Passive first
We build an asset inventory and protocol map from traffic captured on a mirror (SPAN) port. Nothing is sent to the network in this phase.
OT and industrial security
Security assessment without disrupting production
PLCs, HMIs, engineering workstations, OPC UA and Modbus networks. We first understand how the plant works, and only then touch anything.
Principles
Active testing only under control
In a test environment, on redundant equipment or in a maintenance window, together with operations and with separate written OT authorisation.
In the language of the plant
Risk is expressed in production, safety and compliance impact, and recommendations are ranked by effort.
Services
Industrial control systems assessed without disrupting production, following IEC 62443 and NIST SP 800-82.
OT security baseline assessment
Interviews, documentation and passive traffic analysis: asset inventory, protocol map, Purdue levels, IT/OT boundary, remote access.
per site
OT penetration test (active, controlled)
In a test environment or maintenance window, with written OT authorisation: engineering workstation, HMI, PLC access, OPC UA.
custom scope
OT segmentation design and validation
Zones and conduits, DMZ, secure remote maintenance, then verification that traffic really is blocked.
per site
OT security training for plant staff
2 × 45 minutes on site.
per session
Typical findings
- Missing or porous segmentation between office and industrial networks
- Unauthenticated industrial protocols (Modbus, S7) reachable from the office network
- OPC UA servers without a security mode or certificate validation
- Default passwords on PLCs, HMIs and switches
- Uncontrolled remote access for maintenance partners
- Outdated firmware and operating systems on engineering workstations
What you receive
- Asset inventory and network map by Purdue level
- Executive summary with production and safety impact
- Technical findings with evidence and recommendations
- Risk matrix and prioritised action plan
- Proposed zone and conduit design per IEC 62443