- Home
- Architecture & Hardening
- OT & ICS security
Securing the systems that move, heat and manufacture,
without touching what keeps them running.
Passive asset discovery, protocol-aware monitoring, IT/OT segmentation review, safe assessment of systems that cannot be rebooted, and incident response planned around plant safety and uptime.
OT is not IT with older computers.
In a plant, a pipeline, a mine or a substation, availability and safety come before everything else. A scan that is routine on an office network can stall a PLC, trip a process or put people at risk. Most IT security teams know this, which is why OT environments often go unassessed for years.
We start passive. We listen to the traffic your control network already carries, identify every asset and protocol from that traffic, and find the paths between IT and OT that nobody documented. Active testing happens only where it is safe, agreed with your control engineers, and scheduled around your operations. When we recommend a change, we say what it costs in uptime as well as what it buys in risk.
Energy, utilities, water, mining, manufacturing and transport operators are being targeted by both ransomware crews and state actors. Ransomware does not need to reach a controller to stop production; it only needs to reach the systems the plant depends on. Segmentation and detection at the IT/OT boundary are where most of the risk is reduced.
- A passive asset inventory of controllers, HMIs, historians, engineering workstations and network gear
- A protocol map, with insecure and unauthenticated industrial protocols flagged
- An IT/OT segmentation review, including the remote and vendor access paths that bridge them
- A vulnerability assessment of OT assets, done without disrupting production
- An OT incident response plan and joint IT/OT playbooks built around plant safety
- A risk-ranked remediation roadmap aligned to IEC 62443, with compensating controls where patching is not possible
Listen first. Touch only what is safe.
Agree the rules of engagement
We sit down with operations and control engineers first. Safety-critical systems, change windows and hands-off zones are agreed in writing before anything is connected.
Passive discovery
A passive sensor on a span or mirror port reads existing traffic. Assets, firmware, protocols and communication paths are identified without sending a single packet to a controller.
Architecture and access review
We review zones and conduits, the IT/OT DMZ, remote access, vendor connections and the places the network is bridged that nobody expected.
Safe assessment
Vulnerabilities are identified from passive data, configuration review and, only where agreed, carefully controlled active checks in maintenance windows or on test systems.
Plan for the bad day
Joint IT/OT incident response playbooks and tabletop exercises with your control engineers, so containment decisions protect people and the process, not just the network.
Monitor
Protocol-aware monitoring can feed MSOC, with response guardrails so automated actions never isolate a system the plant depends on.
Mapped to the frameworks that apply to you.
We assess and report against the standards your regulator, insurer or parent company already uses, so the findings plug into work you are already doing.
| Framework | Who it applies to | What we help with |
|---|---|---|
| IEC 62443 | Industrial automation and control systems, asset owners and integrators | Zones and conduits, security level targets, gap assessment and remediation planning |
| NCA OTCC | Operators of operational technology in Saudi Arabia within NCA scope | Control mapping, gap assessment and evidence preparation |
| UAE IA Regulation | UAE government entities and critical infrastructure operators, where relevant | Security management programme review and gap assessment |
| NIST SP 800-82 | Any operator using it as an OT security reference | Control baseline review and architecture guidance |
How we work on live operations.
No scanning controllers
We do not run network scanners against PLCs, RTUs or safety systems in production. Discovery is passive by default.
Engineers in the room
Every active step is agreed with your control engineers and run inside your change process and maintenance windows.
Compensating controls
Where a system cannot be patched or rebooted, we design segmentation, access control and monitoring around it instead.
Safe response
Response playbooks put people and process safety ahead of containment speed, and set guardrails on any automated action.
Who it is for
Operators in energy, utilities, water, mining, manufacturing and transport. Especially those whose OT network has grown through projects and vendors, and who need an accurate picture of it before a regulator, insurer or attacker draws one for them.
- MSOC, round-the-clock monitoring with OT-safe guardrails
- Compromise assessment, find out if someone is already on the IT side
- Network segmentation, design the IT/OT boundary properly
- Center of Excellence, build OT security capability in-house
From real engagements.
Guardrails held on a noisy day
Noisy triggers in a critical-infrastructure environment would have led a conventional playbook to auto-isolate a domain controller and a firewall. MSOC response guardrails prevented it.
Client identities withheld pending permission. Named references and logos available on request.
What buyers ask.
Our plant network is air-gapped.
In our experience it is usually bridged somewhere: a vendor remote-access link, a historian connection, a dual-homed engineering laptop. Passive discovery finds those paths without touching anything.
Scanning could take down production.
Which is why we do not scan controllers in production. Discovery is passive, and any active check is agreed with your engineers and run in a maintenance window or on a test system.
We cannot patch these systems.
Many OT systems cannot be patched for years. We design compensating controls instead: segmentation, tighter access, and monitoring around the systems that have to stay as they are.
Do our IT and OT teams both need to be involved?
Yes. OT incidents need both. We bring the two together in the assessment and in joint playbooks and exercises, so the first time they work together is not during an incident.
Which standard should we follow?
That depends on your sector and regulator. IEC 62443 is the broad reference for industrial control systems; NCA OTCC applies to in-scope operators in Saudi Arabia, and the UAE IA Regulation to UAE government and critical infrastructure. We map findings to whichever ones apply to you.
See your OT network without touching it.
Put an engineer on a call to scope a passive OT assessment. No charge, no commitment.