Table of Contents
- What happened at the OT cybersecurity Florida exercise
- Why water utilities are in the crosshairs
- The key findings from the exercise
- What it means for your organization
- How to build operational resilience
- Frequently asked questions
OT cybersecurity Florida just had its most realistic stress test yet. In late August, more than 100 participants from government, utilities, the military, and private industry gathered in Tampa for the 2026 Jack Voltaic Tampa exercise — a three-day simulation of a coordinated cyberattack against regional water infrastructure. Hosted by Cyber Florida with the U.S. Army Cyber Institute, the drill paired a live-fire cyber range with executive tabletop decision-making running on the same scenario for the first time. Here are five lessons Florida organizations should take from it.
What happened at the OT cybersecurity Florida exercise
The exercise simulated a sophisticated cyber campaign against regional water treatment operations. Participants had to detect malicious activity, investigate attacks spanning both IT and OT environments, coordinate with government agencies and utility operators, and communicate operational impact to executive leadership. Rather than grading compliance or individual technical skills, the drill tested whether organizations could keep essential services running while responding collaboratively under pressure.
Two platforms ran side by side: SimSpace’s cyber simulation range handled the live-fire technical response, while Norwich University Applied Research Institute (NUARI) ran the management side on its DECIDE platform. According to Cyber Florida’s After Action Review, it was the first time a live cyber range and a tabletop exercise operated simultaneously on the same scenario — closing the old gap between what technical teams practice and what executives rehearse. That matters because OT cybersecurity Florida testing has historically split technical and leadership teams into separate drills that never quite line up.
Why water utilities are in the crosshairs
The exercise was not hypothetical, and the timing reflects where OT cybersecurity Florida risk is concentrated. CISA and the FBI have been warning that Iranian cyber actors are actively targeting internet-connected industrial control systems supporting U.S. critical infrastructure — including the water and wastewater sectors. Water treatment plants run operational technology that is older, harder to patch, and more exposed than most business networks, which makes them an attractive target for disruption.
For organizations outside the utility sector, the threat picture still applies: OT cybersecurity Florida conversations are not just about treatment plants. The same classes of devices — building automation, HVAC controls, security cameras, access control systems, and medical equipment — run on networks inside offices, clinics, and facilities across the state.
The key findings from the exercise
Cyber Florida’s After Action Review surfaced findings that translate well beyond Tampa Bay Water and the exercise’s participants:
- Nearly 100 participants from federal, state, local, and private-sector organizations collaborated during the exercise.
- The dual-platform format — live-fire technical response plus executive tabletop — mirrored real-world crisis response and strengthened coordination between technical and leadership teams.
- Participants shifted from isolated technical response toward an integrated incident response posture, improving shared situational awareness.
- Technical teams practiced hypothesis-driven investigations, correlated IT and OT telemetry, built unified incident timelines, and translated technical findings into business-impact decisions for executives.
“Recent nation-state activity reinforces what we’ve believed for years: critical infrastructure organizations need opportunities to safely validate how people, processes and technology perform together before a real incident occurs,” said Bruce Caulkins, Ph.D., director of Cyber Solutions and Technology at Cyber Florida.
What OT cybersecurity Florida means for your organization
You do not have to run a water plant for the lessons to apply. If your business operates anything connected that keeps your facility running — HVAC, access control, cameras, door systems, medical or industrial equipment — you have an OT edge that needs the same attention as your email and servers.
The core lesson of the Tampa drill is that readiness is proven under pressure, not assumed. A checklist gathering dust is not an incident response plan. Organizations that tested their people, processes, and technology together — before an attack — were the ones that kept essential services running. That standard is achievable at any size, and OT cybersecurity Florida organizations of every scale can borrow the exercise’s playbook.
How to build operational resilience
Five practices mirror what the Tampa exercise rewarded — and they are the backbone of OT cybersecurity Florida readiness at any scale:
- Test your response plan. Run a tabletop drill with leadership and technical staff on the same scenario, at least once a year.
- Know your connected devices. Inventory OT-adjacent systems — HVAC, cameras, access control — and who can reach them.
- Correlate IT and OT visibility. An attack rarely stays on one side of the network. Monitoring should cover both.
- Practice translating tech to business. Executives need impact language (downtime, cost, risk), not just log lines.
- Rehearse with partners. Utilities practiced alongside CISA, the FBI, and other agencies; businesses should practice with their managed IT and cybersecurity partners.
That last point is where a managed IT provider earns its keep — not just fixing what breaks, but helping you rehearse what to do when something is attacked. Cybersecurity services that include monitoring, response planning, and employee training turn a scary exercise into a manageable routine.
Frequently Asked Questions
What does OT stand for?
Operational technology — the hardware and software that controls physical systems like water treatment, HVAC, and manufacturing equipment. IT manages data; OT manages things that run.
Is my small business a target for OT attacks?
Directly, most small businesses are not. But connected systems like cameras and access control are common entry points, and the same preparation steps apply at any scale.
What is the Jack Voltaic exercise?
A series of cyber resilience exercises run by the U.S. Army Cyber Institute and partners, simulating coordinated attacks on critical infrastructure. The 2026 Tampa edition focused on water utilities.
Where can I learn more about OT cybersecurity Florida?
Cyber Florida and partners publish After Action Reviews of exercises like Jack Voltaic Tampa; following CISA advisories is the best way to track real threats.
Readiness is not a product you buy — it is a habit you practice. Nextek IT helps South Florida organizations of every size build the monitoring, response plans, and rehearsals that keep operations running when the pressure is on. Contact Nextek IT to start the conversation about your operational resilience.
Source: PR Newswire via Yahoo Finance — “Cyber Florida, SimSpace and NUARI Share Lessons from Nation-State Cyber Exercise” (Aug. 27, 2026).