Cyber Fortress 2025: AWS cloud-based cyber range powers electric grid defense

The threat to America’s critical infrastructure is constant. A comprehensive, whole-of-government approach is required to counter emerging threats such as small Unmanned Aerial Systems (UAS) and cyberattacks against networks and critical infrastructure. Senior U.S. government officials have acknowledged these growing challenges and the need for coordinated defensive measures.

In response to these challenges, Amazon Web Services (AWS) collaborated with the Virginia Army National Guard (VA ARNG) for Cyber Fortress 2025, an exercise that brought together government agencies, public utilities, and academia to strengthen critical infrastructure defense through collaborative training.

Cyber Fortress 2025 used a cloud-based cyber range built on AWS—a first in the exercise’s history. The VA ARNG’s 91^st Cyber Brigade led the two-week exercise and engaged over 500 participants, with 260 working directly on networks. There were 528 participants from 47 military and civilian organizations. The participants came from a wide range of backgrounds, including the U.S. Army Combat Capabilities Development Command (DEVCOM) Army Research Laboratory (ARL), the Defense Advanced Research Projects Agency (DARPA), the U.S. Secret Service, the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and leading universities and state emergency management teams. Using AWS cloud infrastructure, network defenders worked in a realistic training environment to detect, respond to, and mitigate sophisticated attacks against simulated power grid systems.

Advancing power grid protection

Power grid defense is increasingly complex as infrastructures modernize and threats evolve. Traditional on-premises cyber ranges—with their fixed capabilities and limited scale—struggle to replicate the intricate interactions of today’s power systems. Cyber Fortress 2025 addressed this challenge by leveraging AWS cloud infrastructure to create a dynamic, responsive training environment that accurately mirrored real-world systems.

“A stable, resilient platform is the foundation for effective cyber defense training and data collection for follow on research,” said Dr. Andre Slonopas, exercise lead. “AWS enabled us to run simulations without disruption, allowing defenders to focus on mastering the skills while researchers were able to focus on optimizing techniques for effective cyber defense.”

Cloud infrastructure also improved accessibility for remote participants, which led to higher participation in this year’s exercise compared to previous years.

Accelerating deployment through reference architecture

Proven reference architecture for cloud-based cyber ranges and operational technology on AWS facilitated the success of Cyber Fortress 2025. Pre-validated technical configurations and best practices served as a blueprint to quickly establish a sophisticated exercise environment. In less than three months, the team built and deployed isolated training networks that accurately mirrored real-world power grid environments. These networks incorporated automated scaling capabilities to support over 200 concurrent participants, ensuring the exercise accommodated exercise participants across the U.S. The final exercise range was a dynamic, responsive environment where defensive actions had real-time impacts on the simulated attacks, closely mimicking the back-and-forth nature of actual cyber conflicts.

Figure 1. Cyber Fortress 2025 Cyber Training Range on AWS. The firewalls represent pfSense virtual firewalls run on Amazon Elastic Compute Cloud (Amazon EC2). The team used an extremely large EC2 instance with many ENI to simulate the “WAN” in the center of the diagram, connecting each of the representative subnets to one another.

Mission-enabling framework

Cyber Fortress 2025 tested power grid cybersecurity resilience with challenging scenarios. The event leveraged advanced AWS cloud infrastructure to process vast real-time data streams from simulated operational technology systems, while AI-driven analysis empowered teams to swiftly identify and counter threats.

AWS expanded its support beyond cyber training to assist with ARL’s counter-unmanned aerial systems (C-UAS) experimentation during Cyber Fortress 2025. Leveraging Cloud Edge Global Access (CEGA), AWS established resilient and secure cloud connectivity for multiple UAS-sensing systems. AWS deployed the Defense Operations Grid-Mesh Accelerator (DOGMA) solution in partnership with General Dynamics Information Technology (GDIT). DOGMA enhanced the incoming data using AI and machine learning (ML) capabilities and displayed it as a common operation picture (COP) in the command center, effectively depicting simulated UAS threats to critical infrastructure. The integration of these advanced technologies significantly improved real-time decision-making and threat assessment capabilities during the exercise, complementing the cyber defense focus of Cyber Fortress 2025 and demonstrating a comprehensive approach to critical infrastructure protection.

The exercise also validated critical defensive capabilities. Participants demonstrated rapid threat detection, maintained energy operations during attacks, and achieved seamless coordination between multiple agencies and utilities. With AWS Partner Sentient Industries, the AWS team deployed an AI-integrated internet of things (IoT) solution to monitor modular energy for tactical expeditionary operations resource (METEOR) power assets to dynamically forecast energy demands and optimize power distribution. Sentient Industries also provided off-grid power to GDIT’s tactical edge nodes, delivering scalable, uninterrupted energy for the event.

With AWS support, Cyber Fortress 2025 defenders proved they can implement robust security controls that protect critical systems while maintaining operational access vital to keeping the power grid running.

Looking ahead

The success of the Cyber Fortress 2025 cloud-based approach demonstrates how AWS technology can transform cybersecurity training from limited-scope events into dynamic programs that evolve with emerging threats. This scalable, realistic training approach can help prepare defenders to protect our nation’s critical energy infrastructure as threats to our power grid grow more sophisticated. Speak to your AWS representative about how AWS can support your cyber training requirements and your tactical integration with the cloud.