Thesis Work - Generative AI for Scenario and Injection Design in IT/OT Cybersecurity Exercises

Description

You are a student nearing the end of your studies who wants to apply what you have learned to practical problems in the energy sector. You would work close to the business, alongside experienced specialists, on challenges where your ideas can make a difference.

The thesis sits within the corporate security and resilience function. This unit is modern, flexible and agile, works in a demanding and fast-changing setting, and builds security and resilience into all business operations through a holistic, risk-based approach.

Tabletop and functional cybersecurity exercises help organisations stay resilient, especially critical infrastructure operators whose IT and OT environments are connected. Their value depends on how realistic, technically accurate and relevant the scenario and its injects (alerts, emails, media reports, decision points) are.

Writing scenarios and injects by hand takes time and effort. Planners must combine many variables into a sequence that feels credible to both IT and OT participants. Generative AI and large language models can help with scenarios, structured content and role-based dialogue, and agentic capabilities could let exercises adapt by proposing later injects.

The thesis is qualitative. It asks how generative AI can support both the design and the adaptive running of IT/OT exercises, and it builds a conceptual framework and workflow specification for AI-assisted exercise design. Expert review and walkthroughs will test their fit with real IT/OT environments.

Responsibilities

• Develop an academic framework for generative AI assisted scenario and inject design.
• Build a small library of reviewed example artifacts that illustrate the framework.
• Document a workflow covering source preparation, scenario generation, state tracking, adaptive inject selection, human approval and debrief support.
• Create a limited demonstrator or simulation showing how participant decisions can change later injects and scenario outcomes.
• Report on expert review, including the risk factors and likely adoption issues the experts foresee.

Requirements

• You are about to complete your academic studies and want to apply your knowledge in a real setting.
• You share the company's values: Active, Open, Positive and Safety.
• You study computer science or software engineering.
• You write and speak English fluently, since the thesis is conducted in English.
• The thesis is worth 30 credits at master's level.

Conditions

The project is for a team of 2 students.

Start date is 2027-01-11 or by agreement.

Location is Göteborg or Stockholm.

Application deadline is 2026-11-18.

Contact person and supervisor is Elpidoforos Arapantonis.