Cyber Security Education by integrating Digital Twins and Generative AI[v1] | Preprints.org

Digital twins enhance cybersecurity education by creating virtual replicas of physical systems such as programmable logic controllers (PLCs) and Internet of Things (IoT) devices, enabling real-time monitoring, simulation of cyberattacks, and proactive vulnerability assessment without disrupting operational environments . These digital twins (DTs) support both design-time and runtime security operations by allowing learners to engage in realistic, scenario-based training involving threats like ransomware, phishing, and zero-day exploits within safe, controlled IT, OT, and IoT infrastructures .

Generative artificial intelligence (Gen AI), particularly through large language models (LLMs), complements digital twins by automating complex cybersecurity tasks such as penetration testing, threat modeling, and incident response . Tools like PentestGPT and PentestAgent leverage LLMs to automate vulnerability detection, generate attack vectors, and provide adaptive feedback during training exercises . In educational contexts, Gen AI tailors attack complexity to learner skill levels and delivers contextual, natural-language explanations to support red team and blue team exercises .

A key innovation in this integration is the Red Team Knife (RTK), a custom penetration testing toolkit aligned with the Cyber Kill Chain model, which guides learners through attack phases such as reconnaissance, exploitation, and command and control within a digital twin environment . The framework employs a two-dimensional structure mapping simulation layers (applications, networks, social engineering) against attack stages, reflecting the non-linear nature of real-world cyber operations .

This combined DT–LLM framework is being piloted in academic settings to improve hands-on skills in vulnerability assessment and security operations, with initial findings indicating enhanced effectiveness in bridging theoretical knowledge and practical readiness . The synergy of digital twins and generative AI not only transforms cybersecurity education but also supports broader applications in threat detection, policy automation, and secure semiconductor lifecycle management .

This preprint explores the development of an advanced educational framework designed to bridge the gap between theoretical cybersecurity knowledge and practical application in industrial environments. It focuses on the integration of Digital Twin technology to create high-fidelity, virtual replicas of critical infrastructure components, specifically Programmable Logic Controllers (PLCs) and Internet of Things (IoT) devices. By decoupling the training environment from physical hardware, the research provides a safe, cost-effective sandbox for students and professionals to engage with Operational Technology (OT) systems. The study further enhances this virtual architecture by incorporating Generative AI (GenAI), which is utilized to automate complex tasks such as penetration testing, vulnerability assessment, and the generation of realistic cyber-attack scenarios.

The key contribution of this work lies in its novel approach to simulating proactive security measures within a cyber-physical context. Unlike static training modules, the proposed framework leverages the generative capabilities of AI to dynamically create attack vectors and defensive exercises, thereby exposing learners to evolving threat landscapes that mimic real-world adversarial behavior. This integration allows the Digital Twin to function not merely as a passive simulator, but as an interactive opponent that adapts to the learner's proficiency level. The paper details the architectural requirements for embedding Large Language Models (LLMs) and generative algorithms into the digital twin ecosystem, demonstrating how AI can facilitate rapid scenario generation and code analysis for ICS security.

This material is significant because it addresses the acute skills gap in the industrial cybersecurity sector, where the consequences of breaches are physical and potentially catastrophic. By combining the immersive nature of Digital Twins with the scalability and creativity of Generative AI, the authors present a viable path toward scalable, hands-on workforce training. For researchers and practitioners, this work highlights the transformative potential of GenAI in cybersecurity education, suggesting that AI-driven simulations will become essential for preparing the next generation of security professionals to defend increasingly complex and automated industrial networks.

# Summary: Cyber Security Education via Digital Twins and Generative AI

This research explores the integration of digital twins and generative AI (GenAI) to advance cybersecurity education by simulating Programmable Logic Controllers (PLCs) and Internet of Things (IoT) environments. The paper proposes a proactive security framework where digital twins—virtual replicas of physical systems—enable realistic, risk-free training for detecting vulnerabilities, conducting threat modeling, and testing defensive strategies. By leveraging GenAI, the approach automates complex tasks such as penetration testing, adversarial scenario generation, and security policy optimization, making cybersecurity training more dynamic and scalable.

The key contributions include: - Enhanced Simulation Fidelity: Digital twins provide high-fidelity replicas of industrial control systems (ICS) and IoT networks, allowing students and practitioners to experiment with real-world attack surfaces. - AI-Augmented Security Testing: GenAI accelerates vulnerability discovery by generating synthetic attack patterns and simulating adversarial behavior, reducing the need for manual, time-consuming assessments. - Educational Scalability: The framework lowers the barrier to entry for cybersecurity training by offering a low-cost, repeatable environment for hands-on learning.

This work is particularly relevant to AI research in secure digital twin frameworks, as it demonstrates how GenAI can augment cybersecurity education and operational security. By bridging the gap between theoretical knowledge and practical application, the approach could improve workforce readiness in critical infrastructure protection. The paper is available on [Preprints.org](https://www.preprints.org/manuscript/202511.1203).