Brazil Tests Nuclear Cybersecurity in Large-Scale Cyber Guardian Exercise with IAEA

The IAEA has supported Cyber Guardian since its first edition in 2018, helping Brazil strengthen its ability to prevent, detect and respond to cyberthreats against nuclear facilities and nuclear and other radioactive material.

Brazil tested its ability to respond to cyberthreats against critical infrastructure during Cyber Guardian, a national exercise supported by the International Atomic Energy Agency (IAEA), with scenarios covering nuclear power plants, cancer treatment facilities and the maritime transport of floating small modular reactors (SMRs).

Held from 21 to 25 September, the exercise focused on computer security across the nuclear sector and essential services including energy, water, communications and transport, bringing together public and private organizations responsible for keeping these systems operating. Around 4,000 participants from 380 national institutions took part, including nearly 1,300 attending in person in Brasilia and at regional hubs in Belém, Curitiba, Manaus, Recife, Rio de Janeiro and São Paulo.

Simulations test responses to nuclear cyber risks

The annual exercise combined virtual simulations with crisis management practices, giving participating organizations opportunities to coordinate across agencies, develop technical response skills and assess how essential services could withstand complex cyber incidents.

IAEA information and computer security training tools, including simulated environments, helped recreate attacks targeting information technology and operational technology networks, allowing participants to examine threats in realistic exercise conditions.

Scenarios addressed cyber risks affecting nuclear power plants, SMRs, applications of artificial intelligence, hospitals using radioactive sources and nuclear activities at sea, reflecting the range of settings in which computer security can affect nuclear security.

Rafael de Oliveira Faria, Computer Security Coordinator at Brazil's National Nuclear Safety and Security Authority, said organizations representing the nuclear sector had assessed their experience positively, with the variety and novelty of the scenarios helping engage participants.

He described IAEA support as essential to improving the exercise, pointing to the agency's tools, methodologies and expertise as resources for the continued development of scenarios.

IAEA support builds on cooperation since 2018

The IAEA has supported Cyber Guardian since its first edition in 2018, helping Brazil strengthen its ability to prevent, detect and respond to cyberthreats against nuclear facilities and nuclear and other radioactive material.

Elena Buglova, Director of the IAEA's Division of Nuclear Security, said raising awareness of cyberthreats and their potential consequences for nuclear security, together with improving countries' response capabilities, forms a key part of the agency's nuclear security programme.

The exercise brought together national stakeholders with nuclear security responsibilities, creating opportunities for public and private institutions to practise cooperation during incidents that could affect several organizations and essential services.

The agency's wider assistance includes guidance, training, expert support and international cooperation, helping countries build sustainable computer security capabilities as threats to nuclear facilities and activities evolve.

Training platforms expand practical security skills

IAEA virtual training platforms and simulators give practitioners opportunities to develop practical skills and prepare for real-world cyberthreats, supporting information and computer security training activities, including those delivered at its Nuclear Security and Training Demonstration Centre.

Self-paced courses covering the main concepts and principles of information and computer security are available through the IAEA's Learning Management System in all six official United Nations languages.

Brazil's Nuclear and Energy Research Institute became Latin America's first IAEA Collaborating Centre for nuclear security in 2024, joining a group of four centres worldwide specializing in information and computer security, with the other three located in Austria, Canada and France.