OT Security Solutions and IoT Security Services

ICS & SCADA
Medical devices
Field & branch
Building systems

In plain terms

Factories, hospitals and utilities run equipment that cannot be switched off, cannot be updated on your schedule, and would break if you scanned it. We secure those environments by watching the network silently rather than touching the equipment, and by controlling what each machine is allowed to talk to.

Operational technology breaks every assumption IT security is built on. You cannot reboot it, you cannot patch it this quarter, and the vendor voids the warranty if you touch it. Security has to be designed around those constraints, not in spite of them.

Why IT playbooks fail on OT

	IT estate	OT / IoT estate
Priority order	Confidentiality first	Availability and safety first
Patch cycle	Weeks	Years, in a scheduled outage window, if at all
Asset lifetime	3–5 years	15–25 years
Agent support	Assumed	Rare, and often contractually prohibited
Failure cost	Data loss	Physical consequence

An agent-first vendor will quote you a rollout that cannot legally be installed on half your plant. The work is passive discovery, network-level enforcement and compensating control.

What we do instead

Passive asset discovery

Mapping what is actually on the network by observing traffic, never by scanning. Active scanning has knocked over PLCs and infusion pumps in the field, and an unexpected probe on a safety system is an incident in its own right.

Protocol-aware monitoring

Detection built for Modbus, DNP3, BACnet, PROFINET and the proprietary protocols your vendors ship, so an anomalous setpoint change is visible as an anomalous setpoint change — not as unclassified TCP.

Segmentation as the primary control

Where the device cannot be secured, the network around it is. Cell-level segmentation, strict conduits between zones, and enforcement in the switch and router rather than on an endpoint that cannot host software.

Compensating controls for the unpatchable

A documented, defensible position for every device that cannot be remediated — what the risk is, what control offsets it, and what evidence supports that for an auditor.

Environments we build for

Industrial control and SCADA — utilities, water, manufacturing
Medical equipment and connected clinical devices
Branch routers and ruggedised field hardware
Building management, access control and surveillance
Satellite and remote telemetry systems

Sensor placement and the receive-only rule

Receive-only at the physical layer, not merely by configuration. On a process network that distinction is the whole safety argument.

Discovery on an OT network is passive without exception. An active scan has knocked over PLCs, infusion pumps and building controllers in documented field incidents. Our capture interfaces are receive-only at the physical layer — an optical TAP with no transmit fiber, or a SPAN port on a switch where the sensor's NIC has its transmit pair physically unconnected. Configuration can be changed by mistake; a missing transmitter cannot.

Protocol coverage

Protocol	Typical environment	What we decode	Built-in security
Modbus TCP	Manufacturing, water	Function codes, register writes, coil forcing	None — no authentication at all
DNP3	Electric, water utilities	Object changes, control relay output, unsolicited responses	Optional (Secure Authentication v5), rarely enabled
BACnet	Building management	Property writes, priority array manipulation	Minimal
PROFINET	Discrete manufacturing	Cyclic data, alarms, config changes	None in common profiles
EtherNet/IP (CIP)	Rockwell estates	Tag reads and writes, firmware upload	Minimal
IEC 61850	Substations	GOOSE, MMS, sampled values	Optional, seldom deployed

The pattern is uniform: these protocols assume a physically protected network. That assumption is why segmentation, not endpoint hardening, is the primary control in OT.

Worked example — regional water utility, 14 sites

Starting position: SCADA supervisory network bridged to corporate at three sites for reporting convenience. No inventory. Engineering laptops moved physically between sites and plugged into both networks. One site still used a dial-up modem for out-of-hours vendor access.

Weeks 1–4, passive discoveryTAPs at each site. Discovered 1,847 devices against an expected 1,100 — the gap was mostly building systems, cameras and three forgotten engineering workstations with domain credentials cached.
Weeks 4–8, baselineA full production cycle observed, including a seasonal demand peak. Industrial traffic is highly repetitive, which makes the baseline genuinely tight — far more so than any IT network.
Week 9, the finding that matteredThe dial-up modem was answering. It had been assumed decommissioned for six years. It was the first thing disconnected, and it cost nothing.
Weeks 10–16, conduit designIT/OT boundary defined per site with a broker in a DMZ. Reporting traffic reversed from pull to push, so the corporate side never initiates a connection into the process network.
Weeks 17–24, enforcementImplemented site by site during scheduled outages, with the operations team present and rollback rehearsed at each. Two sites required a second window when undocumented vendor traffic surfaced — which is why the observation phase exists and why we schedule contingency windows from the start.
OngoingEngineering laptops issued as dedicated, hardened, single-network devices. The shared-laptop practice was the most likely bridge for a real intrusion and the hardest change to sell, because it made a technician's day slower.

The honest constraint list

What we could not fix at that utility

Roughly 240 controllers cannot be patched, will not be replaced within the decade, and speak unauthenticated protocols. No product changes that. What changed is that they now sit behind enforced conduits, are monitored for any deviation from a tight baseline, and each has a documented compensating control and named risk owner. That is the achievable outcome, and any vendor promising more is describing a different plant than the one you operate.

IoT, OT & SCADA Security