Comparative Analysis of ICS Cybersecurity Testbeds Using a Purdue-Aligned Approach

Abstract

Industrial Control Systems (ICSs), which underpin communications and operations in industrial environments in general and in critical infrastructures in particular, are targeted by malicious actors for diverse reasons. To strengthen their resilience against cybersecurity attacks, testbeds play a fundamental role in supporting experimentation, the validation of defense mechanisms, dataset generation, and architecture evaluation, among other activities. However, existing testbeds differ considerably in their functional capabilities, architectural completeness, implemented technologies, and degree of documentation, making systematic comparison and classification difficult. This paper presents a comparative analysis of 34 ICS cybersecurity testbeds within a Purdue-aligned framework based on two complementary dimensions: Functional Maturity (FM) and Architectural Completeness (AC). The former evaluates capabilities relevant to cybersecurity experimentation, while the latter measures the coverage of Purdue-aligned and supporting IT/OT components the testbed includes. To address this problem, we propose a methodology that enables the identification of technology adoption patterns, capability distributions, and recurring architectural characteristics across contemporary testbed implementations. Results reveal that many platforms provide advanced experimentation capabilities while offering only partial representation of industrial and enterprise environments. Moreover, the analysis also highlights underrepresented architectural components that may influence the scope of cybersecurity, Industrial Internet of Things (IIoT), and Industry 5.0 research that can be conducted within a testbed. Finally, based on these findings, a Purdue-aligned testbed blueprint is proposed as a reusable conceptual baseline for the design and comparison of future industrial cybersecurity experimentation environments.