Avoiding Grid Outages With Network Digital Twins

The recent energy grid blackouts across Spain, Portugal and parts of France were one of world’s biggest ever power system collapses. Effective modelling of the energy grid would have helped avoid this outcome and is a cautionary tale for any operator who has not already built a digital twin of their grid operation.

Digital twins are virtual replicas of real-world assets that let operators simulate and analyze without risk. A digital twin for power grids is a digital representation of the power network model and real-time measurements that can simulate a variety of scenarios (Haag and Anderl 2018). Rebuilding an entire national grid isn’t practical or affordable but digitally mirroring it? That’s smart. In fact, grid simulation tools have been powering control rooms since the 1970s, now digital twins are taking that capability to the next level.

In the face of growing cybersecurity threats, the power to run fully automated simulations using real-time data and live network topology is a critical defense. Digital twins enable operators to pinpoint system vulnerabilities, test new technologies safely, and assess how cyberattacks or extreme events could impact operations before they strike. With automated, parallel simulations, these virtual replicas can help you stay one step ahead of evolving threats.

In this post, we explore how EXata, Keysight Technologies’ advanced communication emulation platform, helps grid operators assess, harden, and protect critical energy infrastructure.

Example of a power grid digital twin

To see firsthand how a digital twin can be used to understand, and prepare for real-world attacks, we have demonstrated how a real cyber-attack on the Ukraine power grid can be modeled and analyzed using EXata. This was a very sophisticated attack, planned and executed over several months prior to the actual power outage. The attackers probed the system for weaknesses and exploited them to gradually infiltrate the network. They first gained access to the corporate IT network, using emails with infected attachments as the initial entry point. Once they infiltrated the corporate network, the attackers snooped around until they were able to steal credentials that gave them access to the SCADA network and, subsequently, the relays at the substations.

This combination of deploying different types of cyber-attacks, gradually infiltrating the system through successive layers of security by probing and adapting the attacks, and exploiting human behavior represents real-world cyber-attacks against different types of organizations and can be modeled within EXata.

The attack model can be easily modified to create what-if scenarios, for example by changing the firewall rules or changing the network topology and access control rules to better isolate critical segments of the network.

These scenarios can be simulated and the effects of changes evaluated by visualization, analyzing statistics, and observing the effects on connected systems. Therefore, effectiveness of different mitigation strategies can be studied. The visualization capabilities offer a convenient training platform where operators can interact with the simulation model, launch attacks, and modify firewall rules, then observe their effects on the system’s behavior in real time. Thus, operators can be trained to recognize breaches and learn how to counter them in a timely manner.

Benefits of digital twins in the energy grid

According to the US Department of Energy “Digital twins, or detailed software models of physical systems, will play a key role in this modernization, enabling utilities to understand weaknesses, detect problems quickly, and address them effectively without risking the operational grid. As a result, this investment will help:

• Keep Your Lights On: Improved grid security and reliability means fewer blackouts and outages for consumers.
• Keep You Safe: Fewer power disruptions that affect critical services like hospitals, emergency response systems, and public transportation translate to beneficial impacts to public health and safety.
• Keep Power Affordable: When utilities spend less time and money responding to grid disruptions, customers will benefit from efficiency of operations.”

Extensive work by the National Renewable Energy Laboratory in the US has demonstrated the benefits of Digital Twin + AI to create the Control Room of the Future. In Europe the eFORT project is developing the digital twin as one of its main solutions with the expectation of revolutionizing grid security by enhancing cyber security. It aims to secure the interconnected power grids in Europe and make them resilient to cyber-attacks, maintenance faults, terrorism, natural hazards, or similar related events (at infrastructure, hardware, software, and organizational levels).

In our last blog, Establishing strong roots of grid security, we spoke about the increase of cyberattacks on the energy grid by cyber criminals and hostile states. State-linked cyber groups increasingly target industrial control systems pivotal to energy infrastructure.

In response to growing threats, regulatory bodies and standards organizations have issued new frameworks such as IEEE 2030.5, IEC 62351, and NERC CIP. These standards help, but compliance alone is not enough. Utilities need tools to test, simulate, and validate their systems against evolving attack scenarios.

Keysight digital twin for the grid

Keysight EXata is used in the defense and critical national infrastructure sectors because it allows the user to create a network digital twin for real-time simulation and emulation that replicates the behavior of a network. The emulator provides an exact, high-quality model, indistinguishable from the real system, to digitally represent the entire network, the various protocol layers, antennas, and devices. The system can interoperate, at one or more protocol layers, with real radios and devices to provide hardware-in-the-loop capabilities. It can also be connected to systems with real applications.

EXata for Cyber-Physical (EXata CPS) modelling is integrated with OPAL-RT’s HYPERSIM or RT-LABS simulator on the same hardware to offer a complete real-time solution for the development, testing, and assessment of electrical grids with communication networks.

Proactive cyber security using a digital twin

Grid operators use EXata CPS to simulate, visualize, and strengthen their cybersecurity posture. Integrated with OPAL-RT’s power system simulators, it replicates both the power and communication layers of the grid in real-time.

Key capabilities include:

• High-Fidelity Network Emulation: Model real-world ICS/SCADA communication protocols, delays, bandwidth, and jitter.
• Scenario Testing and Red-Teaming: Simulate attacks such as man-in-the-middle, DDoS, or spoofed control signals across live grid environments.
• Live-Virtual-Constructive (LVC) Training: Train operators and security teams using real-time simulations of high-impact events.
• Graphical Visualization: Real-time dashboards of traffic flows, device states, intrusion attempts, and cascading effects.

These features allow grid operators to conduct “what-if” simulations that expose hidden vulnerabilities and guide investment in preventive controls. The key takeaway from energy grid cyber-attacks like the ones we have seen in Ukraine or the active Chinese intrusion in the US grid is that static defenses are no longer enough. Cyberattacks on grid systems are not hypothetical, and absolute prevention is unrealistic. Keysight EXata can help grid operators;

• Anticipate: Assume the grid will be targeted.
• Detect: Identify anomalies before damage occurs.
• Respond: Practice recovery in realistic simulations to minimize downtime and disruption.

With a long history in the energy sector, Keysight is dedicated to safeguarding critical national energy systems. You can read more about how we keep energy grids safe on our Grid Modernization page.

Keysight is your partner for energy cyber security.