With the continuous acceleration of coal mine intelligentization and informatization, industrial control systems (ICS) are increasingly confronted with complex cybersecurity threats, particularly the emergence of high-frequency and large-scale cyberattacks as a prominent challenge. Traditional protection schemes often rely on hardware-based detection devices and passive defense mechanisms; however, they commonly suffer from significant drawbacks such as strong intrusiveness, delayed responsiveness, and insufficient traceability. These limitations make it difficult to satisfy the stringent security requirements of coal mine ICS, where both real-time performance and operational stability are equally critical. Against this backdrop, digital twin technology, with its unique capabilities of virtual-physical mapping and synchronized interaction, provides a novel approach to enhancing cybersecurity in coal mine networks. This paper first reviews the current security landscape of coal mine ICS and, in light of recent advances in digital twin models, analyzes their potential applications in cybersecurity. An experimental system is then constructed on the OpenPLC platform, and empirical tests are conducted to assess the security vulnerabilities of the Modbus protocol, thereby validating the effectiveness of digital twin technology in offensive–defensive security scenarios. Finally, the study further explores the practical implementation challenges and future development directions of digital twin applications in coal mine contexts.