Cybersecurity · Free online course
OT Security Assessment: Testing a Plant Without Stopping It
The assessment half of OT security, for engineers who have to do it on a plant that is running. Rules of engagement first, then passive capture, careful enumeration, what an attacker does with a protocol that has no authentication, the Windows machines nobody mentions, the logging that would have caught it, and a report written in the language of consequence.
- 12 modules
- 8h 50m of video
- Intermediate
- English
- ₹0, free
- Lab practice in your browser
₹0Free for good
Worth ₹5,999 by length and depth against classroom training. It has always been free; that is not a former price.
No card. Checkout takes a minute and gives you a receipt.
Overview
About OT Security Assessment: Testing a Plant Without Stopping It
Learn to assess the security of a live plant safely: agree the rules, read the traffic first, test with care and report clearly.
OT Security Assessment: Testing a Plant Without Stopping It is a free, self-paced online course from EDWartens for automation, OT and IT engineers responsible for security. It has 12 modules and 8h 50m of video lessons by SANS ICS Security, with written notes and worked problems, a practical project with a document pack and a 15-question final assessment (pass mark 60%). Learning is free with an account; an optional certificate with a public verification code is issued when you pass. Last updated 27 September 2026.
Who it is for: Automation, OT and IT engineers responsible for security
This course includes
- 8h 50m of video lessons
- 12 modules with written notes and diagrams
- One final assessment: 15 questions, pass mark 60%
- Ask-an-engineer support from practising engineers
- Lifetime access, the course does not expire
- Optional verifiable certificate when you finish
- Step 1 of 3
Learn the 12 modules
8h 50m of video lessons, written notes and a practice task per module, at your own pace.
- Step 2 of 3
Pass the final assessment
15 questions drawn from every module, pass mark 60%, 3 attempts.
- Step 3 of 3
Take the certificate, if you want it
Optional, paid once, only if you choose it. The course stays free either way.
See the certificate and its price
A look inside
From the lessons
Rules of Engagement: Assessing a Plant That Is Running
by SANS ICS Security
Field Rules and the Ground You Are Assessing: Architecture and Segmentation
by SANS ICS Security
Reading the Traffic Before You Send Any
by SANS ICS Security
Enumeration, Carefully
by SANS ICS Security
What the Attacker Does Next
by SANS ICS Security
Naming What You Found: ATT&CK for ICS
by SANS ICS Security
Lesson frames belong to the creators named in the Credits and are shown from YouTube.
What you learn
What you will be able to do
By the end you will be able to:
- Write rules of engagement for a system that cannot be stopped
- Capture and read industrial traffic before sending any
- Choose compensating controls for a device that will never be patched
- Review PLC code against the Top 20 Secure PLC Coding Practices
- Write a two-page report ordered by consequence
How it works
How this course works
Watch the lessons
Short video lessons, one module at a time, at your own pace.
Read the notes
Open the Reading tab for the written notes and diagrams of the module.
Practise in the 3D labOptional
Try the module in the free 3D lab, in your browser.
Check yourself
Answer the questions to see what stuck before you move on.
Final assessment
Pass the final once you have been through the modules.
Certificate, if you want oneOptional
Optional, with a page anyone can use to verify it.
Syllabus
Course content, module by module
In order, at whatever pace suits you. Each module ends with a practice task that builds on the last.
- Modules
- 12
- Video lessons
- 22
- Of video
- 8h 50m
- Final questions
- 15
- 01
Rules of Engagement: Assessing a Plant That Is Running
1 lesson · 14m - 02
Field Rules and the Ground You Are Assessing: Architecture and Segmentation, with lab practice:
3 lessons · 1h 29m - 03
Reading the Traffic Before You Send Any
2 lessons · 39m - 04
Enumeration, Carefully
2 lessons · 49m - 05
What the Attacker Does Next, with lab practice:
2 lessons · 53m - 06
Naming What You Found: ATT&CK for ICS
2 lessons · 24m - 07
The Windows Machines Nobody Mentions
2 lessons · 53m - 08
Seeing It Happen: Windows Logging and Integrity Baselines
2 lessons · 1h 3m Final assessment · 15 questions, pass mark 60%
3D lab
Practise in the 3D lab
Practise the desk side of an OT assessment in the OT security lab: reading a plant network by level and zone, and choosing what to protect when a weakness cannot be patched.
- Map the plant network: put every device on its levelOT security labOpen in the lab (opens in a new tab): Map the plant network: put every device on its level
- Zones and conduits: split a flat networkOT security labOpen in the lab (opens in a new tab): Zones and conduits: split a flat network
- Patch or protect: choose within the maintenance windowOT security labOpen in the lab (opens in a new tab): Patch or protect: choose within the maintenance window
Optional. Skip it whenever you like: it never blocks your progress or your certificate.
Project
The course project
Optional practice that ends in the kind of job the course prepares you for, with the documents that go with it.
About 16 hours
Passive OT security assessment of a running cement plant: DCS, packing PLCs and weighbridges, without a single active scan
Assess the security of a cement plant that cannot be stopped. Write the rules of engagement. Build the asset inventory from documents, interviews and a mirror-port capture. Read the DCS and packing-plant traffic in Wireshark. Run CHAPS on the Windows machines with the owner present. Review the packing PLC program against the Top 20 Secure PLC Coding Practices. Name every finding in ATT&CK for ICS. Write the report ordered by consequence, with a 30/90/365-day roadmap. You deliver your own plan, inventory, evidence register, risk register and report. The sample pack shows what an assessor hands to a plant head who has never read one.
- 7documents in the pack
- 9steps to follow
- 6things to hand in
- 16 hof work, at your pace
Sample document pack, 7 documents, filled in for the scenario
- PlanAssessment Plan and Rules of Engagement: Beni Suef Plant OT Security Assessment
- Asset inventoryOT Asset Inventory: Beni Suef Plant, as Found
- RegisterInterview and Evidence Register
- Risk registerRisk Register: Cyber Risks on the Plant's HSE Matrix
- ReportOT Security Assessment Report: Findings by Consequence, Beni Suef Plant
- PlanRemediation Roadmap: 30, 90 and 365 Days
- Training recordTraining Record: Running the Roadmap and Repeating the Assessment
Read inside the course and download as a workbook. The project is optional practice, marked when you submit it; the certificate needs only the modules and the final assessment.
Tools
Software, hardware and lessons
Software
Wireshark, a Linux virtual machine, a Modbus simulator or a lab PLC, and CHAPS. All free downloads. Nothing in this course requires a licence or a paid lab.
Hardware
None required. A spare PLC or a Raspberry Pi running a Modbus simulator makes the enumeration and capture work more real, and every exercise is written to work without one.
Who it is for
Intermediate. You should already know what a PLC, an HMI and a SCADA system are, and how they sit on a network. ICS Security Foundations covers that in five hours if you do not. No penetration testing background is assumed.
Software you need
What to download, where from, what it costs and how to install it. Every link goes to the maker's own site, never a mirror.
For a Modbus target, pymodbus runs a simulated Modbus server on the Linux virtual machine, or use a spare lab PLC. Nothing in this course needs a licence or a paid lab.
Required
- 01Free
Wireshark
Wireshark Foundation
- Runs on
- Windows 11 or 10 64-bit (x64 or Arm64), Windows Server 2016 or later, macOS (Universal disk image), Linux
- Account
- None needed
Free, open source software. No licence fee for any use.
Steps
- 1.Open wireshark.org/download.html.
- 2.Download the Windows x64 Installer (or Arm64, or the macOS Universal Disk Image).
- 3.Run the installer and keep the Npcap option ticked on Windows.
- 4.Open Wireshark, pick your network interface and click the blue fin to start capturing.
- Npcap is needed for live capture on Windows. The Windows installer includes it.
- Only capture traffic on networks you own or have written permission to monitor.
Official download pagewireshark.org - 02Free
Oracle VirtualBox
Oracle
- Runs on
- Windows, macOS (Intel and Apple Silicon), Linux and Solaris hosts
- Account
- None needed
The VirtualBox platform packages are free and open source under GPL version 3. The separate Extension Pack is free only for personal and educational use (PUEL licence); business use of the Extension Pack needs a commercial licence from Oracle.
Steps
- 1.Open virtualbox.org/wiki/Downloads.
- 2.Click the package for your host system (for example, Windows hosts).
- 3.Run the installer and accept the network driver prompts.
- 4.Open VirtualBox, click New, choose your ISO file (for example Ubuntu or Windows) and follow the wizard.
- Turn on hardware virtualisation (Intel VT-x or AMD-V) in your PC's BIOS or UEFI if VirtualBox says it is not available.
- You do not need the Extension Pack for normal lab work. Install it only if you need its extra features and your use is personal or educational.
Official download pagevirtualbox.org - 03Free
Ubuntu Desktop
Canonical
- Runs on
- 64-bit PC (Intel or AMD) or ARM 64-bit. Recommended: 2 GHz dual-core processor, 6 GB RAM, 25 GB free disk space.
- Account
- None needed
- Size
- About 5.9 GB ISO (Intel or AMD 64-bit, current LTS)
Free to download and use. LTS releases get five years of free security updates, which Ubuntu Pro can extend.
Steps
- 1.Open ubuntu.com/download/desktop and download the LTS ISO. For ROS 2 courses, get 24.04 LTS or 22.04 LTS from releases.ubuntu.com instead.
- 2.To try it safely, create a new virtual machine in VirtualBox and attach the ISO.
- 3.To install on a real PC, write the ISO to a USB stick (8 GB or more) and boot from it.
- 4.Follow the installer, then run Software Updater when it finishes.
- Your course may name a specific release. ROS 2 Humble needs Ubuntu 22.04 and ROS 2 Jazzy needs Ubuntu 24.04.
- Give a virtual machine at least 25 GB of disk space.
Official download pageubuntu.comAlternatives
- Ubuntu 24.04 LTS: Use for ROS 2 Jazzy.
- Ubuntu 22.04 LTS: Use for ROS 2 Humble.
- Windows Subsystem for Linux: Run Ubuntu inside Windows 10 or 11 without a virtual machine.
- 04Free
CHAPS (Configuration Hardening Assessment PowerShell Script)
Cutaway Security
- Runs on
- Windows. chaps_PSv3.ps1 for Windows 8 / Server 2012 and later; chaps_PSv2.ps1 for Windows 7 / Server 2008 R2; chaps.bat when PowerShell is not available.
- Account
- None needed
Free under the GNU GPL v3; a commercial licence is offered for use inside proprietary products. Reports you generate are not derivative works.
Steps
- 1.Open the CHAPS GitHub page, click Code, then Download ZIP, and extract it.
- 2.Open PowerShell as administrator in the extracted folder.
- 3.Run: Set-ExecutionPolicy Bypass -Scope Process
- 4.Run: .\chaps_PSv3.ps1 > $env:COMPUTERNAME-chaps.md
- 5.Open the .md report in a text editor or VS Code and review the findings.
- Only run CHAPS on systems you own or are authorised to assess.
- It is read-only and makes no changes, which is why it suits industrial control system PCs.
- Practise first on a Windows evaluation virtual machine.
Official download pagegithub.com
Optional
Useful, not needed to finish the course.
- 05Free
PyModbus
pymodbus-dev (open source project), a Python or npm package
- Runs on
- Windows, macOS and Linux with Python 3.10 or later
- Account
- None needed
Free, open source under the BSD 3-Clause licence.
Steps
- 1.Install Python 3.10 or later and create a virtual environment.
- 2.Run: pip install "pymodbus==3.8.6" (the version the course code is written and tested for; 3.10 renamed slave= to device_id=)
- 3.For serial (RS-485) devices, run: pip install "pymodbus[serial]==3.8.6"
- 4.Follow the client examples in the documentation to read holding registers from a device or the built-in simulator.
- PyModbus includes a server simulator with a web interface, so you can practise without real hardware.
- Only write registers on lab equipment. Writes can move real machines.
Official download pagegithub.com
Checked against each maker's own page on 27 September 2026. Trial lengths and editions change; the maker's page is the final word.
What you walk away with
Your certificate for OT Security Assessment: Testing a Plant Without Stopping It
Finish the course, pass the final, and this is the document with your name on it.
Verifiable by anyone
Adds to LinkedIn in one click
QR code on the certificate
Names what you can do
A permanent link
Earned, not attended
Learning is free. The certificate is optional.
Add it now and pay only when you have finished the course, or come back for it later. One-off, US$28.99, with a receipt.
Issued by Wartens Ltd (England and Wales, company no. 15262249) through the EDWartens training portal, as a Certificate of Completion for this self-paced course. Sold in India by Wartens Automation Private Limited. It is not a vendor certification, a university award or a CPD-accredited activity, and it does not certify competence on live equipment. Delivered electronically; see the refund policy.
Practise what you learn in the free 3D lab
Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.
- Practise safely, so a mistake costs nothing.
- The lab checks your work like a site test, so you know when it is right.
- Free, in your browser, with nothing to install.
Why learn with EDWartens
What you get with this course.
- Free from the first lesson to the final assessment.
- Practice in a free 3D lab in your browser, with nothing to install.
- Video lessons with written notes and a project.
- An optional certificate that anyone can verify online.
FAQ
Common questions
Is this a hacking course?
No. It is an assessment course, and the difference matters on a plant. It teaches you to evaluate systems you are authorised to evaluate, for the people who own them. The first module is entirely about the permission, the window and the condition under which you stop. There is no exploit development here, and nothing is aimed at systems you do not own. The course covers what an attacker does, such as a Modbus man-in-the-middle, because you cannot assess a weakness you have not seen.
How is it different from the OT and ICS Cybersecurity course?
That course is the standards and programme side: ISA/IEC 62443 clause by clause, security levels, risk assessment and governance. It is forty-four hours. This one is the practical assessment: what you actually do in the four days you are on site, in the order that keeps the plant running. They complement each other and neither repeats the other. If you have done neither, ICS Security Foundations is the five-hour place to start.
Do I need a lab, or a real PLC?
No. Every exercise is written to work with a free Modbus simulator on a laptop and a Linux virtual machine. A spare PLC or a Raspberry Pi running a simulator makes the capture and enumeration work feel real. Several people find that worth the effort. Nothing in the course assumes you have one.
Do I need penetration testing experience?
No. The course is deliberately not written for penetration testers moving into OT. It is written for automation engineers who already understand plants and are being asked to assess them. That is the more common situation on real plants, and the one that is worse served.
Is this a SANS course, or does it lead to a GIAC certification?
No. Every video lesson is from the SANS ICS Security channel's free ICS Concepts series, credited on each module. SANS is not affiliated with EDWartens. SANS run their own paid courses and GIAC issue their own certifications. This course is neither and does not count towards either. What EDWartens wrote is the study plan, the objectives, the practice tasks, the notes and the assessments.
What will I have at the end?
A two-page assessment report on a system you chose. It has the scope, the method, findings ordered by consequence, and a section naming what you deliberately did not test. That report is the deliverable of the course. It is worth showing an employer more than the certificate is.
Is the OT Security Assessment course really free?
Yes. Every module, every practice task and the final assessment. You create an account so your progress is saved and the assessment can be marked. The only paid item is the certificate, and only if you decide you want it.
What certificate does the OT Security Assessment course give?
An EDWartens Certificate of Completion, issued when you have worked through every module and passed the final assessment, with a unique number anyone can verify on our site. It is not a vendor or industry credential and we will never describe it as one.
Do I have to use the lab?
No. The lab is optional practice. You can skip it whenever you like, and it never blocks your progress, the final assessment or your certificate.
Is the lab free?
Yes. Every lab level for this course opens in your browser, free, with nothing to install.
Is the OT Security Assessment course free in India, and what does the certificate cost?
Yes. Learning costs ₹0 in India: every module, the written notes, the practice tasks and the final assessment, with no card and no trial period. The only paid item is the optional EDWartens Certificate of Completion, ₹599 including GST for this intermediate course, paid in rupees through Razorpay, and only if you want it after passing the final assessment.
All course factsHide course facts
- Price
- ₹0, free for good. No trial, no card. Comparable classroom training of this length costs about ₹5,999.
- Who it is for
- Automation, OT and IT engineers responsible for security
- Format
- 12 self-paced modules, 8h 50m of video, written notes, a practice task per module and one final assessment.
- Level
- Intermediate. Intermediate. You should already know what a PLC, an HMI and a SCADA system are, and how they sit on a network. ICS Security Foundations covers that in five hours if you do not. No penetration testing background is assumed.
- Brand
- Vendor-neutral
- Software
- Wireshark, a Linux virtual machine, a Modbus simulator or a lab PLC, and CHAPS. All free downloads. Nothing in this course requires a licence or a paid lab.
- Hardware
- None required. A spare PLC or a Raspberry Pi running a Modbus simulator makes the enumeration and capture work more real, and every exercise is written to work without one.
- Certificate
- Optional EDWartens Certificate of Completion, ₹599 inclusive of GST for learners in India, verifiable by code. Not a vendor credential.
- Video lessons by
- SANS ICS Security (independent creators, credited below)
- Language
- English
- Last updated
- 27 September 2026
Pairs well with
Cybersecurity · FreeCompTIA Security+ (SY0-701) Exam Prep
Cybersecurity · FreeMicrosoft Sentinel and Defender: SC-200 Exam Prep
PLC programming · FreeSiemens TIA Portal
PLC programming · FreeSiemens TIA Portal in Three HoursMore free courses: Free cyber security courses · Free OT and ICS security courses
Classroom course, Bangalore
PLC training in Bangalore
The Automation Engineer Program (AEP) is our classroom course in PLC programming and industrial automation, taught in person at our Electronic City centre.
Credits
Who made the video lessons
The video lessons in this course were created by the people below, not by EDWartens. Every lesson streams from its creator's own YouTube channel; EDWartens neither hosts nor sells that footage, and the creators are not affiliated with EDWartens and do not endorse this course. What EDWartens wrote is the study plan, the notes, the practice tasks and the assessments.
- SANS ICS Securitythe entire ICS Concepts series that this course is built from: attacker methodology, field practice, network architecture, Modbus traffic analysis, enumeration and man-in-the-middle, Zeek, ATT&CK Navigator, Windows hardening and logging, integrity baselining, honeypots, the Top 20 Secure PLC Coding Practices, CHAPS and cyber informed engineering
If you are one of these creators and would like a lesson removed or credited differently, write to info@wartens.com.