Zakhar Bernhardt

Founder Labshock | Hands-on OT/ICS Security

[Zakhar Bernhardt @zakharbernhardt]

Master OT/ICS cybersecurity hands-on > safely

Build real ICS Labs
Simulate pentest & validate IDS/SIEM rules
No hardware needed > deploy in minutes via Docker

Labshock: #1 Industrial Cyber Lab https://t.co/BJwp2dSbqt

[Zakhar Bernhardt @zakharbernhardt]

Phase 3 complete 🚀
World of Labshock now unifies design
and guides, labs, quests in one place.

One flow.
One zone.

OT security must be testable, not documented.

[Zakhar Bernhardt @zakharbernhardt]

Firegate zone with 2 new LABS
inside Labshock
DNP3 & IEC104

[Zakhar Bernhardt @zakharbernhardt]

Labshock 🪖 Boots to Cyber

New partnership is here.

More people from military are moving into cyber.

Together we make OT security testable, teachable and visible.

More coming soon.

[Zakhar Bernhardt @zakharbernhardt]

World of Labshock Patch 2.3 is live ⚡

Thunderwatch is opening inside World of Labshock: PLC Programming, automation stack, HMI, tags, memory, and runtime state.

[Zakhar Bernhardt @zakharbernhardt]

Masterclass
This Sunday we open Patch 2.3 inside World of Labshock.

New PLC Programming zone starts with Automation Anatomy + first Ladder program.

Because OT security starts when you understand how control works.

Not documented.

Testable.

[Zakhar Bernhardt @zakharbernhardt]

PLC languages are not only syntax

They define how control logic is built, read, tested, and secured

LD for visible logic
FBD for signals
ST for complex logic
SFC for sequences
IL for legacy
OT security must be testable
not documented

[Zakhar Bernhardt @zakharbernhardt]

#Labshock is now on Trustpilot

Reviews are signal

Good feedback shows what works

Critical feedback shows what to fix

No PDF can replace real users

If you tested Labshock, leave honest review

https://t.co/GbSY31KN2R

[Zakhar Bernhardt @zakharbernhardt]

Automation is not one device

It is chain of trust

Sensor reports
PLC decides
Output moves
Process changes

I made new Labshock Automation Anatomy guide

OT security must be testable
not documented

[Zakhar Bernhardt @zakharbernhardt]

IEC104 is now supported in Labshock ⚡

Why?

Because our next environment is focused on power grids, substations and control centers

See protocol behavior, generate traffic, build detections and test security controls

OT security must be testable

🌍 https://t.co/BJwp2dSbqt

[Zakhar Bernhardt @zakharbernhardt]

OT alerts without context are useless.

In OT the same Modbus write can be normal operation or a real attack.

We need full pipeline:
> PLC & SCADA
> Network & IDS
> Logs & SIEM
> process & history
> correlation & decision

In #Labshock we build it end-to-end.

[Zakhar Bernhardt @zakharbernhardt]

#Labshock environments are executable systems, not static labs

Most OT labs describe process behavior but don’t execute it

Systems change, labs stay frozen → drift builds, validation breaks

OT loop: build, run, change, validate, repeat

[Zakhar Bernhardt @zakharbernhardt]

Segmentation without validation does not exist

OT shows zones on paper, but real traffic crosses them
Engineering, PLC, vendor access stays active
If communication exists, boundary is not real

In #Labshock we test zones, not document them

What do you validate today?

[Zakhar Bernhardt @zakharbernhardt]

Not all OT sources are healthy ⛑️
Some break #OTSIEM faster than attackers
PLCs, HMIs, firewalls, traffic, historians

Start small
pick low noise + high signal
normalize before SIEM

Bad input = bad detection
Check with #Labshock

[Zakhar Bernhardt @zakharbernhardt]

OT security still runs on docs, audits and dashboards. No real validation of process behavior.

IDS not tested in process context. SIEM data not verified under manipulation.

Shift is clear: from snapshots to execution systems like #Labshock.

[Zakhar Bernhardt @zakharbernhardt]

PLC is modular system not UI tool.
CPU
memory
I/O
and comms define behavior.

[Zakhar Bernhardt @zakharbernhardt]

OT environments will be continuously testable.
Not audited once. Not assumed secure.
Built, changed, validated > in a loop.

[Zakhar Bernhardt @zakharbernhardt]

Which SIEM should I integrate next for a Labshock OT demo?

Sentinel, Splunk, Chronicle, Elastic, Wazuh?

❗️Any❗️

OT must be testable, not documented.

[Zakhar Bernhardt @zakharbernhardt]

Dry contact = simple switch logic

🟨 two metals open/close circuit.
🟨no power, no data.

just physical state in OT systems.

[Zakhar Bernhardt @zakharbernhardt]

Pentest is not Python only. Real work is logs + files + pipes. If you can’t handle Linux flow, you can’t handle real security.

[Zakhar Bernhardt @zakharbernhardt]

New #Labshock website live.

OT security becomes testable system, not docs.

Explore: https://t.co/BJwp2dSbqt