or any indication of when the simulated attack would begin.

The exercise was designed to assess whether behavioural methods alone could detect abnormal conditions during a realistic campaign. During calibration, SimSpace reported zero idle false positives across what it called a 72-combination grid. In the live simulation, every alert was confirmed by both the machine-learning detector and the latency-ratio check, while all alerts retained attribution to the attack source.

According to SimSpace, each alert also identified the affected device, the relevant vulnerability pattern, source information, the detection method and the basis for the classification.

Shift in security

The product enters a market where cybersecurity suppliers are trying to move customers beyond tools trained largely on historical attacks. That approach has become harder to defend as attackers automate the generation of new variants and adapt tactics more quickly, particularly in environments with limited historical data for training defensive models.

SimSpace framed EWI Radar as part of a wider move from reactive detection to earlier-stage validation of defences. Rather than waiting for a live incident to produce evidence for tuning security controls, the company argues for simulated environments that generate synthetic attack and infrastructure data for testing.

Clint Sand, Chief Product Officer at SimSpace, said the company is seeing demand for methods that allow defenders to validate controls before introducing them into operational settings.

"Cyber defenders need the ability to move quickly with confidence that a new defense will be effective before their environment is under attack," said Sand, Chief Product Officer at SimSpace.

He added that the company's approach is intended to connect current threat intelligence with repeatable testing in a controlled setting.

"As part of SimSpace's preemptive cyber simulation platform, EWI Radar empowers defenders to take intelligence from an active threat, recreate the relevant conditions safely, and test a defensive approach repeatedly and at a massive scale to understand whether it deserves to be trusted, and where it must be bolstered. For OT teams protecting systems where failure has real-world consequences, that path from threat intelligence to operational evidence is increasingly essential," Sand said.

SimSpace also pointed to a broader industry shift towards simulation-based security testing using synthetic data, citing external analyst research that argues such methods will play a larger role in how cybersecurity products are developed and assessed.

For SimSpace, the immediate case for EWI Radar rests on the operational technology sector, where organisations need evidence that a defensive control works before putting production systems at risk.