Live Attack Simulation

Watch a simulated cyber-physical attack unfold across a fleet of solar inverters, and see why traditional IT firewalls are blind to it.

Scenario

10 grid-tied 10 kW solar inverters generating standard Modbus telemetry
14:00 Attacker spoofs curtailment command, capping all inverters at 80%
14:15 Coordinated reactive power injection across 8/10 inverters
Traditional firewalls see valid Modbus TCP, ObsistO detects violated physics via telemetry

speed

System Status: All Clear

All Modbus TCP traffic validated. No malformed packets or unauthorized connections detected.

Packets Analyzed

Threats Detected

99.99%

Uptime

1.2ms

Avg Latency

Modbus TCP Traffic Log

Port 502

Timestamp	Source	Destination	FC	Register	Count	Status

Physics Baseline Normal

All telemetry correlates with expected solar irradiance and grid conditions. No anomalies detected.

CRITICAL 14:00:00 UTC

Unauthorized Active Power Curtailment

Coordinated active power curtailment detected across 10/10 inverters. GHI reads 940 W/m² (clear sky confirmed). No grid dispatch order received via SCADA. Active power capped at exactly 80% of rated output. High probability of unauthorized setpoint manipulation via Modbus write to register 40149.

CRITICAL 14:15:00 UTC

Coordinated Reactive Power Injection

Simultaneous reactive power shift across 8/10 inverters. kVAR jumped from ~0 to ~5.2 kVAR within 200ms. Power factor degraded from 1.00 to 0.85 lagging. No VAR dispatch from grid operator. Voltage instability risk: HIGH. Attack pattern consistent with coordinated Modbus write to register 40151.

Fleet Status — 10 Inverters

Active Power — Fleet Overview (kW)

All 10 inverters overlaid. Expected solar curve shown as dashed line.

Reactive Power (kVAR)

Near-zero baseline expected. Step change = attack signature.

Weather vs. Power Correlation

Irradiance and fleet avg power should track together. Divergence = anomaly.