RAMPART Vanderbilt University · Institute for Convergent Software Integrated Systems (ICONS)

Human-AI teaming for cybersecurity in critical water infrastructure

What would a cyberattack actually do to your plant?

Find out — without touching your plant. RAMPART builds a working digital twin of a utility's control network, then lets you attack it, defend it, and train on it safely.

AI changed the attacker. Scanning, planning and pivoting through a network are now automated, cheap, and patient. Small utilities are being hit by the same tools as large ones.
AI can change the defender. Agents that know what normal looks like on your network can watch it around the clock — but only if there is a safe, faithful copy of that network to train and test them on.
The human still decides. No agent takes a treatment plant to manual. Preparing the people who make that call — and learning how they really decide — is the other half of the problem.
1 · Build the twinPlug in, scan, and get a faithful copy of your IT/OT network — PLCs, HMIs, pumps and all.
2 · Attack & defendReplay real-world water sector incidents against the twin. Watch what breaks. Try the fix.
3 · TabletopPut your operators in the chair at 2 a.m. and see the decisions they really make.

· Why now

Water is the critical infrastructure with the most systems, the fewest security staff — and, lately, the most visitors.

Five years, two curves water-sector incidents AI milestones

    1 Build the twin

    Meet Riverbend Water Authority — a made-up utility serving 38,000 people. We have just plugged one laptop into their network. We know nothing about it yet.

    Riverbend network · livenot scanned

    Passive listening first, then gentle, OT-safe queries — the same identity requests your SCADA software already sends.

    0devices
    0services
    0OT protocols
    0field devices inferred
    Twin specification · riverbend.yaml0 lines
    
        
    
      
    
    
    
  
    

  
  
    
    
    
      
    2 Attack & defend — in the twin
    
      
    Everything below runs in the twin: same devices, same protocols, same control logic — and zero risk to real water. Pick a scenario.
    
    
    
    
    
    
    
    
    
      
    
        
    
        
    
          
          
        
    
      
    
      
    
      
    
    
    
    
      
    
        
    
        
      
    
      
    
        
    
          
    Digital twin · network viewisolated sandbox
    
          
    
          
    Click any device for details.
    
        
    
      
    
    
    
    
    
      
    Event timelinered vs. blue
    
      
    
    
    
  
    

  
  
    
    
    
      
    3 Tabletop — you're in the chair
    
      
    Same twin, but now you make the calls. There are no trick questions and no single right answer — every choice has a cost.
    
    
    
    
    
    
    
      
    
      
    
        
    
        
    
          
    What the platform records● REC
    
          
    
        
    
      
    
    
    
  
    

  
  
    
    
    
      
    We're looking for water utility partners
    
      
    Bring RAMPART to your utility.
    
      
    What you just saw was a cartoon of a real system. The real one builds a working twin from a real network, runs real attack tools against it, and provides real insights about defensive capabilities and posturing for enterprise-scale networks. 
        We have seed funding to deploy this to water utilities given our previous success with other utility services.
    
      
    
        
    
          
    What you get
    
          
      
            
    • A digital twin of your OT network, built with your team
      • 
            
    • A plain-language report: what an attacker could reach, and the cheapest fixes
      • 
            
    • Tabletop exercises for your operators, on your plant, with your screens
      • 
            
    • A head start on AWIA risk & resilience and cyber incident response planning
      • 
            
    • It is free to you — DARPA has already provided seed funding for this integration.
      • 
          
    
        
    
        
    
          
    What we ask
    
          
      
            
    • Supervised access to scan an OT environment — passive-first, on your schedule, with your staff in the room
              
      • Or a mock-up of your network, if you would rather not disclose real information
      • 
            
    • A few hours from the people who know the plant
      • 
            
    • Optional: operators who'd join our study of how people really respond to cyber incidents (university ethics-board reviewed, de-identified)
      • 
            
    • Your honest feedback on what is and isn't useful
      • 
          
    
        
    
        
    
          
    Why we're doing this
    
          
      
            
    • RAMPART is a Vanderbilt research project under DARPA's CASTLE program
      • 
            
    • We want to deploy this to water systems of all sizes given the increasing threat of cyber attacks in critical infrastructure
      • 
            
    • Your network details stay confidential under an agreement you control
      •