ICS/SCADA Case Study

This is the full story of building a production ICS/SCADA course from nothing — 14 new plugins, a multi-machine scenario, a complete curriculum, and automated testing, all driven through Claude Code with the Rogue Arena MCP.

It was the most complex build done on the platform to date. This walkthrough documents how each phase worked, what the non-obvious decisions were, and what you’d do differently knowing what we know now.

The finished ICS-Pinebrook course canvas — four network segments wired together: the OT floor, the corporate IT domain, a DMZ with Security Onion, and an isolated PLC network.

This is advanced territory

This case study is essentially its own class in Claude-assisted lab development. If you’re here expecting a quick-start, this isn’t it. Expect depth.

The Two-Canvas Strategy

Before anything else, the most important architectural decision of this build:

The plugin-testing canvas and the course canvas are completely separate.

One canvas exists purely to validate that every plugin works — exhaustively testing every plugin and parameter combination before they ever touch a student environment. The course canvas is built separately, after the plugins are proven. This distinction matters because debugging plugins inside a live course scenario is painful; debugging them in an isolated test environment is manageable.

Keep these two contexts separate in your head as you read through the phases.

Four Phases

Phase 1: Plugins

Research what tooling a real ICS/SCADA course needs, identify catalog gaps, build 14 new plugins, and validate them via a dedicated test canvas.

Plugin development

Phase 2: Scenario

Feed Claude a course outline, generate a full scenario, validate the flow maps naturally to course objectives, and frame the whole thing as an apprenticeship.

Scenario design

Phase 3: Curriculum

AI-drafted curriculum transformed into the instructor's own voice — voice tokens, transform guides, critique agents, and visual learning material.

Curriculum authoring

Phase 4: Testing

Claude drives end-to-end testing — deploying VMs, simulating student browser sessions, and executing directly on machines to walk the full lab flow.

Automated testing