SimSpace has unveiled EWI Radar, an early-warning research capability within SimSpace platform that helps defenders turn data from active nation-state campaigns into actionable intelligence. The preemptive capability enables operational technology defenders to develop and validate emerging defenses against real-world adversarial behavior before production systems are at risk.
Early Warning Indicator Radar enables teams to test defenses in safe, realistic replicas of production before real-world systems are compromised, shifting from reactive defense to preemptive security.
Attackers have always held first-mover advantage, and AI is widening gap by making new attack variations faster and easier to launch. Security teams and AI agents traditionally trained on historical data from recent attacks, leaving organizations vulnerable to autonomous AI attacks that adapt on fly with no historical precedent.
EWI Radar equips defenders to shift from reactive defense focused on rapid detection and response, and move beyond predictive defense which also relies on historical data, toward preemptive security. Instead of waiting for real-world attack to generate incident data to train defenses, organizations can preempt next AI-fueled attack by relying on SimSpace to generate hyper-synthetic data in realistic replica of production environment, building and validating new defenses before operationalizing them in production.
"Cyber defenders need the ability to move quickly with confidence that a new defense will be effective before their environment is under attack," said Clint Sand, CPO at SimSpace. "As part of SimSpace's preemptive cyber simulation platform, EWI Radar empowers defenders to take intelligence from an active threat, recreate the relevant conditions safely, and test a defensive approach repeatedly and at a massive scale to understand whether it deserves to be trusted, and where it must be bolstered. For OT teams protecting systems where failure has real-world consequences, that path from threat intelligence to operational evidence is increasingly essential."
An EWI Radar within SimSpace Cyber Range uses hyper-synthetic data to reproduce real-world threats in realistic environment, so security teams can test how defenses perform before attack reaches production. With cyber range replicating exact environment, defenders can take current threat pattern, reproduce safely, develop new defensive capability, discover where capability fails, tune it, and gather operational evidence before trusting it in live fleet.
This is especially valuable in OT, where untested security control can disrupt operations and potentially have catastrophic consequences. Testing first against realistic attack, infrastructure, traffic, and device conditions gives security and operations teams room to try new approaches without putting critical systems at risk.
To show how this works, SimSpace recreated Iran-attributed campaign documented by security researchers in March 2026, in which Iran-nexus threat actors intensified targeting of internet-exposed Hikvision and Dahua IP cameras across multiple countries. Event showed compromised cameras can support battle damage assessment and targeting correction, and tracking activity may serve as early indicator of potential follow-on kinetic activity.
In own research, SimSpace team built 12-device simulated camera fleet on real, multi-homed cyber range hardware, with authentic firmware interfaces and real per-device TLS. Range first generated normal device activity to establish behavioral baseline, then launched live five-phase adversary campaign built from disclosed exploit structures associated with five vulnerabilities identified in real-world campaign. Against campaign, SimSpace tested behavioral detection approach pairing unsupervised Isolation Forest model with deterministic latency-ratio check.
During range validation, EWI Radar recorded zero idle false positives across 72-combination calibration grid. In live simulated campaign, 100% of alerts were independently confirmed by both machine-learning detector and latency-ratio backstop, and every alert retained attacker-source attribution. Each alert identified affected device, mapped vulnerability pattern, source information, detection mechanism, and reasoning behind classification.
About SimSpace
SimSpace provides the high-fidelity cyber simulation infrastructure required to continuously train, test, and validate AI agents. By integrating AI agents with human operators inside a realistic cyber range, SimSpace serves as the AI Proving Grounds for elite cyber teams.
