Plan an OT/ICS red-team engagement, emulate a real adversary, track what got through, and hand the client a report — all mapped to MITRE ATT&CK for ICS.
Red-teaming an industrial environment is not the same as popping a web app. The hard part is doing it safely and legibly: agreeing scope, emulating an adversary the client actually worries about, recording what each technique met — a wall, an alert, or nothing — and turning that into something the asset owner can act on. Vantage is the planning, coverage, and reporting layer for exactly that work.
It is methodology, not malware. Vantage holds no exploits and drives no attacks. It organises an authorised assessment around the public ATT&CK for ICS taxonomy and produces the artifacts a consulting engagement lives or dies by: an emulation plan, a coverage matrix, and a written report.
- Adversary emulation plans from public threat profiles — TRITON, Industroyer, PIPEDREAM, and IT-to-OT ransomware — each mapped to the ATT&CK for ICS techniques it is publicly associated with.
- A coverage matrix in the familiar ATT&CK Navigator style: every tactic and technique, each cell coloured by what happened — successful, detected, blocked, planned, or out of scope.
- Findings tracking per technique: status, severity, what was observed, and the recommendation that follows.
- A report generator that turns the engagement into a clean Markdown deliverable with an executive summary and prioritised findings.
pip install -r requirements.txt
# see the adversary profiles you can emulate
python run.py threats
# build an engagement that emulates PIPEDREAM
python run.py plan --threat pipedream --name "Water utility assessment" \
--client "Riverside Water" --scope "L3 Site Ops,L2 Supervisory,L1 Control"
# (or load the fully populated demo)
python scripts/make_demo_engagement.py engagement.json
# open the coverage matrix
python run.py dashboard --engagement engagement.json # -> http://localhost:3003
# generate the report
python run.py report engagement.json --out report.md
The dashboard is the heart of Vantage: the full ATT&CK for ICS matrix, twelve tactics from Initial Access to Impact, with each technique you exercised coloured by outcome. A wall of green is a hardened site; a red cell in Impair Process Control is the finding that ends up on page one of the report. It is the same matrix the blue side defends — shown from the attacker's chair.
threat profile ──▶ emulation plan (ATT&CK for ICS techniques)
│
▼
engagement ──▶ record outcome per technique ──▶ coverage matrix (dashboard)
│ (blocked/detected/successful) │
└──────────────────────────────────────────────────┴──▶ assessment report
- Common language. Scoping a test against ATT&CK for ICS means the client's blue team can map every finding straight to a detection or control.
- Defensible. An emulation plan tied to a named, public adversary is far easier to justify to an asset owner than an open-ended "we'll try things".
- Purple by default. Because every technique carries the defender's signal, the same engagement doubles as a detection-gap assessment.
| Profile | Year | Target |
|---|---|---|
| TRITON / TRISIS | 2017 | Safety Instrumented Systems |
| Industroyer / CRASHOVERRIDE | 2016 | Electric grid substations |
| PIPEDREAM / INCONTROLLER | 2022 | Multiple PLC / OPC UA platforms |
| IT-to-OT Ransomware | various | Enterprise IT bridging into OT |
Each profile is a reference to public threat reporting — the campaign name and the
ATT&CK technique IDs it is associated with — used to seed a plan. Profiles are easy
to add in vantage/threats.py.
Vantage is for authorised OT/ICS security assessments only. It is a planning, tracking, and reporting tool: it contains no exploit code, payloads, or attack automation, and it never touches a live device. Industrial testing carries real safety risk — always work under written rules of engagement, with operations staff aware, and validate process-impacting techniques by simulation rather than against running plant. Use it to make authorised assessments safer and clearer, nothing else.
- Export the coverage matrix to ATT&CK Navigator JSON for sharing with blue teams
- HTML / PDF report rendering alongside Markdown
- Custom threat profiles from a YAML file
- Engagement diffing — show detection improvement between two assessments
- Mapping findings to common OT controls (IEC 62443 / NIST 800-82)
MIT — see LICENSE.