#United States #Tampa #SimSpace #Cyber Florida #NUARI

Cyber Florida and SimSpace: Strengthening Utilities' Cybersecurity

As the landscape of cybersecurity threats evolves, utilities across the United States are facing increasingly complex challenges, particularly from nation-state actors. Recent warnings from federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, highlight a growing threat from Iranian cyber forces targeting critical infrastructure such as water and wastewater systems.

In response, Cyber Florida and SimSpace have collaborated to unveil valuable insights from the 2026 Jack Voltaic™ (JV) Tampa cyber resilience exercise, which strategically aimed to evaluate and enhance the operational readiness of utilities against sophisticated cyber attacks.

The Exercise: A Simulation of Real-World Threats

Held in Orlando and Tampa, Florida, the JV Tampa exercise simulated a multifaceted cyber attack on regional water treatment operations. Over the course of three days, more than 100 participants from diverse sectors—government agencies, military organizations, private industry, and emergency management—worked together to respond to a staged incident threatening essential services. By uniting local entities like Tampa Bay Water and U.S. Water Corporation with federal bodies like CISA and the FBI, the exercise sought to validate operational technology (OT) readiness amidst persistent threats.

Participants were tasked with detecting unauthorized activity, investigating threats within both IT and OT environments, and communicating the potential consequences of attacks to executive leadership. Uniquely, this exercise prioritized operational continuity and the collaborative response of participants under pressure, foregoing traditional evaluations that merely assessed compliance.

A New Approach to Cyber Resilience

The JV Tampa exercise introduced a revolutionary format combining a live-fire cyber range with executive decision-making. Utilizing SimSpace's cyber simulation platform, the event allowed engineers and security analysts to engage in real-time responses to evolving threats, creating an environment that mirrored realistic crisis situations. Additionally, the involvement of Norwich University Applied Research Institute (NUARI) provided a structured management framework through its DECIDE® platform, which further stressed the incident response plans of participating organizations.

This dual-platform strategy enabled a seamless blend of technical and managerial responses, reinforcing the coordination between deployment teams and organizational leaders. According to Cyber Florida’s After Action Review, this was the first time such a simultaneous operation had been executed in a cyber exercise, marking a significant advancement for incident response training.

Key Findings from the Exercise

The outcomes from the exercise revealed crucial insights:

• - Participants included representatives from federal, state, local, and private sector entities, advocating a unified front in cybersecurity efforts.
• - Integrating live-fire technical responses with executive tabletop discussions effectively simulated real-world crisis scenarios, thus enhancing coordination between technical staff and leadership.
• - Teams transitioned from isolated responses to a shared situational awareness, which is essential for integrated incident handling.
• - The exercise encouraged hypothesis-driven investigations and the correlation of telemetry between IT and OT systems to drive business-impact decisions.

As cybersecurity strategies evolve to confront new challenges, experts emphasize the importance of operational readiness. Lee Rossey, CTO of SimSpace, noted, "The next phase of cybersecurity is operational validation. Organizations must continuously test their preparedness to ensure the integrity of their operations."

The Future of Cybersecurity in Utilities

The findings from the JV Tampa exercise are essential as organizations increasingly adopt Artificial Intelligence into their security operations. Understanding how human operators and AI systems collaborate is now as critical as the act of threat detection itself. In light of these developments, SimSpace offers its AI Proving Grounds, facilitating continuous validation of AI systems and human defenders against realistic attack scenarios prior to deployment.

Overall, the collaborative efforts between Cyber Florida, SimSpace, and their partners not only fortify the cybersecurity measures employed by utilities but also pave the way for improved resilience against emerging threats in the cyber domain. With the stakes continuing to rise, proactive preparation is vital for maintaining the safety and functionality of critical infrastructure across the nation.