The live demo
A simulated plant, Werk Niederrhein, runs around the clock. Its controllers, workstations and remote access produce the traffic a real site would, and Klaar Lagebild watches it.
Open the live demo (opens in a new tab)All data is simulated: no real plant, no real people, nothing to break.
What you will see
The floor map shows every asset. When Lagebild spots something, the asset changes colour and a case opens with its next step, the chain of events and the NIS2 clock.
Plays by itself, one after the other
- 01
Unplanned write to PLC Filling
An office laptop reaches the filling line’s PLC through a firewall rule that is too broad, reads it and changes the filling setpoint. Lagebild links the write, the unusual source and the jump in the process value into one incident.
- 02
Vendor login outside the maintenance window
The machine vendor’s remote-maintenance account logs in over VPN while no maintenance is agreed, and starts reading the SCADA server. Lagebild flags the login, the unusual connection into the control network and the burst of reads as one incident.
- 03
New device talking to the boiler
A device nobody registered shows up in the control network and starts querying the boiler controller. Lagebild notices the unknown address, links it to the traffic towards a critical asset and raises one incident.
Start it yourself
From a phishing mail to the filling line
A member of staff clicks a phishing link. Minutes later their account logs in over VPN, the attacker moves from the office PC to the engineering workstation and writes to the filling PLC. Each step alone looks harmless; Lagebild links them into one incident with the whole path.
Use “Try an attack” on the overview. Your attack starts at once; the floor map, the case and the NIS2 clock follow within a minute or two. The case then waits for you: work it through yourself.
Finding your way
- The menu on the left switches between Overview, Cases, Sense, Network zones and Audit.
- Click an asset on the floor map to open its cases. Every case says what to do next and shows why it was flagged, the evidence and the NIS2 reports.
- The demo is available in English, German, Dutch and French (EN · DE · NL · FR at the top right).
- From Switzerland? The demo follows the Swiss ISG by itself: reportable or not, the initial report to the BACS within 24 h and the completion within 14 days. Switch between EU NIS2 and Switzerland ISG under “Rules” at the top.