Ransomware Simulation Highlights Gaps in Critical Infrastructure Defense At InfoSecurity Europe, cybersecurity firm Semperis demonstrated the high-stakes reality of ransomware attacks through a tabletop simulation pitting a red team (attackers) against a blue team (defenders) safeguarding a water treatment facility a sector increasingly targeted by cyber threats. Why Critical Infrastructure is Vulnerable Public sector organizations, including utilities, face heightened risks due to bureaucratic inefficiencies, underfunding, and skill shortages, according to Guido Grillenmeier, Semperis’ principal technologist for EMEA. While compliance checklists may be met, many lack the technical expertise to respond effectively to real-world breaches. The simulation underscored that detection and recovery not just prevention are critical, as attackers exploit even minor deviations from normal system behavior. The Simulation’s High-Pressure Scenario The red team, drawing on real-world tactics, compromised the water facility’s systems and demanded a ransom matching typical insurance payouts. The blue team, despite pressure, refused payment, but the exercise revealed how unpredictable attacks force defenders to adapt rapidly. Semperis introduced wildcards to test resilience, emphasizing that preparation and creative problem-solving are key to outmaneuvering adversaries. Tools Alone Aren’t Enough Semperis’ Ready1 platform, launched recently, provides a centralized hub for incident response plans, communication protocols, and recovery strategies aiming to reduce downtime and regulatory risks. However, Grillenmeier stressed that tools are only as effective as the teams using them. A 2023 Semperis study found that while 96% of companies have response plans, 71% suffered a high-impact attack disrupting critical operations in the past year. Common failures included poor cross-team communication (48%), unclear roles (41%), and over-reliance on disparate tools (40%). Regulatory Pressure and the Path Forward The EU’s Digital Operational Resilience Act (DORA) now mandates independent resilience testing, pushing organizations to validate their preparedness. Simulations like Semperis’ offer a low-risk environment for teams to refine strategies, test defenses, and identify weaknesses lessons that apply far beyond the financial sector. The exercise reinforced that ransomware attacks are inevitable, but their impact can be mitigated through structured preparation, clear roles, and continuous testing. For critical infrastructure, the stakes couldn’t be higher.