Background
Cascade operates regional transmission with a substation fleet built up over decades — mixed-vintage relays, RTUs and historians across a strict Purdue hierarchy. Their OT monitoring saw traffic and raised alerts, but every alert came with the same unanswerable question from operations: does this actually threaten the grid, or is it noise we can defer past the maintenance window?
The challenge
Severity scores were written for IT. A 'critical' CVE on a historian might be irrelevant to grid stability, while a quiet relay-setting change could drop a feeder. Confirming which was which meant either a tabletop exercise that took weeks or an active test no one would run against an energised substation.
What we did
- Built a coupled twin — the network topology alongside a power-flow model of the affected substations and feeders — from existing inventory, telemetry and the engineering models Cascade already ran on Aether.
- Ran IT/OT boundary analysis to find the reachable paths, then forward-rolled each candidate intrusion in the twin to its physical effect on the grid.
- All discovery stayed passive and all emulation ran against the sandboxed copy; the agent's capability envelope excluded any action against a live controller by construction.
- Findings shipped to operations ranked by consequence — which feeders destabilise, which protections are defeated — with the shortest conduit cut for each.
“It showed us which intrusion would actually drop the feeder — and which were noise. Our alerts finally rank by physics.”
The outcome
- Alerts were re-ranked by grid consequence: a handful of relay-setting and segmentation paths jumped the queue while a batch of 'critical' historian CVEs were correctly deferred.
- Operations acted on a list ordered by physical risk for the first time, with the evidence — the simulated feeder response — attached to each item.
- Zero active scans touched a live controller; reachability and consequence were both established off the twin.
- The coupled twin now runs continuous what-if analysis as the topology changes, instead of a once-a-year tabletop.
One detail worth calling out
The turning point was watching the twin reproduce a historical disturbance — a known prior feeder trip — from the same initiating conditions. Once operations saw the physics twin match an event they remembered, they trusted it to rank hypothetical intrusions by consequence. The safety posture was non-negotiable for the operator: the model that proved a feeder could be dropped was structurally incapable of dropping it.