Cyber Florida, SimSpace and NUARI Share Lessons from Nation-State Cyber Exercise to Help Utilities Strengthen Operational Resilience against Iranian OT Threats

Multi-agency exercise demonstrates how critical infrastructure operators can validate IT/OT readiness against emerging threats targeting water systems

ORLANDO, Fla. and TAMPA, Fla., Aug. 27, 2026 /PRNewswire/ -- As federal agencies continue to warn of escalating cyber threats targeting U.S. critical infrastructure, Cyber Florida and SimSpace today announced findings from the 2026 Jack Voltaic™ (JV) Tampa cyber resilience exercise, demonstrating how utilities and public-sector organizations can validate operational readiness against sophisticated attacks targeting operational technology (OT) before those attacks occur.

The announcement comes as the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI continue to warn that Iranian cyber actors are actively targeting internet-connected industrial control systems supporting U.S. critical infrastructure, including the water and wastewater sectors.

The exercise simulated a sophisticated cyber campaign against regional water treatment operations, requiring participants to detect malicious activity, investigate attacks spanning IT and OT environments, coordinate with government agencies and utility operators, and communicate operational impacts to executive leadership. Rather than evaluating compliance or individual technical skills alone, the exercise focused on whether organizations could sustain essential services while responding collaboratively under operational pressure.

Hosted by Cyber Florida in partnership with the U.S. Army Cyber Institute, the three-day Jack Voltaic^TM exercise brought together more than 100 participants from government, utilities, military organizations, emergency management agencies and private industry, including Tampa Bay Water, U.S. Water Corporation, CISA, the FBI, U.S. Cyber Command, and U.S. Central Command, to simulate a coordinated cyberattack against regional water infrastructure.

Unlike traditional tabletop exercises, JV Tampa combined executive decision-making with simultaneous live-fire technical response using SimSpace's cyber simulation platform, allowing operational technology engineers, SOC analysts, and executive leaders to respond to the same evolving attack in real time. Cyber Florida further partnered with Norwich University Applied Research Institute (NUARI), which used their Distributed Environment for Critical Infrastructure Decision-making Exercises (DECIDE®) platform to run the management side of the JV Tampa exercise. DECIDE® simulates cyber-attacks for organizations and their partners to stress and test incident response plans, resulting in after-action reports to improve strategic communication, compliance, risk, and overall resilience.

According to Cyber Florida's After Action Review, the exercise marked the first time a live cyber range and tabletop exercise operated simultaneously on the same scenario, creating a realistic environment that strengthened collaboration between technical responders and organizational leadership.

"Recent nation-state activity reinforces what we've believed for years: critical infrastructure organizations need opportunities to safely validate how people, processes and technology perform together before a real incident occurs," said Bruce Caulkins, Ph.D., Director of Cyber Solutions and Technology at Cyber Florida.

Cyber Florida's After Action Review identified several key findings:

• Nearly 100 participants from federal, state, local and private-sector organizations collaborated during the exercise.
• The dual-platform approach combining SimSpace's live-fire cyber range with executive tabletop decision-making successfully mirrored real-world crisis response and strengthened coordination between technical and leadership teams.
• Participants shifted from isolated technical response toward an integrated incident response posture, improving shared situational awareness and cross-functional collaboration.
• Technical teams practiced hypothesis-driven investigations, correlated IT and OT telemetry, built unified incident timelines and translated technical findings into business-impact decisions for executive leadership.

"For years, cybersecurity has focused on identifying vulnerabilities. The next phase is proving operational readiness. Whether organizations rely on human operators, AI agents or both, they need realistic environments where they can continuously validate decisions before those decisions affect production. That's exactly why we created the AI Proving Grounds," said Lee Rossey, CTO and Co-Founder of SimSpace.

The exercise also reflects a broader shift across the cyber domain. As organizations adopt AI throughout security operations, validating how humans, AI agents and operational technologies work together is becoming as important as detecting threats themselves. SimSpace developed the AI Proving Grounds to help organizations continuously train, test, and operationalize both human defenders and AI-powered systems against realistic attacks before deployment.

About SimSpace:

SimSpace is the realistic cyber simulation infrastructure for continuously training, testing, and validating AI agents. By enabling AI agents to work together with human operators in an intelligent cyber range, SimSpace serves as the AI Proving Grounds for elite cyber teams. To learn how SimSpace helps cyber teams outperform and outsmart adversaries in any terrain, visit: www.simspace.com

Amy Rice, [email protected]

SOURCE SimSpace Corporation