LibertyEclipse26 Postmortem

---

Have you ever seen a wire get overloaded with so much electricity that it melts away into nothing? How about when that surge of power is the result of a cyberattack, shutting down actual electrical components? My guess is no, and that’s what makes the Department of Energy’s Liberty Eclipse Cybersecurity Exercise so unique.

Liberty Eclipse 2026 was my second year working on the project from the development side, but my first time actually going out to the island for exercise week. I wasn’t a participant - most of my time was spent putting out infrastructure fires - but I still got the opportunity to learn a ton.

What is LibertyEclipse?

“The Liberty Eclipse (LE) full-scale exercise is an annual cybersecurity preparedness exercise that brings together federal partners, and operational technology (OT) and cybersecurity experts from the energy sector to validate the security of their cyber defense systems, plans, policies, and procedures, in a scaled environment. The collaboration and testing that results from Liberty Eclipse, along with its unique format, has made it one of CESER and DOE’s best preparedness exercises and an illustration of the value of preparedness testing across the Federal government and industry. Read more about the exercise here: https://www.energy.gov/ceser/liberty-eclipse”

What sets LE apart from any other Attack/Defense training is that it’s live fire. The grid on the island is real. LE has real OT equipment and real power generation. When the red team pulls off an attack, the effects are physically reflected in the OT network (which is how you end up with a melted wire).

My role

In the months leading up to the exercise, I helped build the IT infrastructure and the in-game portal players use to access exercise resources. That work gave me a lot of experience across DevOps, IAM engineering, and software development. Onsite, I helped the red team execute thier operations, and maintained the portal infrastructure.

Lessons learned

Just watching your systems get hacked is nerve-wracking. Utility SOC and Ops teams understandably feel pressure when they realize they’ve been compromised. Mitigation isn’t really the goal of the exercise - the goal is for teams to see what an attack looks like from their seat and practice how they’d detect, communicate, and respond. Stopping the attack by firewalling a port or locking down a device is out of scope. Instead, utilities need to coordinate their SOC and Ops teams to monitor and understand the attack. LE is a good place to have a bad day – it’s the perfect practice for the real thing.

The red team hits hard. The red team simulates APT-level adversaries and shows the utilities as many different attack paths as they can fit into a week. Gotta keep them entertained, right? I got a chance to watch the red team in action and got a rundown on the C2s and exploits they were running and why. There’s a vignette the hackers stick to, mimicking different APTs and the way they’d get initial access or maneuver through a network.

Things break. I was putting out fires all week. From password resets to reinstalling logging tools, something always needed fixing. My biggest takeaway on the infra side was that stuff will always break in the least expected way, and we’ve just got to triage what needs to be fixed urgently and push through it.

AI tools are getting good. The utility detection setup was one of the most impressive things I saw all week. With logging tools like Gravwell, Frenos, Dragos, and Security Onion all tied into the high-risk boxes, operators could see red team actions within seconds of them happening. All of this fed into an LLM that spit out the details, including severity and remediation, in seconds. SOC teams had potential fixes for moves the red team had made just moments earlier.

Looking ahead

Overall, LE26 was a blast. I learned a ton, and I’m leaving with a list of things to improve for next year. If you work in OT cybersecurity, or just want to see what defending a real grid looks like, it’s an experience that’s hard to match.