SimSpace Introduces Preemptive Capability Built on Active Nation-State Threat Intelligence

Early Warning Indicator Radar enables operational technology defenders to develop and validate emerging defenses against real-world adversarial behavior before production systems are at risk

ORLANDO, Fla., Oct. 27, 2026 /PRNewswire/ -- SimSpace today unveiled EWI Radar, an early-warning research capability within the SimSpace platform. It helps defenders turn data from active nation-state campaigns into actionable intelligence that can be tested and validated in safe, realistic replicas of production before real-world systems are compromised.

Attackers have always held the first-mover advantage, and AI is widening that gap by making new attack variations faster and easier to launch. Security teams and their AI agents traditionally have trained on historical data from recent attacks. Preparing for the next attack based on what's occurred leaves even the most well-resourced organizations vulnerable to increasingly common autonomous AI attacks that adapt on the fly and have no historical precedent or data for defenders to train on.

EWI Radar equips defenders to shift from reactive defense, focused on rapid detection and response, and move beyond predictive defense, which also relies on historical data, toward preemptive security. Instead of waiting for a real-world attack to generate incident data to train defenses, organizations can preempt the next AI-fueled attack by relying on SimSpace to generate hyper-synthetic data in a realistic replica of their production environment, building and validating new defenses before operationalizing them in production.

"Cyber defenders need the ability to move quickly with confidence that a new defense will be effective before their environment is under attack," said Clint Sand, CPO at SimSpace. "As part of SimSpace's preemptive cyber simulation platform, EWI Radar empowers defenders to take intelligence from an active threat, recreate the relevant conditions safely, and test a defensive approach repeatedly and at a massive scale to understand whether it deserves to be trusted, and where it must be bolstered. For OT teams protecting systems where failure has real-world consequences, that path from threat intelligence to operational evidence is increasingly essential."

EWI Radar Helps OT Teams Test New Defenses Before an Attack

An EWI Radar within the SimSpace Cyber Range uses hyper-synthetic data to reproduce real-world threats in a realistic environment, so security teams can test how their defenses perform before an attack reaches production. With a cyber range that replicates their exact environment, defenders can take a current threat pattern, reproduce it safely, develop a new defensive capability against it, discover where that capability fails, tune it, and gather operational evidence before trusting it in a live fleet or critical production environment.

This is especially valuable in OT, where an untested security control can disrupt operations and potentially have catastrophic consequences. Testing first against realistic attack, infrastructure, traffic, and device conditions gives security and operations teams room to try new approaches without putting critical systems at risk.

SimSpace hosted a threat webinar discussing how to validate IT/OT defenses using AI-powered simulations. Watch the recording here.

SimSpace Recreates a Live Nation-State Campaign to Validate Defenses

To show how this works, SimSpace recreated an Iran-attributed campaign documented by security researchers in March 2026, in which Iran-nexus threat actors intensified targeting of internet-exposed Hikvision and Dahua IP cameras across multiple countries. The event showed that compromised cameras can support battle damage assessment and targeting correction, and that tracking this activity may serve as an early indicator of potential follow-on kinetic activity. For defenders, that means devices often treated as IoT background noise could provide an early warning signal and a chance to investigate before digital reconnaissance progresses toward physical operations.

In its own research, the SimSpace team built a 12-device simulated camera fleet on real, multi-homed cyber range hardware, with authentic firmware interfaces and real per-device TLS. The range first generated normal device activity to establish a behavioral baseline, then launched a live, five-phase adversary campaign built from disclosed exploit structures associated with all five vulnerabilities identified in the real-world campaign. Against that campaign, SimSpace tested a behavioral detection approach that pairs an unsupervised Isolation Forest model with a separate deterministic latency-ratio check. The model learns baseline device behavior, principally response latency and response size, and flags meaningful deviations. It received no attack signatures or notice of when the attack would begin, so the test measured whether behavioral detection alone could detect abnormal conditions during realistic nation-state activity.

During range validation, EWI Radar recorded zero idle false positives across a 72-combination calibration grid. In the live simulated campaign, 100% of alerts were independently confirmed by both the machine-learning detector and the latency-ratio backstop, and every alert retained attacker-source attribution. Each alert identified the affected device, the mapped vulnerability pattern, source information, the detection mechanism, and the reasoning behind the classification.

Read the full report.

Hyper-Synthetic Data is Driving the Shift to Preemptive Security

The results reflect a broader industry shift from reactive to preemptive security, made possible with hyper-synthetic data. Gartner sees this kind of simulation-driven work becoming central to the industry. Its April 2026 Emerging Tech report states that hyper-synthetic data will reshape the cybersecurity market and that product leaders who fail to champion it risk stalling innovation and losing relevance.

About SimSpace
SimSpace provides the high-fidelity cyber simulation infrastructure required to continuously train, test, and validate AI agents. By integrating AI agents with human operators inside a realistic cyber range, SimSpace serves as the AI Proving Grounds for elite cyber teams. To discover how SimSpace enables teams to outsmart adversaries across any digital terrain, please visit: www.simspace.com.

Contact: Amy Rice, amy.rice@simspace.com 

View original content to download multimedia:https://www.prnewswire.com/news-releases/simspace-introduces-preemptive-capability-built-on-active-nation-state-threat-intelligence-302920725.html

SOURCE SimSpace Corporation