Security Digital Twin-as-a-Service
- Security Digital Twin-as-a-Service is a service model that creates live virtual replicas of ICT assets to enable continuous, non-intrusive cybersecurity compliance and real-time monitoring.
- It leverages integrated technologies such as IoT, cloud computing, Big Data analytics, and AI to simulate cyber-physical environments and guide security governance.
- Practical implementations demonstrate fast instantiation, low latency, and precise anomaly detection, validating the model’s effectiveness in diverse domains.
Security Digital Twin-as-a-Service (SDT-aaS) is a service-oriented use of digital twins for cybersecurity, cyber-physical security, and cybersecurity governance. In its explicit formulation, SDT-aaS is introduced as a way to perform automated, non-intrusive security compliance by mirroring real-world ICT assets, collecting compliance artifacts, and creating machine-readable evidence (Koufos et al., 9 Sep 2025). Closely related formulations in the literature include “Digital Twin-as-a-Security-Service (DTaaSS)” for public-space protection, Security Digital Twins for Smart Critical Systems, Cyber Digital Twins for automotive firmware, and digital-twin security frameworks for CPSs, IoT, ICS, and critical infrastructure (Stefanidou et al., 2024, Mohsin et al., 2023, Silva et al., 2021, Zhao et al., 2022). Across these formulations, the common idea is a continuously updated virtual counterpart that supports security monitoring, simulation, analysis, verification, and feedback without requiring repeated direct experimentation on the live target system.
1. Conceptual scope and terminology
The term Security Digital Twin-as-a-Service is used explicitly in work on continuous and automated cybersecurity certification, where the twin is a live virtual counterpart of real assets and the service logic centers on compliance evidence, lifecycle orchestration, and on-demand deployment (Koufos et al., 9 Sep 2025). A near-synonymous formulation appears as Digital Twin-as-a-Security-Service, defined as a cloud-based, service-oriented security platform that combines digital twins, IoT, cloud computing, Big Data analytics, and AI for public-space protection (Stefanidou et al., 2024). Other papers use adjacent terms rather than the exact label: Security Digital Twins emphasize lifecycle-wide cyber defense for Smart Critical Systems, while Cyber Digital Twins denote security-enriched digital representations of firmware binaries used for continuous requirements verification (Mohsin et al., 2023, Silva et al., 2021).
A recurrent boundary in the literature is the difference between a security-oriented digital twin and a fully realized service-delivery model. EPICTWIN, for example, is a digital twin of an electric power cyber-physical security testbed that is remotely usable, modular, software-defined, and reconfigurable, but it does not define tenancy isolation, scheduling, user authentication, quota management, or a formal hosted service interface (Kandasamy et al., 2021). Similarly, a digital-twin framework for CPS security proposes synchronization, intrusion detection, state replication, and feedback-driven protection, yet it does not provide an explicit service interface, orchestration model, or multi-tenant management layer (Zhao et al., 2022). By contrast, the service orientation is central in the cloud-deployed digital twin virtualization framework that adopts service slicing, supports distributed deployment on cloud computing platforms, separates control functions from physical devices, and enables multiple services over the same infrastructure (Jagannath et al., 2022).
This suggests that SDT-aaS is best understood not as a single fixed architecture, but as a family of architectures in which security twins are exposed as reusable, remotely consumable capabilities. The exact emphasis varies: some systems are oriented toward compliance, some toward intrusion detection, some toward vulnerability assessment, and some toward pre-deployment validation.
2. Architectural composition and lifecycle
Several architectural patterns recur across the literature. One line of work defines a four-layer digital twin framework. At the first layer, each physical entity has a local twin containing an emulation model, a predictive model, and a synchronization engine. The second layer performs model aggregation to construct twins of larger systems and aggregate learning experiences, including federated learning or similar communication-efficient distributed learning. The third layer builds interlinking models of physical systems and network models of the communication infrastructure, with graph neural networks suggested as promising for interlinking models. The fourth layer is a simulation environment with multiple virtual planes used for current-state simulation, Monte Carlo tree search, reinforcement learning, testing, verification, and cross-validation of policies (Jagannath et al., 2022).
A complementary architectural perspective is the Internet of Digital Twins (IoDT). Here the architecture has three parts: physical entities, digital twins, and an IoDT engine linking them via input data and output feedback. The design is distributed rather than centralized: twins may live in cloud or edge servers, multiple twins form interconnected sub-IoDTs, and communication includes both intra-twin and inter-twin modes. Intra-twin communication supports synchronization levels from real-time (~milliseconds) to near real-time (~seconds) and delay-tolerant (~minutes), while inter-twin communication supports information retrieval, cooperative missions, and information sharing beyond physical range constraints (Wang et al., 2023).
A more operationally specific SDT-aaS architecture divides the system into three domains: the real system, the Audit Management Service (AMS), and the Digital Twin domain. The AMS contains a Profile Management System, an Evidence Collector controller and collectors, and a BOM Creator. The Digital Twin domain contains an SDT Manager and SDT instances. Within the SDT Manager, the architecture identifies an SDT Manager Interface, an SDT Manager Core, an SDT Lifecycle Manager (LCM), and a Data Adapter. Each SDT instance contains an SDT Controller and a stored representation that persists the states and attributes of network assets over time (Koufos et al., 9 Sep 2025).
Another recurring pattern is the separation of the physical plane/data plane from the virtual/control plane, explicitly compared with SDN. In this design, physical devices remain in the data plane, while decision-making, learning, and policy optimization are moved into virtual space. The same literature frames this as essential to SDT-aaS because control logic can be hosted independently in the twin, updated and tested without disrupting the physical system, and validated in simulation before deployment (Jagannath et al., 2022). Security Digital Twins for Smart Critical Systems extend this pattern with Virtual Components (VCs), software-based replicas of CPS components such as PLCs/RTUs and IIoT devices that are hosted in edge or cloud environments and improve reliability of data ingestion and observability (Mohsin et al., 2023).
A useful way to interpret the lifecycle in SDT-aaS terms is: sensing or ingestion from assets, synchronization of the twin with physical state, aggregation of distributed twin knowledge, simulation or planning, decision support or control, security evaluation, and feedback and retraining (Jagannath et al., 2022).
3. Representation, synchronization, and evidence models
Synchronization is the technical core of SDT-aaS. In CPS security frameworks, the stated requirements are that the virtual twin must match the physical twin, the virtual twin must have enough data to simulate the physical twin, and the physical twin must have enough data and time to respond to virtual twin information (Zhao et al., 2022). The same framework proposes synchronizing only key states at a regular time slot, rather than all raw state data, so that the system can reduce network burden while preserving security usefulness. State machine replication is used to maintain consistency between physical and digital environments (Zhao et al., 2022).
EPICTWIN demonstrates a different synchronization pattern tailored to power-system security testing. The physical power system is simulated in MATLAB/Simulink running in real time on a Speedgoat real-time target, and its signals are passed via a data bus to the cyber side. The physical simulation produces process signals such as current, voltage, power, and frequency, and these are made available to IEDs and AMIs through a publisher-subscriber MQTT setup. The twin preserves the communication protocols of the original system, including IEC 61850 MMS for SCADA-PLC/IED interactions and GOOSE for time-critical IED-to-IED messages; OPC is used between SCADA and historian, and Modbus is also discussed as a candidate for the data bus (Kandasamy et al., 2021). The paper stresses that this explicit interface between the physical signal layer and the controllers makes the twin closer to a mirrored cyber-physical system than to a simple emulator.
In security-compliance-oriented SDT-aaS, synchronization extends beyond operational state to machine-readable evidence. The AMS collects artifacts such as crypto libraries, certificates, algorithms, OpenSSL settings, kernel security settings, logs, software projects, and dependencies, and the BOM Creator converts them into OWASP CycloneDX v1.6 artifacts: SBOMs, CBOMs, VEX, and BOM-Links. The implementation uses Eclipse Ditto and Web of Things (WoT) descriptions for the stored representation, while topology and profile data are mapped into MongoDB (Koufos et al., 9 Sep 2025). The SDT is thus positioned as a single source of truth for security compliance state, containing both static and dynamic information.
The automotive Cyber Digital Twin extends representation into binary-level software analysis. Its extracted artifacts include Hardware BoM, Network interfaces, SBoM, Operating system, OS settings, Kernel configuration, OS security configuration, Memory management and mapping, User credentials, Firewall configuration, Application frameworks, APIs, Application configuration, Encryption mechanisms and flows, Encryption keys, and Control and data flow graphs (Silva et al., 2021). This representation is then used for known-vulnerability matching, context-sensitive filtering, and requirements verification. The paper summarizes requirement fulfillment as
where vulnerabilities and weaknesses are traced back to requirements through CWE-based mappings (Silva et al., 2021).
4. Security functions and analytical modes
SDT-aaS supports a broader functional scope than simple mirroring. In the cloud-deployed digital twin virtualization framework, the twin supports online learning of a physical environment, real-time monitoring, event detection, predictive modeling, Monte Carlo heuristic search, on-policy reinforcement learning, off-policy reinforcement learning, policy exploration, and robustness assessment against attacks (Jagannath et al., 2022). The same work presents Zero Trust Architecture (ZTA) as a flagship security use case. In this formulation, successful authentication does not grant trust; instead, access decisions depend on a model of the security state of the entire network. The DT provides the needed real-time monitoring of users, devices, data, applications, and network environment, together with a security model, network interaction models, security analytics, an event detection engine, and a policy decision point (PDP) (Jagannath et al., 2022).
The same framework also introduces an adversarial twin assessment service. The adversarial twin uses virtual planes to simulate poisoning attacks, evasion attacks, extraction attacks, and inference attacks, identifies weakest links, and assesses the security of control processes (Jagannath et al., 2022). This makes adversarial robustness a property of the twin itself, not only of the protected physical system.
For Smart Critical Systems, Security Digital Twins are organized around Protection, Detection, Response, and Recovery across both Shift Left and Shift Right cybersecurity operations. The twin is intended to support early security testing, simulation, vulnerability identification, misconfiguration detection, threat modeling, runtime monitoring, intrusion detection and prevention, incident response, and recovery planning. The paper emphasizes hybrid intelligence, combining state-based behavioral models, ML-based security models, knowledge-based hybrid security models, semantic technologies, knowledge graphs, and LLM-assisted modeling (Mohsin et al., 2023).
Industrial control applications place special weight on process-aware attack simulation and intrusion detection. A digital twin-based security framework for ICS implements four classes of attack scenarios: command injection, network DoS, calculated measurement modification, and naive measurement modification. For calculated measurement modification, the paper gives the attack model
and then uses twin-generated labeled data to train and deploy a real-time IDS (Varghese et al., 2022). In CPS security frameworks more generally, state inconsistency between physical and digital domains is used to detect or stop Message Delete, Message Insert, Message Modify, and Message Replay attacks (Zhao et al., 2022).
Public-space DTaaSS broadens the function set further. Its intelligent service layer distinguishes single-entity services such as source analysis, visual analytics, NLP, open-space analytics, UAV detection, USV/UUV detection, mobile analytics, facial biometrics, and enclosed-space analytics from multi-entity services such as cyber threat detection, area monitoring, event detection, attack prediction, vulnerability assessment, and information sharing (Stefanidou et al., 2024).
5. Domain-specific instantiations and empirical observations
The electric-power domain provides one of the clearest research testbeds for SDT-aaS-like practice. EPICTWIN mirrors the EPIC test-bed’s four zones—generation, micro-grid, transmission, and smart home—while replacing hardware with software components hosted on a small number of general-purpose machines. Its security workflow includes the EpicSploit attack designer and launcher framework, enabling man-in-the-middle attacks that intercept control commands, modify status indications, and spoof measurement values so that SCADA reflects a false safe state. The system uses headless Ubuntu virtual machines, Docker containers for AMI meters, Open vSwitch, GRE tunnels, Node-RED, SQLite, Python, and MQTT. The authors report that with about 20 VMs they observed no visible latency issues from MQTT, and they argue that packet-sniffer traces are similar to those of the physical testbed because the same protocol stack is preserved (Kandasamy et al., 2021).
The industrial-control example is more quantitative. In the MiniCPS-based filling-plant twin, data were collected over 3 hours with process variables logged every 0.5 seconds, producing 2705 records: 1920 normal samples and 785 anomalous samples. The anomaly set comprised 434 calculated measurement modification, 227 naive measurement modification, 88 network DoS, and 36 command injection samples. Eight supervised classifiers were evaluated, and the stacked model obtained accuracy 0.927, precision 0.936, recall 0.862, and F1-score 0.894. The paper reports 0.1 seconds average latency for near real-time detection and notes that the IDS detects process-aware attacks that the rule-based SIEM correlation engine largely misses (Varghese et al., 2022).
The automotive CDT shows how SDT-aaS can serve continuous verification rather than live process monitoring. The approach was applied to about 100 automotive firmwares. For rich components, the paper reports ~150 libraries per firmware on average, ~600 detected CVEs per firmware, ~20 critical CVEs per firmware, ~80 unknown vulnerabilities per firmware, and ~10 high-severity unknown vulnerabilities per firmware. The most common publicly known vulnerabilities were in sqlite, and the most common unknown weaknesses were CWE-119, CWE-125, and CWE-338 (Silva et al., 2021). This demonstrates a service model centered on continuous re-analysis as firmware, vulnerability databases, and security requirements evolve.
The explicit SDT-aaS architecture for certification provides the most direct operational timings. In a validation topology, 50 SDT deployments yielded mean deployment time: 5.78 s, min: 5.61 s, and max: 5.96 s. In a moderate-scale SMB topology, again with 50 instantiations, the paper reports mean instantiation time: 5.86 s and median: 5.87 s. The larger twin took about 80 ms longer to instantiate than the lighter one, and the total storage footprint was only a few MB (Koufos et al., 9 Sep 2025). These results are presented as evidence that on-demand audit-oriented SDT instantiation can remain fast, stable, and lightweight.
Other domains are less benchmarked but structurally important. Public-space DTaaSS is presented through three scenario families—a bomb attack at a metro station, a hybrid USV/UUV and shooting attack at a leisure site, and a combined UAV and suicide attack at a cathedral square—but the paper does not report a deployed prototype, formal experimental comparison, or explicit mathematical vulnerability model (Stefanidou et al., 2024). In nuclear operations, the iFAN ecosystem combines UE5, the Generic Pressurized Water Reactor (GPWR) simulator, VR, RL/AI/ML pipelines, cybersecurity testbed integration, radiation simulation, and hardware-in-the-loop with real PLCs. Its HIL timing is explicit: GPWR runs with a 50 ms integration step, while the PLC runs a 100 Hz periodic task. The paper demonstrates a false data injection case in which a circulating water temperature sensor is changed from about 14.77°C to 200°C, with the abnormal state then reflected into the digital twin (Do et al., 27 Jan 2026).
6. Threat surfaces, limitations, and open directions
The threat surface of SDT-aaS is broader than conventional IT security because the twin, the data plane, the model plane, and the service plane can all be attacked. The IoDT survey organizes threats into seven dimensions: data, authentication, communication, privacy, trust, monetization, and cyber-physical threats. Its threat taxonomy includes data tampering, desynchronization of digital twins, model inconsistency attacks, semantic adversarial attacks, model poisoning, impersonation, unauthorized data access, rogue virtual assets, eavesdropping, message flooding, interest flooding, MITM, Sybil attack, DoS/DDoS, membership inference, knowledge/model inversion, and single point of failure (Wang et al., 2023). The industrial DT survey provides a parallel layered taxonomy of physical-level, digital- and communication-level, and HMI-level security issues, including operational software attacks, privilege escalation, rogue IIoT/CPS devices, rogue virtual resources, virtual resource tampering, privacy leakage, rogue HMIs, and visualization tampering (Zami et al., 2024).
A common misconception is that any security-oriented twin automatically constitutes SDT-aaS. The literature does not support that conclusion. Many systems are testbeds, conceptual frameworks, or scenario-driven architectures rather than complete service platforms. EPICTWIN explicitly remains a lab prototype rather than a fully managed hosted service and lacks explicit orchestration, billing, isolation, tenant separation, and API-based productization (Kandasamy et al., 2021). Public-space DTaaSS is largely architectural and scenario-driven, with no deployed prototype or benchmark metrics (Stefanidou et al., 2024). The CPS security framework is an early architectural precursor, not a full service-oriented system (Zhao et al., 2022). Surveys likewise note the absence of a unified security model, limited comparative evaluation, and unresolved orchestration for multi-tenant industrial environments (Zami et al., 2024).
Open directions recur across the corpus. They include scalable distributed security monitoring, high-fidelity interlinking models, privacy-preserving collaborative learning, ZTA integration, safe online planning and control, multi-service orchestration, and real-time verification before deployment (Jagannath et al., 2022). The IoDT survey highlights unresolved questions in cloud-edge-end orchestration, semantic security, decentralized trust management at scale, privacy-preserving analytics with utility guarantees, accountability and regulation, secure model delivery and update, physical-world resilience, and explainable AI for security decisions (Wang et al., 2023). Security Digital Twins for Smart Critical Systems add concerns about the security of Virtual Components, the security of the SDT itself, data curation, interoperability, and trustworthy AI (Mohsin et al., 2023). In compliance-oriented SDT-aaS, future work is stated for large-scale empirical evaluation, continuous resource-monitoring studies, and end-to-end automated verification using standards such as OSCAL (Koufos et al., 9 Sep 2025).
Standardization and governance remain central. The industrial survey cites ISO 23247 parts 1–4 for industrial digital twins and ISO/IEEE 11073 for healthcare-related standardization (Zami et al., 2024). A plausible implication is that mature SDT-aaS will depend not only on better analytics and synchronization, but also on interoperable evidence formats, lifecycle governance, and well-defined trust and policy boundaries across cloud, edge, and physical domains.