Breach and Attack Simulation for ICS Security: Validating Controls Across IT/OT Environments

**Executive Summary:** This whitepaper warns that adversaries commonly compromise enterprise IT and pivot into OT, reviews historical APT and ICS-targeting malware campaigns (e.g., Sandworm, Triton, APT33, EKANS, LockerGoga), and advocates continuous Breach and Attack Simulation (BAS) — specifically Picus — to safely validate detection and controls across Purdue Model layers using cloned VMs and real-world simulation scenarios for phishing, lateral movement, DMZ/jump-server compromise, ICS data theft, and destructive malware.