Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Digital Twins to Simulate Attacks
Transcript
- Lucas: You know how in aerospace, they build a digital twin of a jet engine before they ever fire up the real one? Run it through every failure mode imaginable — flameout, bird strike, compressor stall — without risking a single human life? Luna: Yeah, it's standard practice now for testing safety-critical systems. Simulate first, deploy second. Lucas: Well, a growing number of security teams are asking: why can't we do that for our networks? Why can't we build a digital twin of our production environment and run attacks against it before the bad guys get a chance? Luna: So — digital twin security. I've heard the term, but it feels like one of those concepts that's either overhyped or under-explained. Where does it actually sit today? Lucas: If today was useful to you — and I hope it will be — the reason these episodes stay ad-free is listener support. Buy me a coffee dot com slash fexingo. That's the whole model. Luna: It really is. Keeps us independent, keeps the conversations honest. Lucas: So — digital twins in security. The idea isn't brand new. Defense contractors and energy companies have been doing it for years. But what's changed is accessibility and fidelity. Luna: Define fidelity in this context. Lucas: How closely the twin mirrors the real production environment — network topology, configs, user behavior, data flows, even latency profiles. Early digital twins were basically static network diagrams with some scripts attached. Today, companies like AttackIQ and SafeBreach can spin up a twin that's near-identical to production, using actual traffic logs and device telemetry. Luna: And then what do you do with it? Just run pen tests on loop? Lucas: That's part of it. But the real power is in simulations you'd never dare run in production. Like, what happens if a ransomware variant encrypts your domain controllers? Or if an attacker compromises the software supply chain of your SCADA system? You can test those scenarios in the twin, observe the blast radius, and tune your defenses — all without downtime. Luna: So it's like a fire drill where you actually set the building on fire, but the building is a simulation. Lucas: Exactly. And the fire is real code — actual malware samples, actual exploit chains — just in a contained environment. Boeing, for instance, has been doing this for years with their production networks. They built a digital twin of their assembly line control systems to test for vulnerabilities in the industrial control protocols. They found a flaw in a PLC firmware update routine that could have let an attacker halt the 787 production line. Luna: And they found it in the twin, not in the factory. That's the value proposition in a sentence. Lucas: Right. Now, the energy sector is arguably the most aggressive adopter. The Department of Energy has funded multiple projects where utilities build digital twins of their grid control systems — substations, transformers, even wind farm controllers — and then run attack simulations that mimic what we saw in the Ukraine blackouts of 2015 and 2016. Luna: Those attacks were manual, highly coordinated, and they took out power for hundreds of thousands of people. Simulating that in a twin lets you practice response without triggering a real blackout. Lucas: Exactly. And what they've learned is that the response playbooks they had on paper didn't work under real attack conditions. In the twin, they discovered that their incident response team couldn't even access the monitoring tools because the attackers had changed the admin credentials as part of the simulation. They had to build a whole new communication protocol — out-of-band radios — just to coordinate during a simulated blackout. Luna: That's a finding you only get from a high-fidelity simulation. A tabletop exercise wouldn't catch the credential lockout detail. Lucas: Right. And that's the argument for digital twin security over traditional methods like sandboxing. Sandboxes are great for analyzing a single file, but they don't replicate the complexity of a live enterprise network — the Active Directory trusts, the legacy systems, the third-party integrations. A digital twin can model all of that. Luna: But there's a cost. I've seen estimates that a decent digital twin for a mid-size enterprise — say, 5,000 employees — costs between $500,000 and $2 million to build, and then ongoing maintenance is significant because the twin has to stay in sync with production. Lucas: That's the biggest barrier right now. It's not a tool you buy off the shelf; it's a program. You need dedicated engineering time, constant data feeds from your network, and a team that understands both security and the operational technology side. That's why adoption is concentrated in industries where downtime costs millions per hour — aerospace, energy, pharmaceuticals, manufacturing. Luna: But the technology is getting cheaper. Cloud providers like AWS and Azure offer digital twin services now — AWS IoT TwinMaker, Azure Digital Twins. They're not security-specific, but you can layer security simulation on top. Lucas: That's a big development. It lowers the entry barrier for companies that don't have a million-dollar simulation budget. And there's a new standard emerging from the Digital Twin Consortium — their Cybersecurity Framework for Digital Twins — that gives organizations a structured way to validate that their twin is accurate enough to be useful. Luna: Because if the twin doesn't accurately reflect production, the simulations are worthless. Garbage in, garbage out. Lucas: Exactly. You could get a false sense of security. So the consortium's framework defines metrics for fidelity — like network latency deviation, configuration drift, user behavior modeling — and requires regular re-synchronization. Some organizations are doing daily syncs, others weekly, depending on how dynamic their environment is. Luna: Let's talk about a concrete case outside of critical infrastructure. Have you seen any digital twin adoption in financial services? Lucas: A bit, but it's slower. Banks are terrified of data leakage — if your digital twin contains customer transaction patterns, that's sensitive data. So they tend to use anonymized or synthetic data in the twin. JPMorgan has a project called 'Project Twin' that simulates their payment infrastructure, but it's mostly focused on fraud detection rather than attack simulation. Luna: Interesting. So they're using it for defensive modeling, not offensive simulation. Lucas: Right. But the offensive side is where the real innovation is happening. I spoke with a CISO at a large manufacturer who told me they use their digital twin to run 'what-if' scenarios for ransomware that specifically target their industrial control systems. They modeled the 2021 Colonial Pipeline attack — which shut down fuel supply to the US East Coast — against their own pipeline control system. They found that their backup SCADA servers were on the same network segment as the primary, meaning an attacker could take out both simultaneously. Luna: And they fixed that because of the simulation. That's a concrete ROI story. Lucas: Yeah. And it's not just about finding flaws. It's about building muscle memory. When an actual incident happens, the team has already run through the scenario in the twin. They know which logs to check first, which systems to isolate, who to call. The mean time to respond drops significantly. Luna: So where do you see this going in the next 12 to 18 months? Will it become mainstream for the Fortune 500? Lucas: I think yes, for the top 500. The cost is coming down, cloud services are maturing, and the regulatory pressure is building. The SEC's new cybersecurity disclosure rules essentially require companies to know their attack surface and test their defenses. A digital twin is a defensible way to demonstrate that you're doing serious simulation. Luna: And for smaller companies? Is it ever going to be accessible? Lucas: Maybe through managed security service providers who offer digital twin as a service. You don't build your own twin; you pay for access to a vendor's twin that models a typical environment in your industry. The fidelity won't be as high, but it's better than nothing. I think we'll see that emerge as a product category within the next two years. Luna: So for a CISO planning their 2027 budget, digital twin security should be on the radar — even if it's just a pilot project. Lucas: Absolutely. Start small. Pick one critical system — maybe your Active Directory or your main ERP — and build a twin just for that. Run one simulation. See what you learn. The insight you gain from that first exercise will likely justify the investment for the rest of the environment. Luna: And if you find a credential lockout flaw that would have taken down your factory for a week, the twin pays for itself a hundred times over. Lucas: Exactly. That's the bet. And it's a bet more security teams are starting to make.