Each demonstration is a working process on screen, drawn to match the real control system of that sector. Run the plant, trigger the attack, and watch what the operator sees. Everything runs in a browser with no install and no network.
Built around the control systems and protocols each sector actually runs, not a generic diagram.
Blending and CIP for a soft drinks line. A paid insider plugs a USB stick into an operator panel and the plant goes blind while the PLCs keep running.
An IEC 61850 substation targeted at 62443 SL3. Protection and control on a PRP network, with GOOSE and sampled values as the thing an attacker actually reaches.
Automated storage and retrieval, conveyor sortation and the WMS link. Where operational technology stops and the business system begins is the whole argument.
Dosing, filtration and distribution across remote sites. Telemetry over public networks and unmanned assets are the two problems that define this sector.
The process screen is a live mimic. Batches run, valves open, readings move. Plant engineers recognise it because it is drawn to their conventions.
A single realistic scenario plays out on a clock, hop by hop, showing how far it spreads and how much of it ever reaches a security team.
Enable one control at a time and watch the chain get cut earlier. The argument is not the whole stack, it is that each layer changes the outcome.