Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Digital Twins to Simulate Attacks
Transcript
- Lucas: Luna, you know how every major engineering firm builds a digital twin before they build a bridge or a jet engine — a virtual model that mirrors the real thing so they can test failure modes without risking lives? Luna: Sure. Boeing, Siemens, GE all do it. Simulate stress, heat, metal fatigue before a single physical part is made. Lucas: Right. Well, that same concept is now moving into cybersecurity. Security teams are starting to build digital twins of their own networks — full-scale replicas of their infrastructure, applications, even user behavior — and then they attack the twin to see what breaks. Luna: I've heard the term thrown around, but I've never seen a real deployment. Who's actually doing this? Lucas: Microsoft has been using a twin of its own Azure backbone for years — they call it 'Project Attack Simulator' internally. And Siemens is selling a product called 'Cyber Twin' that lets industrial companies replicate their OT environments. But the most concrete example I found is a global bank — I won't name it, but think top five by assets — that built a twin of its entire payment infrastructure. Luna: A whole payment system? That's massive. How long did that take? Lucas: Eighteen months and about $4 million. But they claim it saved them $12 million in the first year alone by catching a ransomware payload that would have hit their production network. The twin let them see the lateral movement path before any real data was encrypted. Luna: So the twin isn't just a diagram — it's a live, breathing copy of the environment? That sounds like a huge data hygiene challenge. Lucas: Exactly the issue. You can't just snapshot a network and call it a twin. It has to be continuously synchronized — configuration changes, new apps, user permissions, traffic patterns. If the twin drifts even a few hours, the simulation loses accuracy. Luna: And what about the fidelity question? If your twin doesn't perfectly replicate the production environment, you might miss an attack vector. Lucas: That's the number one criticism. A twin is only as good as the data you feed it. Most teams start with network flow logs and endpoint telemetry, but they often skip things like DNS resolver behavior or certificate chains — which attackers exploit constantly. Luna: So you could build a twin, run a simulated attack, feel confident, and still get breached through something you didn't model. Lucas: Right. That's why the smarter teams use twins not as a single source of truth but as one layer in a broader threat simulation stack. They combine it with breach and attack simulation tools and red team exercises. The twin gives them a sandbox where they can run 'what-if' scenarios at machine speed. Luna: Like, 'what if we expose this API to the internet for a day?' kind of thing? Lucas: Exactly. Or 'what if an insider with access to the HR database tries to exfiltrate employee records?' The twin can simulate the data flow, the detection alerts, and the containment response — all without touching real people's data. Luna: That's actually a huge privacy win too. A lot of security testing involves copying PII into test environments, which creates its own risk. A twin could use synthetic data that mimics real patterns. Lucas: Yes. And some vendors are doing exactly that. A company called SafeBreach — they're one of the bigger names in breach simulation — now offers a 'Twin Mode' where they generate synthetic user accounts and data flows so you don't have to expose real credentials. Luna: So how do you measure the ROI on a digital twin? The bank example was clear — $12 million saved from one ransomware catch. But for a mid-size company, the cost of building and maintaining a twin might outweigh the benefit. Lucas: That's the open question. The consensus I've heard from CISOs is that twins make sense if you have at least 5,000 endpoints or a complex multi-cloud environment. Below that, traditional tabletop exercises and purple teaming are probably more cost-effective. Luna: And what about the compute cost? Spinning up a full replica of a network can't be cheap. Lucas: It's significant. One CISO at a financial services firm told me their twin consumes about 15 percent of their total cloud budget. But they justify it because they run hundreds of attack simulations per month — automated, continuous testing they couldn't do in production. Luna: So it's a trade-off: you pay more for cloud compute, but you reduce the risk of a production outage from aggressive testing. Lucas: Right. And you also get the ability to test patches before deploying them. A lot of organizations now run their monthly patch cycle through the twin first — they apply the update, simulate an attack that exploits the vulnerability, and confirm the patch works without breaking anything. Luna: That alone could justify the cost for a lot of teams. I mean, how many times have we seen a patch cause an outage that took down critical systems? Lucas: Too many. The Colonial Pipeline ransomware attack in 2021 actually had a secondary effect — the company took its own billing system offline because they weren't sure if the patch would interact badly with their accounting software. A twin could have tested that in minutes. Luna: Let's talk about the industrial side. You mentioned Siemens earlier — OT environments have traditionally been terrible at testing because you can't just reboot a power plant. Lucas: Right. In OT, digital twins are actually more mature than in IT. Oil refineries, power grids, pharmaceutical plants — they've been using twins for years to simulate process failures. Now they're layering cyber on top. Siemens' 'Cyber Twin' product lets operators simulate a malware infection in the programmable logic controllers and see how the safety systems respond. Luna: So it's not just about network attacks — it's about physical consequences. A valve that opens when it shouldn't, a turbine that overspeeds. Lucas: Exactly. And regulation is starting to push this. The European Union's NIS 2 directive, which came into force last year, now requires critical infrastructure operators to conduct regular cyber-physical risk assessments. A digital twin is the most practical way to do that without shutting down a plant. Luna: That makes sense. But I wonder — if a twin is connected to the real network for synchronization, doesn't that create a new attack surface? An attacker could compromise the twin and use it as a staging ground. Lucas: That's a real concern. The twin itself needs to be isolated — ideally in a separate cloud tenant with no direct network path to production. Data goes one way: from production to the twin, not the reverse. And the twin should be treated as a high-value target, because it contains a map of your entire environment. Luna: So the twin becomes a crown jewel that needs its own security stack. That's ironic — you build a security tool that itself becomes a security risk. Lucas: It is. But it's manageable if you architect it right. The bank I mentioned earlier keeps its twin in a separate AWS account with its own SIEM, its own endpoint detection, and its own incident response plan. They treat it almost like a honeypot — they monitor for anyone trying to access it from outside the authorized team. Luna: Let's zoom out. Where do you see this going in the next two years? Is the digital twin going to become standard for every enterprise security team? Lucas: I don't think it'll be universal because of the cost and complexity. But I think it becomes standard for regulated industries — finance, energy, healthcare. And for large tech companies. I also think we'll see managed services where a vendor runs a twin for you and delivers simulation results as a subscription. Luna: Like a 'twin as a service' model. That could lower the barrier for mid-market companies. Lucas: And that's exactly the kind of shift that makes episodes like this possible. Look, we spend a lot of time digging into these emerging tools because they matter for the people building and running organizations. Luna: And we keep this whole show ad-free — no sponsors, no product placements — because we think the conversation is better that way. Lucas: If you find value in that, and you want to support the work, you can do so at buy me a coffee dot com slash fexingo. It's a simple way to keep these episodes independent and focused on what actually works in security. Luna: No pressure, just a link if it resonates. And now back to digital twins. Lucas: So the next frontier is probably ai driven twins. Instead of manually modeling every asset, you'd feed raw telemetry into a model that builds the twin automatically. Luna: That would solve the fidelity problem — if the AI can detect and replicate subtle patterns that humans miss. Lucas: Exactly. A startup called CyTwins — they're still in stealth — claims they can generate a twin from network metadata alone in under 24 hours for a 10,000-user environment. If that scales, it changes the economics dramatically. Luna: So the barrier becomes: do you trust the ai generated twin enough to base real security decisions on it? Lucas: That's the trust question. But it's the same question we face with any simulation. The key is to validate the twin against real incidents — replay past attacks and see if the twin would have caught them. If it passes that test, confidence grows. Luna: I can see a future where every CISO has a dashboard with a live twin showing attack paths in real time. Lucas: And that's the direction we're heading. It's not here yet for most organizations, but the pieces are coming together. If you're a security leader, now is the time to start understanding the technology, even if you don't deploy it until next year. Luna: Good advice. Thanks, Lucas. Lucas: Thanks, Luna. Until next time.