SimSpace Launches Preemptive Cybersecurity Capability

 SimSpace today unveiled EWI Radar, an early-warning research capability within the SimSpace platform. It helps defenders turn data from active nation-state campaigns into actionable intelligence that can be tested and validated in safe, realistic replicas of production before real-world systems are compromised.

Attackers have always held the first-mover advantage, and AI is widening that gap by making new attack variations faster and easier to launch. Security teams and their AI agents traditionally have trained on historical data from recent attacks. Preparing for the next attack based on what’s occurred leaves even the most well-resourced organizations vulnerable to increasingly common autonomous AI attacks that adapt on the fly and have no historical precedent or data for defenders to train on.

Read more –Cyera Achieves FedRAMP High Status to Enable Federal AI

EWI Radar equips defenders to shift from reactive defense, focused on rapid detection and response, and move beyond predictive defense, which also relies on historical data, toward preemptive security. Instead of waiting for a real-world attack to generate incident data to train defenses, organizations can preempt the next AI-fueled attack by relying on SimSpace to generate hyper-synthetic data in a realistic replica of their production environment, building and validating new defenses before operationalizing them in production.

“Cyber defenders need the ability to move quickly with confidence that a new defense will be effective before their environment is under attack,” said Clint Sand, CPO at SimSpace. “As part of SimSpace’s preemptive cyber simulation platform, EWI Radar empowers defenders to take intelligence from an active threat, recreate the relevant conditions safely, and test a defensive approach repeatedly and at a massive scale to understand whether it deserves to be trusted, and where it must be bolstered. For OT teams protecting systems where failure has real-world consequences, that path from threat intelligence to operational evidence is increasingly essential.”

EWI Radar Helps OT Teams Test New Defenses Before an Attack

An EWI Radar within the SimSpace Cyber Range uses hyper-synthetic data to reproduce real-world threats in a realistic environment, so security teams can test how their defenses perform before an attack reaches production. With a cyber range that replicates their exact environment, defenders can take a current threat pattern, reproduce it safely, develop a new defensive capability against it, discover where that capability fails, tune it, and gather operational evidence before trusting it in a live fleet or critical production environment.

This is especially valuable in OT, where an untested security control can disrupt operations and potentially have catastrophic consequences. Testing first against realistic attack, infrastructure, traffic, and device conditions gives security and operations teams room to try new approaches without putting critical systems at risk.

SimSpace hosted a threat webinar discussing how to validate IT/OT defenses using AI-powered simulations. 

Read more –Datalink Networks Addresses Critical Global Cybersecurity Risks

SimSpace Recreates a Live Nation-State Campaign to Validate Defenses

To show how this works, SimSpace recreated an Iran-attributed campaign documented by security researchers in March 2026, in which Iran-nexus threat actors intensified targeting of internet-exposed Hikvision and Dahua IP cameras across multiple countries. The event showed that compromised cameras can support battle damage assessment and targeting correction, and that tracking this activity may serve as an early indicator of potential follow-on kinetic activity. For defenders, that means devices often treated as IoT background noise could provide an early warning signal and a chance to investigate before digital reconnaissance progresses toward physical operations.

Read more – Check Point Launches Firewall-as-a-Subscription

In its own research, the SimSpace team built a 12-device simulated camera fleet on real, multi-homed cyber range hardware, with authentic firmware interfaces and real per-device TLS. The range first generated normal device activity to establish a behavioral baseline, then launched a live, five-phase adversary campaign built from disclosed exploit structures associated with all five vulnerabilities identified in the real-world campaign. Against that campaign, SimSpace tested a behavioral detection approach that pairs an unsupervised Isolation Forest model with a separate deterministic latency-ratio check. The model learns baseline device behavior, principally response latency and response size, and flags meaningful deviations. It received no attack signatures or notice of when the attack would begin, so the test measured whether behavioral detection alone could detect abnormal conditions during realistic nation-state activity.

During range validation, EWI Radar recorded zero idle false positives across a 72-combination calibration grid. In the live simulated campaign, 100% of alerts were independently confirmed by both the machine-learning detector and the latency-ratio backstop, and every alert retained attacker-source attribution. Each alert identified the affected device, the mapped vulnerability pattern, source information, the detection mechanism, and the reasoning behind the classification.

Write to us editorial@demandmediaagency.com. to learn more about our exclusive editorial packages and programmes.