Securing Smart Cities with a Digital Twin: The Tartu Cyber Range 

A smart city runs on connection. Across transport, utilities and public services, sensors, operational technology and conventional IT are increasingly linked, and every connection that improves a service also widens the attack surface. Securing that surface means being able to test a city’s systems against realistic threats without disrupting the services its residents depend on.

A living testbed in Tartu

That is what CybExer set out to do in Tartu. Together with Auve Tech, the City of Tartu and the University of Tartu, the company brought its Smart City Cyber Range technology to bear on the resilience of a real urban ecosystem, adding a digital-twin element to the systems that city and municipality organisations, and the third parties operating alongside them, depend on.

Each partner brought a distinct piece. The University of Tartu supplied the digital twin of the city centre and its autonomous-driving research; the City of Tartu provided the municipal context and the systems a working city depends on; Auve Tech contributed its self-driving vehicle expertise; and CybExer brought the cyber range technology and the visualisation that tie the testing together.

The work took shape as an applied research project in 2023. It drew on a digital twin of the Tartu city centre that the University already maintained, and used cyber range technology to test the cybersecurity of smart-city solutions. The objectives were practical: to understand the cyber threats facing smart cities, to investigate the security of smart-city mobility solutions, to carry out security-architecture studies, and to model the cross-dependencies between systems, all while raising risk-management awareness across Estonia.

“Well-designed, sophisticated smart city solutions and preparedness for cyber threats and attacks are critical.”

Getter Kartau, Head of Data Management, City of Tartu

The mobility focus tied the project directly to the University of Tartu’s Autonomous Driving Lab, whose work on self-driving vehicles depends on exactly the kind of connected infrastructure a smart city provides.

“Future smart city solutions must undergo comprehensive analysis and testing.”

Tambet Matiisen, Tech Lead, University of Tartu Autonomous Driving Lab

Crucially, all of this happens on the digital twin, not the live city. A faithful replica can be attacked and stressed without exposing the systems Tartu’s residents rely on.

The role of the digital twin

At the centre of the approach is the digital twin, a virtual clone of a real system built from its data and simulation models to reproduce how it behaves in the real world. For a city, that means being able to analyse, monitor and test the systems residents depend on without any risk to the systems themselves. Digital twins come in two broad forms: exact replicas, used to study a single complex object in depth, and meaningful replicas, used to test many similar objects at once. A smart city needs both, because it is at once a collection of intricate individual systems and a dense web of repeated, connected components.

The technology is moving quickly. The global digital twin market is projected to grow to more than 250 billion dollars by 2032, driven in large part by exactly the kind of connected, safety-critical environments a smart city represents. Testing those environments before they go live, rather than after an incident, is becoming a mainstream expectation rather than a luxury.

How the Smart City Cyber Range works

The Smart City Cyber Range is a simulated environment that replicates the technologies, systems and tools a smart city runs on. It combines operational technology and Internet of Things systems with the standard IT infrastructure, the workstations, servers and networking equipment, that municipal teams and technology providers work with every day.

A distinctive part of the platform is its visualisation. CybExer’s smart-city layer in the Integrated Scoring and Awareness (ISA) tool gives participants real-time feedback on the status of the IT systems in the range, and shows how they interconnect on a geospatial map. Around that, digital twins let a range of stakeholders, from city and municipality organisations to traffic and public-transport operators and critical infrastructure companies, rehearse against realistic scenarios without touching live systems.

Because the environment is virtual, training modules can be reused and replicated as often as needed, without touching the city’s live networks. Teams can rerun a scenario after making a change, compare approaches, or introduce a new class of attack, building the kind of repeatable practice that turns a one-off assessment into a habit of readiness.

CybExer’s smart-city visualisation layer maps connected systems on a geospatial view.

The case for a smart-city cyber range

The need is growing quickly. There are around 170 projects developing smart cities across the European Union, and the global market is projected to be worth well over 160 billion dollars by 2028. That expansion brings enormous benefits, but it also multiplies the ways a city can be attacked, and the consequences reach into daily life in a way that few other systems do.

A cyber range answers that in three ways. It lets cities experiment with new technologies in a secure, isolated setting before deployment. It helps teams optimise their security processes, testing how quickly incident-response systems trigger and how people react. And it builds confidence among the teams responsible for deploying smart-city solutions, so that new services can be introduced with a clearer understanding of their risks.

Connected mobility and safety

Connected mobility shows why this matters in the most tangible way. Autonomous vehicles, traffic-management systems and public transport all rely on the same connected infrastructure, and a failure there is not an abstract data breach but a safety issue on the road. Testing those systems in a digital twin, where a fault causes nothing worse than a lesson, is how a city can adopt them responsibly. It is no coincidence that Tartu’s project brought the city, its university’s autonomous-driving researchers and a self-driving vehicle company to the same table.

Estonia is a fitting place for the work. As one of the world’s most digitised societies, it has both the connected infrastructure that makes a smart city real and the instinct to secure it early, and Tartu, its second city and a university hub, offered a compact, genuine environment in which to prove the approach.

For Tartu, the value is concrete: a way to understand and strengthen the cybersecurity of the systems its residents rely on, using a faithful replica rather than the city itself. For the wider field, it is a model others can follow, showing how a digital twin, a cyber range and a willing city can come together to help make security part of smart-city design rather than a lesson learned after an incident.

A model for safer smart cities

Smart cities can only succeed when the systems behind them are secure and dependable. The Tartu project shows how cities can build that confidence by testing connected urban systems against realistic threats in a digital-twin environment. By bringing together the city, the University of Tartu and technology partners, it provides a practical, repeatable model for addressing risks before they affect live services.