Thesis Work - Generative AI for Scenario and Injection Design in IT/OT Cybersecurity Exercises

Are you a student looking to apply your knowledge to real-world solutions that support the energy transition? With us, you will have the opportunity to complete your thesis project close to the business, working alongside experienced specialists and tackling challenges where your ideas and perspectives can make a real difference.

About the Thesis Work

The Thesis will be held under Corporate Security & Resilience function at Vattenfall which is a modern, flexible, and agile unit that is operating in a challenging and rapidly changing environment. We strive to embed security & resilience into all our business operations and we apply a holistic and risk-based approach to constantly adopt and improve our security posture.

Background and Scope

Cybersecurity exercises, including tabletop exercises and functional exercises are an important part of organizational resilience, particularly for critical infrastructure operators where information technology (IT) and operational technology (OT) environments are interconnected. The effectiveness of such exercises depends on the realism, technical accuracy, and relevance of the scenario and its supporting injects (alerts, emails, media reports, decision points).

However, developing scenarios and injects is often manual and resource intensive activity. Exercise planners must translate and combine multiple variables into a sequence that is credible for both IT and OT participants. Generative AI and large language models can support on scenario development, structured content generation and role-based dialogues, while agentic capabilities can enable more adaptive exercises by proposing subsequent injects.

The thesis will investigate how generative AI can support both the design and adaptive facilitation of IT/OT cybersecurity exercises. The thesis will follow a qualitative approach, focusing on the development of a conceptual framework and workflow specification for AI assisted exercise design. The proposed framework and workflow will be evaluated through expert review and walkthroughs with focus on real world applicability and relevance for IT/OT cybersecurity environments.

The thesis is expected to deliver:

• An academic framework for generative AI assisted scenarios and injection design;
• A small library of reviewed example artifacts demonstrating the framework;
• A documented workflow covering source preparation, scenario generation, state tracking, adaptive inject selection, human approval and debrief support.
• A limited demonstrator or simulation showing how participant decisions can change subsequent injects and scenario outcomes.
• Output and summary of experts after review where they will analyze the risk factors and the possible adoption issue that they foresee.

This thesis project is for 2 students.

We are looking for students who are about to complete their academic studies and are eager to apply their knowledge in a real-world setting through a thesis project at Vattenfall. You are someone who shares our values and identifies with our principles: Active, Open, Positive and Safety.

Furthermore, we see that you have: 

• Education - Computer Science, Software Engineering
• Fluency in written and spoken English as the thesis project will be in English

Scope: 30 credits (M.Sc Level)

• Start date: 2027-01-11 or by agreement.
• Location: Göteborg or Stockholm
• Application – Submit a single file containing your CV and a copy of your academic transcripts. Please note that only one file can be uploaded with your application, so it is important that all required information is combined into the same document.
• Application deadline: 2026-11-18
• Contact person and supervisor at Vattenfall: Elpidoforos Arapantonis, elpidoforos.arapantonis@vattenfall.com, +46 70 284 19 86

Diversity and Inclusion – In Everything We Do

At Vattenfall, we value being Active, Positive, Open, and Safety-conscious. We are looking for employees who share our vision and can contribute to strengthening our company culture. We believe that diversity helps build a more successful and attractive company, and we strive to be role models in diversity and inclusion. Vattenfall actively works to ensure that all employees have equal opportunities and rights, regardless of age, ethnic or cultural background, gender identity, religion or belief, sexual orientation, or disability. Read more about how we work with diversity and inclusion here.

Vattenfall is part of Sweden’s critical infrastructure, and many of our positions are therefore classified from a security perspective. If this position is security-classified, a security screening will be conducted prior to employment in accordance with the Swedish Security Protection Act.

Vattenfall is a leading European energy company serving approximately 12 million customers and employing around 21,000 people. We believe there is a way to build a future where everyone can choose fossil-free ways to move, make, and live.