Automation fundamentals
Free
Foundation → Practitioner
An extensive open textbook covering industrial measurement, control loops, instrumentation, PLCs, and process safety. Available as downloadable material for deeper study.
Use it for: Learn what sensors, actuators, and control systems actually do before analyzing their security.
- Cost
- $0
- Access
- Free downloadable textbook; select the stable edition
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation
A free electrical and electronics textbook covering DC/AC circuits, semiconductors, digital circuits, and practical experiments.
Use it for: Build the electrical background needed to understand industrial I/O and field devices.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Foundation → Practitioner
Video libraries introduce PLC control and provide product-specific instruction for AutomationDirect controller families. The provider also links free programming software.
Use it for: Learn scan cycles, I/O, ladder logic, and basic controller programming.
- Cost
- $0
- Access
- Training free; registration may be required; physical controllers are extra
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Foundation → Practitioner
Free online training for Ignition, a widely used SCADA platform. Lessons explain the software and its use in industrial visualization and automation.
Use it for: Understand SCADA projects, operator interfaces, data collection, and application structure.
- Cost
- $0
- Access
- Training free; account for progress/credentials; production Ignition licensing separate
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Foundation → Practitioner
Modular educational materials teach Siemens automation technologies through documents and projects. Modules can be selected according to existing knowledge.
Use it for: Study Siemens PLC engineering workflows and build structured automation exercises.
- Cost
- $0
- Access
- Documents free with Siemens ID and extended SiePortal rights; software/hardware for exercises may cost extra
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation
Short public videos explain industrial automation components and concepts with visual examples. The public channel is separate from the subscription course catalog.
Use it for: Quickly understand PLCs, sensors, control panels, and common automation terminology.
- Cost
- $0
- Access
- Public videos free; full structured courses paid
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Foundation
An always-free plan supplies limited access to basic automation courses and projects. The broader PLC and robotics course libraries require paid plans.
Use it for: Sample introductory PLC instruction before buying hardware or a training subscription.
- Cost
- $0
- Access
- Free account; limited basic courses/projects; no credit card advertised as required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Foundation → Practitioner
A freely downloadable IEC 61131-3 development environment for creating industrial control programs. It gives learners exposure to a real automation engineering tool.
Use it for: Practice PLC programming and explore project structure and control logic.
- Cost
- $0
- Access
- IDE free; store registration may be required; target runtimes and add-ons can require licenses
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Security learning and reference
Free, with conditions
Foundation
The CISA catalog lists OPSEC and 210W modules covering ICS components, IT/OT differences, risk, threats, vulnerabilities, impacts, and defense in depth.
Use it for: Use the introductory modules as a structured bridge from IT security to OT.
- Cost
- $0
- Access
- No tuition; registration and critical-infrastructure audience/eligibility conditions apply
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner
An on-demand online course focused on skills for protecting ICS and OT networks. CISA lists it as a prerequisite for the in-person ICS301 course.
Use it for: Build technical readiness for more involved ICS security exercises.
- Cost
- $0
- Access
- No tuition; portal account and eligibility conditions apply
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner → Specialist
CISA offers industrial control system evaluation training online and in person. The online catalog entry is an option for learning assessment-oriented ICS security.
Use it for: Develop assessment vocabulary and a structured approach to evaluating industrial environments.
- Cost
- $0
- Access
- No tuition for online course; portal registration/eligibility; in-person format separate
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Program lead
An on-demand offering aimed at managers in the industrial cybersecurity landscape rather than solely hands-on technical operators.
Use it for: Give managers and program stakeholders an entry point into ICS cybersecurity.
- Cost
- $0
- Access
- No tuition; portal registration and eligibility conditions apply
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner → Specialist
Instructor-led ICS301 includes a red/blue exercise; ICS311 focuses on detecting an attacker. These offer hands-on experience beyond self-paced reading.
Use it for: Practice technical defense and investigation in an industrial training environment.
- Cost
- $0
- Access
- No tuition; prerequisites, approval, dates, and seats apply; travel/lodging are extra
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Foundation → Practitioner
Volumes 1–3 introduce and organize ICS security concepts in a compact practitioner reference format.
Use it for: Use as a glossary and desk reference while learning architecture and defensive practice.
- Cost
- $0
- Access
- Free resource; download form or account may be required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner / Program lead
A strategy paper explains five ICS priorities: incident response, defensible architecture, visibility, secure remote access, and risk-based vulnerability management.
Use it for: Turn a broad OT program into a short set of defensible priorities.
- Cost
- $0
- Access
- Free paper; download form or login may apply
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner
A compact reference provides guidance for network security monitoring and incident response in control system environments.
Use it for: Keep an OT-oriented monitoring and response reference alongside incident procedures.
- Cost
- $0
- Access
- Free poster/PDF; download form or account may apply
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Program lead
ISA's overview and linked Quick Start Guide explain the organization and purpose of the 62443 series and how to navigate its documents.
Use it for: Understand which parts concern asset owners, service providers, systems, and products.
- Cost
- $0
- Access
- Overview/guide free; normative standards are separate licensed documents
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
Public recordings of industry talks cover industrial security research, operational problems, architecture, and program decisions. The event page links the S4 Events video channel.
Use it for: Learn from technical presentations and compare practitioners' approaches to difficult OT problems.
- Cost
- $0
- Access
- Published recordings free; attending the conference is paid
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation
A free article series introduces industrial systems and the distinctive challenges of securing them. Later installments cover remote-access connections and protective practices.
Use it for: Give people entering OT a short reading route before longer standards and technical books.
- Cost
- $0
- Access
- Public articles free; paid course promotions are separate
- Reviewed
- 2026-10-12
Related official source
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free
Foundation → Practitioner / Program lead
A practical guide covers visit preparation, coordination with safety and engineering, plant-floor discussions, asset inventory fields, and passive traffic analysis.
Use it for: Prepare a useful site-assessment checklist and gather operational context, especially when visiting unfamiliar plants.
- Cost
- $0
- Access
- Public guide free; field activities require site permissions and safety procedures
- Publication status
- 2021 article; use current site procedures
- Reviewed
- 2026-10-12
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free, with conditions
Foundation / Program lead
A visual comparison explains differences in mission, operational context, priorities, and risk between traditional IT and industrial security.
Use it for: Brief IT staff and leadership on why security decisions need operational and engineering context.
- Cost
- $0
- Access
- Free downloadable poster; account/download requirements may apply
- Publication status
- Publisher landing page currently dated May 2025; manual referenced an earlier version
- Reviewed
- 2026-10-12
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free, with conditions
Foundation → Practitioner
An awareness poster illustrates access paths into ICS and layered defenses using the Purdue model.
Use it for: Support plant-floor awareness conversations and explain why engineering assets attract attackers.
- Cost
- $0
- Access
- Free downloadable poster; account/download requirements may apply
- Publication status
- Publisher landing page currently dated May 2025; manual referenced an earlier version
- Reviewed
- 2026-10-12
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free
Foundation → Practitioner
An independent OT/ICS security consultant and educator's site lists free e-books on getting started in OT/ICS cybersecurity, more than 30 infographics, and over 50 YouTube videos, including more than 40 hours of free course content in its Getting Started in ICS/OT Cyber Security playlists.
Use it for: Follow a structured, video-based self-study path that connects IT security skills to industrial systems.
- Cost
- $0
- Access
- Free videos, e-books and infographics (no account stated for these); an optional newsletter is offered; paid classes, trainings and consulting are separate; TryHackMe rooms are listed but their cost was not stated
- Reviewed
- 2026-10-13
How this was checked
Site fetched on October 13, 2026; the free-content claims are the site's own description; videos and e-books not opened or evaluated; prices for paid classes not shown
Free
Practitioner → Program lead
An interview podcast on OT and ICS security hosted by Dale Peterson, mixing his opening commentary, guest conversations and listener questions.
Use it for: Hear practitioners and vendors discuss industry problems, then follow up on topics relevant to your own program.
- Cost
- $0
- Access
- Audio episodes through the website, an RSS feed and common podcast apps; podcast directories list it as free to listen; sponsor and vendor perspectives apply
- Publication status
- Directory listings show episodes through 2025; check the feed for current activity
- Reviewed
- 2026-10-13
How this was checked
Podcast page fetched on October 13, 2026; free-to-listen status and activity dates come from podcast-directory listings; no episodes were listened to
Free, with conditions
Foundation → Practitioner
A non-profit that builds hands-on awareness and training for industrial security. Its site lists free online resources, including open courseware, capture-the-flag challenges, an OT trainer-kit build guide and plant-level case studies, alongside a podcast and in-person demonstrations at conferences.
Use it for: Use the challenges and trainer-kit guide for hands-on practice, and the case studies to explain plant-level risk to others.
- Cost
- $0
- Access
- Online resources described as free to access; registration, fees and capacity for in-person trainings and events were not stated; hardware for the trainer kit is extra
- Reviewed
- 2026-10-13
How this was checked
Site fetched on October 13, 2026; the descriptions are the site's own; courseware, challenges and the build guide not opened or evaluated
Free
Practitioner → Specialist
A community-curated list of industrial control system security resources, with sections for tools, honeypots, data, feeds and news, conferences, literature and education.
Use it for: Discover tools and papers beyond this catalog, treating it as a lead generator: check each item's source, license and age before relying on it.
- Cost
- $0
- Access
- Free public GitHub list (Apache-2.0); the items link to third-party material with its own terms
- Publication status
- Community list; completeness and currency of individual links not verified
- Reviewed
- 2026-10-13
How this was checked
Official repository page fetched on October 13, 2026; the page did not show a date for the latest change, so currency of individual links was not verified
Frameworks and architecture
Free
Foundation → Specialist
The final OT security guide explains OT characteristics, architectures, threats, and safeguards, with attention to performance, reliability, and safety constraints.
Use it for: Use as the central reference for architecture reviews, control selection, and program documentation.
- Cost
- $0
- Access
- Free; no account required
- Publication status
- Final, September 2023
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner / Program lead
The September 2026 draft expands sector coverage and restructures the guide around CSF 2.0, including governance.
Use it for: Track proposed changes and prepare informed feedback; keep final guidance clearly distinguished.
- Cost
- $0
- Access
- Free; no account required
- Publication status
- Initial public draft, September 21, 2026; comments due November 30, 2026
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Program lead
A cross-sector framework organizes cybersecurity outcomes around Govern, Identify, Protect, Detect, Respond, and Recover.
Use it for: Describe target outcomes, communicate with leadership, and structure a program roadmap.
- Cost
- $0
- Access
- Free; no account required
- Publication status
- Final
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner / Program lead
The CSF 2.0 manufacturing profile adapts cybersecurity outcomes to manufacturing environments. Revision 2's landing page identifies the publication as an initial public draft.
Use it for: Connect enterprise cybersecurity outcomes with manufacturing operations and risks.
- Cost
- $0
- Access
- Free; no account required
- Publication status
- Rev. 2 initial public draft, September 2025; comment period closed
- Reviewed
- 2026-10-12
Related official source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner / Program lead
An ICS-specific guide applies CIS Controls to industrial environments instead of assuming ordinary enterprise IT implementation.
Use it for: Translate familiar safeguards into an OT-specific improvement plan.
- Cost
- $0
- Access
- Free guide; download form may apply
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Program lead
A prioritized baseline of cybersecurity practices helps critical infrastructure organizations focus on actions with risk-reduction value. Covers both IT and OT.
Use it for: Build a practical initial backlog for organizations with limited staff and budget.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher search-index evidence reviewed; direct CISA page retrieval blocked with HTTP 403; use current landing-page version
Free
Practitioner / Program lead
A maturity model and self-evaluation resources help organizations assess IT/OT cybersecurity capabilities and prioritize investments. Although developed in energy, other industries can use it.
Use it for: Run a maturity workshop and identify specific program gaps.
- Cost
- $0
- Access
- Public model/resources free; some evaluation resources may require a request
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Program lead
Joint international guidance presents six principles for decisions affecting a safe, secure OT environment.
Use it for: Use as common ground for security, engineering, operations, and leadership.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner / Architect
Joint guidance addresses the security of connections into and within industrial environments.
Use it for: Review external access, connectivity decisions, and boundary protections against a consistent reference.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Practitioner
A guide explains a systematic approach to OT asset inventories and supplemental taxonomies, including recommended inventory fields.
Use it for: Create a useful inventory schema tied to function, criticality, and security activities.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner / Architect
Guidance helps organizations establish and maintain an accurate view of industrial architecture for both existing and new environments.
Use it for: Improve network diagrams and the relationship between documented architecture and operational reality.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner / Architect
OT-focused guidance addresses using privileged access workstations for high-risk administrative access.
Use it for: Develop secure engineering and administration workflows.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner / Program lead
A freely available evaluation tool supports systematic cybersecurity assessments. The official repository provides releases, documentation, and issue tracking.
Use it for: Organize assessment questions and record improvement priorities.
- Cost
- $0
- Access
- Software free; deployment and local computing resources required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner / Program lead
A conceptual model distinguishes architecture, passive defense, active defense, intelligence, and offense. It supports discussion of how security actions and investments build on one another.
Use it for: Explain why architecture and visibility should underpin later hunting and intelligence investments.
- Cost
- $0
- Access
- Free whitepaper; download/account requirements may apply
- Publication status
- 2015 foundational paper; conceptual model, not a compliance standard
- Reviewed
- 2026-10-12
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free
Foundation → Program lead
A joint fact sheet urging operators to take OT systems off the public internet, replace default passwords, tighten remote access, separate IT and OT networks, and keep the ability to operate manually.
Use it for: Use it as a short, prioritized checklist for a first review of exposed or weakly protected OT.
- Cost
- $0
- Access
- Free; no account required
- Publication status
- Published May 6, 2025
- Reviewed
- 2026-10-13
How this was checked
CISA page fetched on October 13, 2026; the linked PDF was not opened
Engineering and sector guidance
Free
Practitioner → Specialist
CIE incorporates cyber considerations into physical-system design and operations. The linked implementation guide supplies questions engineering teams can consider throughout the lifecycle.
Use it for: Translate cyber threats into engineering decisions that reduce physical consequences.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
A collection of technical materials, practical guidance, case studies, and lessons supports applying CIE principles.
Use it for: Find deeper engineering examples after studying the CIE implementation guide.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
Public methodology materials introduce a consequence-focused approach to protecting critical infrastructure, alongside information about training and engagements.
Use it for: Identify critical functions and study engineering approaches to reducing high-consequence cyber risk.
- Cost
- $0
- Access
- Public reference materials free; training dates/eligibility and engagement access are separate
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner / Sector specialist
Official standards pages provide CIP documents and distinguish enforced versions from those scheduled for future enforcement.
Use it for: Study electricity-sector security requirements and use the correct standard/version.
- Cost
- $0
- Access
- Public standards free to read; applicability is sector/jurisdiction-specific
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Program lead
Public TLP:CLEAR guides summarize cybersecurity practices for water and wastewater utilities, with a dedicated small-systems compendium. The updated collection uses 12 fundamentals.
Use it for: Build a practical water-sector improvement plan suited to resource-constrained operators.
- Cost
- $0
- Access
- These public PDFs free; WaterISAC membership and restricted intelligence are separate
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Practitioner
EPA provides cybersecurity guidance, a self-assessment tool, risk-mitigation templates, and checklist fact sheets for water systems; some resources also have Spanish versions.
Use it for: Conduct an accessible water-system assessment and document corrective actions.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner / Architect
A NIST National Cybersecurity Center of Excellence practice guide showing how commercially available, standards-based products can provide behavioral anomaly detection, application allowlisting and file-integrity checking in manufacturing control system environments.
Use it for: Use it as a worked reference architecture when planning detection and integrity controls for a manufacturing OT network.
- Cost
- $0
- Access
- NIST publication with a PDF download link; no account indicated; the products named are examples and may differ from what you run
- Publication status
- Final, March 2022; products and versions in the guide reflect that date
- Reviewed
- 2026-10-13
How this was checked
NIST publication page fetched on October 13, 2026; date and download link observed; the PDF was not opened
Industrial protocol references
Free
Practitioner → Specialist
Official protocol and implementation references provide the authoritative detail behind Modbus communication and message behavior.
Use it for: Decode function codes, addressing, requests, and responses accurately.
- Cost
- $0
- Access
- Public references; download/use subject to publisher terms
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
A searchable, hyperlinked reference supplies OPC UA core specifications and companion information models.
Use it for: Understand services, information models, security concepts, and industry-specific data structures.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
The public MQTT standard defines publish/subscribe behavior, packet formats, and protocol features used in IoT and industrial integrations.
Use it for: Study broker/client behavior, QoS, sessions, and protocol semantics.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Practitioner
A technology/system description introduces PROFINET and its place in distributed industrial automation.
Use it for: Understand PROFINET networks before investigating or segmenting them.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Practitioner
ODVA's public overview describes EtherNet/IP and the use of CIP in Ethernet-based industrial communication.
Use it for: Build a working conceptual model of EtherNet/IP and its role in automation.
- Cost
- $0
- Access
- Overview free; full specifications and some developer resources have separate access terms
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Labs and protocol tooling
Free
Foundation → Practitioner
Free open-source PLC tooling supports IEC 61131-3 programming and includes a simulator for running and debugging logic without hardware.
Use it for: Practice control programming before assembling a networked PLC/SCADA lab.
- Cost
- $0
- Access
- Free editor/simulator; other hosted services and hardware are separate
- Reviewed
- 2026-10-12
Related official source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner
An open-source, web-based, multi-platform SCADA project provides code and setup documentation.
Use it for: Build an HMI/data-acquisition lab and observe interactions with simulated field systems.
- Cost
- $0
- Access
- Open-source software; local host and setup effort required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Foundation → Practitioner
A flow-based, browser-edited programming tool connects data sources and services. Its extensible node ecosystem is useful for building industrial lab integrations.
Use it for: Create lab data flows and connect simulated processes to dashboards or protocol clients.
- Cost
- $0
- Access
- Open-source core; review third-party node licenses, quality, and dependencies
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner
A Python Modbus implementation offers clients, servers, and simulation with synchronous and asynchronous APIs.
Use it for: Generate controlled Modbus traffic and create repeatable protocol exercises.
- Cost
- $0
- Access
- Open-source library; Python skills and local lab required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
An OPC UA implementation and detailed documentation explain services, information modeling, and client/server construction.
Use it for: Build OPC UA lab endpoints and examine certificate/security behavior.
- Cost
- $0
- Access
- Open-source software/docs; C/C++ build skills useful; master documentation may describe unreleased behavior
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Specialist
Client/server tutorials and API documentation cover MMS and publisher/subscriber functions for GOOSE and sampled values.
Use it for: Create IEC 61850 learning exercises and inspect substation-related communications.
- Cost
- $0
- Access
- Documentation free; open-source library and commercial licensing options have distinct terms
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
A collection of assessment tools interacts with Modbus, serial devices, embedded SPI/I2C components, and selected PLCs.
Use it for: Explore protocol/device behavior in an isolated assessment lab.
- Cost
- $0
- Access
- Free tool collection; hardware adapters may be required for serial/embedded exercises
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Specialist
Open-source plugins extend Caldera with industrial protocol capabilities mapped to ATT&CK for ICS.
Use it for: Emulate selected behaviors in a lab and evaluate telemetry/detections.
- Cost
- $0
- Access
- Free plugins; substantial setup; use isolated authorized systems
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
An ICS/SCADA honeypot project provides emulated services for observing interactions and exploring deception concepts.
Use it for: Learn how industrial service exposure appears to scanners and how to analyze honeypot events.
- Cost
- $0
- Access
- Open-source software; host/deployment required; emulation is not a complete process testbed
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Foundation → Practitioner
A local OT security lab platform offers real protocol and telemetry exercises. The free tier limits labs, guides, progression, and session access.
Use it for: Try a ready-made environment before paying for extended personal practice.
- Cost
- $0
- Access
- $0 limited tier; time restrictions; local Docker host; personal-learning license scope
- Reviewed
- 2026-10-12
Related official source
How this was checked
Pricing page and official repository reviewed; their wording/limits differ, so check current release and plan before deployment
Free
Practitioner → Specialist
A free suite edits and replays previously captured network traffic with selectable timing/rates.
Use it for: Run repeatable tests of lab IDS signatures and traffic-analysis pipelines.
- Cost
- $0
- Access
- GPLv3 tools free; replay onto isolated authorized lab interfaces, since traffic is actually transmitted
- Reviewed
- 2026-10-12
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free, with conditions
Practitioner → Specialist
An open-source Ethernet communication suite with client, server and partner objects for talking to Siemens S7 controllers from your own code. It is multi-platform and usable from several languages, including C#, Pascal, LabVIEW and C++.
Use it for: Write small scripts that read from or serve S7 data in an isolated lab, and learn what S7 communication looks like on the wire.
- Cost
- $0
- Access
- Free download from the project site; the license name was not shown on the pages retrieved, so confirm it before redistributing; check the project documentation for supported controllers and settings; use only on systems you own or are authorized to test
- Reviewed
- 2026-10-13
How this was checked
Project site fetched on October 13, 2026 (a framed site; the main description and platform list were read); software not downloaded or run
Free, with conditions
Practitioner
A virtual ICS lab with a 3D chemical-process simulation, a soft PLC and an HMI, run as three virtual machines. It is built for practicing attacks such as command injection and man-in-the-middle, and defenses such as segmentation, firewall rules and intrusion-detection rules.
Use it for: Build a self-contained attack-and-defend exercise with visible physical consequences, entirely on a host-only network.
- Cost
- $0
- Access
- Free open source (GPL-3.0; the 3D simulation is supplied only as a compiled executable); about 25 GB of disk, 8 GB of RAM and a quad-core CPU; uses older Ubuntu 16.04 images, and the author no longer hosts pre-built VMs, so setup is from scratch
- Publication status
- Older project; its README points to a Version 2 in a separate repository. The PLC is intentionally vulnerable, so run it only on an isolated host-only network
- Reviewed
- 2026-10-13
How this was checked
Official repository page fetched on October 13, 2026; requirements, license and notices observed; no last-update date shown; not built or run
Free, with conditions
Practitioner → Specialist
A community collection of tools, tips, packet captures, protocol notes, configurations, guides, feeds, hardware notes and scripts for exploring ICS security, described by its authors as developed as a community asset.
Use it for: Find practice captures and starter tooling for a lab, then follow each item back to its original source.
- Cost
- $0
- Access
- Free public repository (CC BY 4.0 for the collection); the tools and captures it points to keep their own licenses and provenance; no maintenance statement on the page
- Reviewed
- 2026-10-13
How this was checked
Official repository page fetched on October 13, 2026; contents not individually reviewed
Monitoring and investigation
Free
Foundation → Specialist
A free packet-analysis tool and user documentation support traffic capture, filtering, and protocol inspection.
Use it for: Analyze authorized industrial captures and learn what a controller actually exchanges.
- Cost
- $0
- Access
- Free software/docs; live capture requires an appropriate capture point
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner
A containerized traffic-analysis suite ingests PCAPs, Zeek logs, and Suricata alerts, combining dashboards and session analysis.
Use it for: Investigate industrial traffic offline or build passive visibility in a lab.
- Cost
- $0
- Access
- Open-source software; local CPU/RAM/storage required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
A network security monitoring framework and manual explain deployment, generated logs, scripting, and customization.
Use it for: Turn packet activity into structured metadata for baselining and detection.
- Cost
- $0
- Access
- Open-source software/docs; protocol coverage depends on version/plugins
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
Documentation explains the IDS/IPS engine, rule development, protocol handling, and EVE event output.
Use it for: Develop and tune lab detections, then examine how alerts relate to industrial operations.
- Cost
- $0
- Access
- Free software/docs; latest documentation can describe a development version
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner → Specialist
A free and open platform combines monitoring, hunting, packet/log analysis, and case management. Commercial appliances and support are separate offerings.
Use it for: Practice SOC workflows using captured or mirrored lab traffic.
- Cost
- $0
- Access
- Free platform; significant hardware/storage may be needed; paid services/features separate
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner
A passive network-forensics application identifies hosts and reconstructs supported artifacts from packet captures. The free open-source edition is distinct from NetworkMiner Professional.
Use it for: Examine hosts, sessions, and supported extracted files in authorized captures during an investigation.
- Cost
- $0
- Access
- Free open-source edition; feature limits compared with Professional; primarily Windows/.NET tooling
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free
Practitioner → Specialist
A free open-source detection engine evaluates traffic against rules and can operate as a sniffer, logger, or IDS/IPS.
Use it for: Build a lab IDS and compare alerts against known industrial protocol activity.
- Cost
- $0
- Access
- Engine free; Community rules available; registered/subscriber rule access differs; verify protocol support for your version
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free
Practitioner → Specialist
Wireshark's command-line analyzer uses its packet-dissection code for capture and offline analysis, enabling filtering and field extraction.
Use it for: Automate extraction of controller addresses, protocol fields, and communication patterns from PCAPs.
- Cost
- $0
- Access
- Free tool/docs; included in the Wireshark ecosystem; field names and capabilities depend on version
- Reviewed
- 2026-10-12
Related official source
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free
Practitioner
A lightweight command-line packet-capture and network-dissection tool provides PCAPs for later analysis.
Use it for: Collect traffic from an approved capture point when a graphical workstation is impractical.
- Cost
- $0
- Access
- Open-source software; live capture requires suitable privileges and an authorized TAP/SPAN/interface
- Reviewed
- 2026-10-12
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free
Practitioner → Specialist
Open-source parsers that teach Zeek to read industrial protocols, including BACnet, EtherNet/IP and CIP, S7comm, OPC UA Binary and Synchrophasor (C37.118), turning captured traffic into structured logs.
Use it for: Add industrial protocol visibility to a Zeek lab or monitoring pipeline, then compare the logs with the packet captures they came from.
- Cost
- $0
- Access
- Open source (BSD-3-Clause); needs a working Zeek installation, build effort and your own packet captures
- Reviewed
- 2026-10-13
How this was checked
Official repository page fetched on October 13, 2026; protocol list and license observed; last-update date not shown on the page; parsers not built or run
Threat intelligence and research
Free
Practitioner → Specialist
A public knowledge base describes observed adversary behaviors in industrial environments, with techniques and supporting references.
Use it for: Map incidents and detection coverage to specific behaviors rather than generic threat labels.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Practitioner
Official advisories publish affected products, technical vulnerability details, and mitigation information for industrial systems.
Use it for: Check whether an advisory affects installed assets and track vendor remedies.
- Cost
- $0
- Access
- Free; no account required
- Reviewed
- 2026-10-12
Supporting publisher source
How this was checked
Publisher bulletin reviewed; direct advisory index retrieval blocked with HTTP 403
Free, with conditions
Practitioner / Program lead
Public reports, technical research, and annual reviews discuss industrial threats, vulnerability observations, and field findings.
Use it for: Inform threat modeling, leadership briefings, and the selection of defensive priorities.
- Cost
- $0
- Access
- Public articles free; some reports require an email/form; paid intelligence/platform separate
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner → Specialist
Public technical research covers industrial and other cyber-physical vulnerabilities, protocol behavior, and exploitation findings.
Use it for: Understand device-level weaknesses and build better vendor/asset risk discussions.
- Cost
- $0
- Access
- Public articles free; some downloads may require a form; vendor perspective
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner / Program lead
Public reports cover OT/IoT security trends and research from a commercial security vendor.
Use it for: Compare findings with other intelligence sources and improve monitoring priorities.
- Cost
- $0
- Access
- Free report access may require registration/email; paid products separate
- Reviewed
- 2026-10-12
How this was checked
Publisher search-index evidence reviewed; direct report-index retrieval failed; report forms not exercised
Free
Practitioner → Specialist
Public reports and technical articles examine industrial threats, malware, and vulnerability research.
Use it for: Compare threat observations and study technical investigations.
- Cost
- $0
- Access
- Public reading free; commercial products/intelligence separate; dataset and vendor perspective matter
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free
Program lead / Policy
Public papers address OT cybersecurity policy and standards-based approaches. OTCC represents a coalition of industry companies.
Use it for: Track policy arguments and standards alignment discussions relevant to program leadership.
- Cost
- $0
- Access
- Public resources free; coalition membership is separate; policy/industry perspective
- Reviewed
- 2026-10-12
How this was checked
Publisher page or publisher search-index evidence reviewed; access and software not independently exercised
Free, with conditions
Practitioner → Specialist
A two-stage model explains adversary campaigns against ICS, supported by Havex and Stuxnet case studies.
Use it for: Analyze the steps between an initial compromise and an attack on a physical process; identify intervention points.
- Cost
- $0
- Access
- Free whitepaper; download/account requirements may apply
- Publication status
- 2015 foundational paper; supplement with current ATT&CK for ICS
- Reviewed
- 2026-10-12
How this was checked
Official publisher/project page or publisher search-index evidence reviewed; software and download flows not exercised
Free
Practitioner → Specialist / Electric sector
Public Dragos analysis discusses the Ukraine power-grid attacks, CRASHOVERRIDE, and lessons for industrial defense. It provides a current accessible route into the case referenced by the manual.
Use it for: Study protocol-aware malware and connect technical behavior with potential operational consequences.
- Cost
- $0
- Access
- Public article free; vendor research perspective
- Publication status
- 2026 retrospective of historical incidents
- Reviewed
- 2026-10-12
How this was checked
Official article found; original manual-linked CrashOverride-01.pdf could not be retrieved
Free, with conditions
Practitioner → Specialist
A public whitepaper analyzes a modular ICS attack framework and supplies mitigation guidance. The public threat-group page offers additional context.
Use it for: Understand industrial attack capabilities and review protocol exposure and detection assumptions.
- Cost
- $0
- Access
- Whitepaper advertised free; form/email may be required; paid intelligence/platform separate
- Publication status
- Historical research; distinguish described capability from observed deployment
- Reviewed
- 2026-10-12
Related official source
How this was checked
Official report landing page and threat-group page indexed; original direct PDF retrieval failed
Free
Practitioner → Specialist
A MITRE knowledge base of cyber threats to embedded devices, such as controllers and field devices, paired with mitigations. It gives device-level threats a common vocabulary.
Use it for: Threat-model a PLC, RTU or gateway by looking up the device-level threats that apply and the mitigations that answer them.
- Cost
- $0
- Access
- Free to read; MITRE Terms of Use apply; no account indicated
- Publication status
- Living knowledge base; the site showed version 2.0.2 (June 1, 2026)
- Reviewed
- 2026-10-13
How this was checked
Official site fetched on October 13, 2026; version and Terms of Use link observed; downloads and any data exports not exercised
Vulnerability management and prioritization
Free
Practitioner / Program lead
FIRST's hub for CVSS v4.0 links the specification document, user guide, implementation guide, examples, FAQ and an online calculator for scoring vulnerabilities.
Use it for: Learn how the base, threat and environmental metrics are defined, and check a score you worked out by hand or in a tool.
- Cost
- $0
- Access
- Public hub page; the page does not state license terms for each document, so check them before redistributing
- Reviewed
- 2026-10-13
How this was checked
FIRST page fetched on October 13, 2026; the linked documents and calculator were not opened or exercised
Free
Practitioner / Program lead
A model maintained by a FIRST special interest group that estimates the probability that a published CVE will be exploited in the wild within the next 30 days. The page says the scores are freely and openly available as daily CSV downloads and through an API, with model documentation and research linked.
Use it for: Add exploitation likelihood to patch-prioritization decisions, remembering that it scores CVEs generally and says nothing about operational consequence.
- Cost
- $0
- Access
- Data described as freely and openly available through CSV files and an API; the license of the documentation was not stated on the page
- Reviewed
- 2026-10-13
How this was checked
FIRST page fetched on October 13, 2026; data files and API not downloaded or called
Free
Practitioner / Program lead
CISA's catalog of vulnerabilities that are known to be exploited in the wild. Each entry carries a CVE identifier, the date it was added, a due date and a required action; the page offers CSV and JSON downloads, a print view and a JSON schema.
Use it for: Check whether a vulnerability in your asset inventory is known to be actively exploited, and feed the JSON into your own prioritization.
- Cost
- $0
- Access
- Public; no account; machine-readable downloads; the due dates and required actions come from a CISA directive that binds US federal agencies and are context for everyone else
- Reviewed
- 2026-10-13
How this was checked
CISA page fetched on October 13, 2026, showing 1,739 entries at that time; downloads not exercised
Free, with conditions
Practitioner → Specialist
CISA's public repository of security advisories in the OASIS CSAF 2.0 format, with the industrial control systems (OT) advisories kept in their own folder, organized by year, together with an index and per-file signature and checksum files.
Use it for: Pull advisories into your own tooling, or look up which published advisories name a CVE, a vendor or a product.
- Cost
- $0
- Access
- Public repository; no account; reading and downloading are free; GitHub did not detect a license file on October 12, 2026, so check before redistributing
- Reviewed
- 2026-10-13
How this was checked
Repository structure inspected through the GitHub API on October 12–13, 2026 (OT advisory folders by year, an index and per-advisory files); advisory content not independently assessed
Free
Practitioner / Program lead
An open-source desktop tool maintained by the author of this catalog. It ranks an OT vulnerability as NOW, NEXT or NEVER from its CVSS score or vector, the asset's criticality and exposure, patch availability and compensating controls, and shows its reasoning. It works offline and uses CISA KEV, EPSS and CISA's ICS advisories as context.
Use it for: Try a transparent, explainable triage on the sample findings, or read its policy document to see how each rule was reasoned.
- Cost
- $0
- Access
- Free and open source (MIT for the code; the OkieOTSec name and logo are excluded from that license); needs Python 3.12 or newer with Tkinter; no third-party packages
- Publication status
- Maintained by the catalog's author; not independently reviewed
- Reviewed
- 2026-10-13
How this was checked
Repository and releases checked by the maintainer on October 13, 2026; included as the maintainer's own project, so judge its rules for yourself
