A well-designed industrial ransomware simulation does not seek a technically perfect response: it seeks to expose, in real time and in front of a room full of colleagues, what decision each organization makes when it does not yet have all the information.
That was the focus of the panel «Hour Zero: Orchestrating Continuity and Resilience in Industry 5.0» of Industrial Cyber Summit Chile 2026, an executive microsimulation conducted by Carolina Eyquem, Head of Strategy and Risk in Cybersecurity at SONDA, alongside three leaders representing different links in the same energy chain: Pablo Silva, CISO of GNL Quintero; César Maldonado, CIO IT/OT and director of a generation company; and Daniel Soto, Deputy Director of Cybersecurity Chile at CGE S.A.
The scenario, initially clarified as fictitious and unrelated to the actual architectures of the companies present, was an industrial ransomware evolving in three phases—detection, propagation, and recovery—along the fuel, generation, transmission, and distribution chains. The exercise made something clear from the very first minutes: coordination among links in the energy chain does not begin when there is a confirmed blackout. It begins much earlier, when there is still no certainty that something serious is happening.
Phase 1: an HMI that stops responding
The scenario began at 18:35 on a winter afternoon, in a LNG plant: an operator detects that an HMI interface stops responding, a ransomware note appears in an engineering station, the historian becomes unavailable, and anomalous activity is detected in an OT remote access. The controllers continue to operate and there is no physical condition of uncertainty, but much of the visualization and administration environment is no longer reliable.
Pablo Silva was categorical about the first move: activating the OT ransomware playbook and assuming that the attack is likely more widespread than is known at that time. Although there is still no certainty about actual impact on the operation, he insisted on immediately notifying the National Electrical Coordinator and the ANCI, because the indicators of compromise already available—the identified malware, some IP addresses, and network behavior—can be vital for the rest of the chain, even if the impact in that particular plant remains minimal.
César Maldonado, on the other end of the chain, was asked whether he would expect a real impact before modifying his own generation commitment. His response was immediate: no. The proper protocols are activated at the first sign, and the concrete decision—to switch to degraded operation or not—depends on the technology involved: a thermal or gas power plant reacts differently than a hydroelectric one, but in both cases constant communication with the dispatch is non-negotiable. Daniel Soto, from transmission and distribution, added the final piece to the puzzle: warning the involved teams early, even if it’s with a simple «there may be an impact; stay alert,» so as not to end up receiving a hundred panic calls instead of twenty well-managed ones.
Phase 2: when the problem stops being local
Thirty-five minutes later, the scenario revealed that the compromised credentials belonged to a provider that services several companies in the energy sector, and that those same credentials could have been used against other clients. It didn’t mean that the ransomware had physically traveled from one company to another, but it did mean that there was a common vector: a possible campaign across various OT environments, with intermittent telemetry in distribution and anomalous access in transmission, although the SCADA remained available in all cases.
This phase left two very concrete technical concepts on the table. Daniel Soto located the problem in the 3.5 zone of the Purdue model —the point of boundary between IT and OT— and explained that in the face of anomalous access attempts, it is to be expected that a privileged access management tool (PAM) will cut off active sessions and start new ones while a war room dedicated exclusively to the incident is activated. César Maldonado, for his part, explained how microsegmentation —DCS, PLC and RTU isolated from the engineering stations that do communicate with the IT/OT world— allows operations to continue with the stable unit even if the engineering station is compromised, always informing the national electrical system under the deadlines required by the regulations: three hours to report a suspected incident to the ANCI, a little less to the Electrical Coordinator.
| Phase | Time elapsed | Key decision |
|---|---|---|
| Detection | 18:35 h, minute 0 | Activating the playbook and notifying ANCI and the Electrical Coordinator of an early warning |
| Propagation | +35 minutes | Isolate and contain without stopping the operation; activate the war room |
| Recovery | +2 hours | Restoring in an isolated environment and requiring evidence before reconnecting |
Source: Panel «Hour Zero: Orchestrating Continuity and Resilience in Industry 5.0», Industrial Cyber Summit Chile 2026.
A criterion that the three panelists repeated in different ways during this phase was that it is preferable to «overreact» in the response and to communicate it to the regulator in a timely manner rather than underestimating the incident. Daniel Soto added a useful warning for any organization that believes that forensic analysis is a matter of minutes: a real investigation can take three to four hours, not the seconds shown in television series, and the role of the leader of cybersecurity at that moment is to translate that into strategic decisions for the business, without constantly interrupting the technical teams that are resolving the incident.
Phase 3: Restored is not the same as reliable
Two hours after the start of the scenario, the campaign was partially contained and the recovery of HMI, engineering stations, and telemetry began. But the existence of backups did not guarantee anything in itself: the question, as Eyquem summarized, was no longer how to contain but when to trust again.
Pablo Silva was emphatic about a detail that often goes overlooked: ransomware first targets the «hot» backups —those that are connected to the network— to encrypt them as well, which is why the only real guarantee is having a «cold» backup, disconnected, and having tested it before needing it. César Maldonado took the standard one step further: restoration must be done in an isolated «clean room» environment, with firmware validation and PLC alongside the vendor, and requiring at least three proofs before reconnecting any asset —an anomalous traffic in zero, a signed checklist with the vendor, and a match between the data shown by the remote operation room and what is actually observed on the ground. Daniel Soto summarized the same principle from risk management: without a completed reconnection checklist, simply no connection is made, no matter how much commercial pressure there is to get back up and running quickly.
The lesson that no technology replaces
The panel's final reflections coincided on something that goes beyond any tool: a critical infrastructure ransomware rarely seeks to destroy the plant as an ultimate goal, but rather to generate loss of trust in the data or an economic gain, and the only real defense against that is having practiced the scenario before it actually happens. Pablo Silva proposed taking the publicly documented attack chains and testing them in tabletop exercises aligned with the own business. César Maldonado went further: in the more mature exercises, the board should be involved, not just the technical teams, and also simulating the recovery of backups, because a plan that has never tested its own recovery is, strictly speaking, not a plan. Daniel Soto concluded with the point that connects this exercise with the rest of the Cybersecurity in critical infrastructures From the country: include the providers in those tests, because many of the actual attack vectors — like the one in this very scenario — enter through there.
Eyquem closed the panel with the phrase that gives it its name: you don’t have to wait for the next ransomware to discover whether an organization is prepared. The invitation is to try today, in a controlled exercise, how it will respond when the real zero hour arrives.
