OT and ICS security
Visibility and segmentation for plant networks, designed around IEC 62443 zones and conduits.
01 · Build
What we build
A plant network often runs flat, with controllers that cannot be patched and vendors who connect from anywhere.
- Passive inventory of PLCs, HMIs and drives, built from network traffic
- Zeek and Suricata monitoring with Modbus, DNP3, S7comm and OPC UA parsers
- Zone and conduit models, with firewall rules generated from them
- Vendor remote access that is recorded and limited by time
- Alerts sent to your SIEM, mapped to MITRE ATT&CK for ICS
- Control evidence mapped to IEC 62443-3-3 system requirements
02 · Demo · sample data
Try it live.
A working sample with made-up data. It runs in your browser; nothing is sent anywhere.
- Plant 1, cells A-D, passive capture
- Asset inventory
- Unknown devices
- Zone boundaries
- PLC program changes
- Vendor remote access
03 · Features
What it does well
- 01
Passive by default
Discovery listens on a mirror port; nothing is sent to controllers on a live network.
- 02
Protocol awareness
A write to a PLC register or a firmware download is seen as what it is, not as bytes.
- 03
Baseline of normal
Which device talks to which, and how, is learnt per cell so a new conversation stands out.
- 04
Zones as data
Zones and conduits live in one model, and firewall rules are generated and checked from it.
- 05
Recorded sessions
Vendor access opens for an agreed window, through one gateway, and every session is recorded.
- 06
One alert queue
Plant alerts reach the same SIEM and on-call rota as IT alerts, with plant context attached.
04 · FAQ
Questions
Will monitoring disturb our controllers?
No. Monitoring reads a copy of the traffic from a switch mirror port or a network tap and sends nothing to the plant network. Any active query of a device is done only with your engineers present, in a maintenance window agreed in writing.
We cannot patch our PLCs. What then?
Most plants cannot patch quickly, so the protection goes around the device: segmentation that limits who can reach it, monitoring that sees unusual writes or downloads, and access that is recorded. Patching is planned with the vendor and your maintenance windows.
Does this make us IEC 62443 certified?
No. Certification is issued by an accredited body. We design and build to the standard and map each control to the IEC 62443-3-3 requirement it supports, so your own assessment or an auditor has the evidence in one place.
05 · Services
Services that go with it
- ServiceOT security assessmentA risk assessment of your plant networks to IEC 62443-3-2, with zones, target security levels and a fix plan.
- ServiceSecurity hardeningServers, cloud accounts, devices and apps locked down against a recognised benchmark, with every change recorded.
- ServiceManaged securityDefensive monitoring of your systems, with alerts triaged and incidents contained by people who know your setup.
06 · Software
Related software
- SoftwareNetwork securityFirewalls, segments and remote access managed as code, with traffic visibility to prove the rules work.
- SoftwareSIEM and SOC softwareOne place where security logs land, get correlated and turn into alerts your analysts can act on.
- SoftwarePLC and SCADAControl logic, operator screens and plant data links, from the PLC to the historian and the MES.
- SoftwareManufacturing softwareShop-floor systems that connect machines, work orders, quality checks and stock to show production as it happens.