What a first-year OTCogniShield pilot includes
Episode 06 — The pilot in practice

[00:00:00.000] Welcome back. I am Sam Armstrong. This episode explains preparation, observation, engineering review and acceptance for an OTCogniShield pilot.

[00:00:10.983] We will explain the initial design-partner programme, optional first-year commercial packages, and products to follow, including local AI and IIoTCogniShield.

[00:00:22.371] The scope, safeguards, deliverables and costs belong in a written agreement before work starts. The episode closes with a practical checklist for that conversation.

[00:00:34.658] The current initial design-partner programme offers the agreed pilot deliverables and founder-led consulting at no charge, subject to suitability and written scope.

[00:00:46.092] The pilot timetable follows the factory’s needs. The website describes a typical observation period of around two to four weeks, followed by review and reporting.

[00:00:57.033] A free initial pilot is not a year of free service. Any paid continuation is a separate proposal, with no automatic conversion to a subscription.

[00:01:08.959] Start with one production area and a named plant lead. Explain what you want to understand, such as asset visibility, supplier access or customer evidence needs.

[00:01:20.210] Agree the included systems, collection points, observation window and exclusions. Identify shared services and equipment outside the proposed feed.

[00:01:30.826] Write measurable acceptance criteria before connection. Agree which records will demonstrate a useful result and who will review them.

[00:01:41.550] Your team provides a plant contact who understands operations, an authorised traffic source and enough context to review the observed assets and relationships.

[00:01:52.259] Name the network owner, controls reviewer and people who can approve installation and data handling. Agree who may pause or stop the evaluation.

[00:02:02.171] The proposal should allocate appliance preparation, feed configuration, access arrangements, site work and acceptance tasks. Do not leave those responsibilities implied.

[00:02:14.967] An approved recorded packet capture can be the starting point. Record where, when and how it was collected, and preserve its observation dates.

[00:02:24.655] A live evaluation uses an approved switch mirror or suitable network TAP only after readiness checks, site approval and the agreed installation arrangements.

[00:02:35.224] The passive observation scope uses no endpoint agents or active discovery scans across production equipment. Verify the collection arrangement against the approved design.

[00:02:48.036] Before sharing captures or site information, agree the data-handling plan: collection source, authorised people, management access, storage, retention and backup.

[00:02:59.414] Record the update-transfer route and any separately authorised export or support access. An appliance intended to remain offline still needs a clear support arrangement.

[00:03:10.879] An initial enquiry needs only a high-level introduction. Agree the secure exchange method before providing detailed network information or captures.

[00:03:22.712] Confirm the physical ports, interface roles, power, management access and approved observation feed. Review any switch configuration or installation work with its owner.

[00:03:34.425] Agree a suitable change window where needed, the pre-connection baseline and the checks to confirm that production and collection behave as expected.

[00:03:44.145] Passive analysis does not remove installation risk. Record an immediate stop procedure, who invokes it and the agreed recovery or removal steps.

[00:03:55.925] Observe the activity available through the agreed feed. Include representative production conditions where authorised, and note activities that were not observed.

[00:04:06.609] Check collection freshness, available loss indicators and processing health. A quiet dashboard may reflect a visibility gap rather than a quiet factory.

[00:04:17.421] The baseline covers communicating devices and interpretable traffic in scope. Keep silent equipment, encrypted detail, unsupported protocols and uncertain identities explicit.

[00:04:31.047] Review the developing asset and relationship view with the people who understand the plant. Compare it with drawings, maintenance records and operational knowledge.

[00:04:41.735] Separate directly observed details from inferred identities or roles. Record who confirmed each important statement and what evidence they used.

[00:04:51.920] Turn disagreements into assigned questions. Keep findings, relevant operational consequences and practical next actions in a reviewable record.

[00:05:03.552] The agreed pilot deliverables include an IEC 62443-3-2 aligned risk assessment, scoped with the plant team and linked to relevant threat scenarios and operational consequences.

[00:05:17.122] Record the risk method, existing controls, uncertainties, treatment decisions and responsible owners. The asset owner remains involved in reviewing and approving the relevant decisions.

[00:05:29.657] The assurance-readiness summary identifies evidence gaps for applicable customer or assurance discussions. It does not award certification or determine legal compliance.

[00:05:42.654] At acceptance, compare observed devices with the agreed reference list, inspect expected protocol records and keep unsupported or missing information visible.

[00:05:53.738] Trace a known capture through processing into the workspace. Check original observation times, agreed freshness indicators, restart behaviour and the stop procedure.

[00:06:04.933] Review exported evidence for scope, dates, owners and limitations. Live capture, isolation, detection coverage and performance need their own acceptance evidence.

[00:06:17.579] The handover brings together the agreed asset and relationship baseline, risk-assessment outputs, assurance-readiness findings and final recommendations.

[00:06:27.963] Hold a joint review against the original success criteria. Record accepted results, unresolved gaps, any exclusions and the people taking responsibility for next actions.

[00:06:40.118] The platform is in pre-launch validation. A controlled pilot evaluates the scoped installation; synthetic demonstrations or unrelated engineering checks do not establish factory performance.

[00:06:54.441] For the current initial cohort, there is no charge for the agreed OTCogniShield pilot deliverables or founder-led consulting time.

[00:07:03.956] Customer-side infrastructure, access arrangements or third-party costs can still arise. Identify those before acceptance rather than assuming the whole exercise has no external costs.

[00:07:16.666] Agree the hardware loan, installation responsibilities, return arrangements and data exit plan in writing. A no-charge pilot does not imply a free hardware purchase.

[00:07:29.294] For an optional paid first year, the current indicative Core price is £3,500 annually, plus £1,500 for the one-off appliance purchase.

[00:07:40.855] Core covers one agreed site and appliance, the contracted local monitoring, risk and evidence workflows, standard report templates and controlled offline update entitlement.

[00:07:52.738] It includes up to six hours of remote platform support per subscription year. Operation is customer managed, and capacity, retention and collection scope are confirmed in the proposal.

[00:08:06.234] The proposed Supported package is £6,995 annually, plus the £1,500 appliance purchase. Availability, final scope and pricing are confirmed before order.

[00:08:20.021] Supported includes Core, with twelve remote support hours replacing Core’s six. It adds four scheduled remote engineering reviews of up to one hour each.

[00:08:30.428] It also adds one annual operator refresher of up to two hours. The four reviews and refresher are additional to the twelve support hours.

[00:08:41.150] Core is £5,000 in year one: the £3,500 annual package plus the £1,500 appliance. Deployment, travel and any applicable VAT are additional.

[00:08:54.885] Supported is £8,495 in year one: the £6,995 annual package plus the £1,500 appliance, before those separately quoted costs.

[00:09:08.939] Supported includes Core; there is no second Core charge. These are indicative pilot-offer figures from the current website copy, not a quotation for every site.

[00:09:20.916] Deployment is quoted separately for the work required: planning, appliance preparation, agreed passive-feed checks, an operator walkthrough, documentation and acceptance checks.

[00:09:32.831] Remote or on-site delivery is agreed before work begins. Installation, site visits, travel and network changes sit outside subscription allowances unless included in writing.

[00:09:45.559] Bespoke reports, integrations, custom development and additional engineering also need agreed scope and an approved quotation. Ask for an itemised first-year proposal.

[00:09:58.582] The published support arrangement is email during agreed UK business hours. Included hours cover diagnosis and agreed assistance, rather than a guaranteed resolution time.

[00:10:10.561] Annual allowances do not roll over. Additional work requires an approved quotation, and scheduled reviews should have an agreed purpose, evidence set and next actions.

[00:10:21.722] The packages do not include a managed security operations centre, twenty-four-hour monitoring, emergency incident response, certification or safety-system changes. Arrange specialist services separately if required.

[00:10:37.614] The selected annual package is the recurring component; the appliance purchase is one-off. Owning the hardware does not provide a perpetual Core licence.

[00:10:48.000] The website’s commercial and expiry arrangements are proposed terms pending review and implementation acceptance. Confirm renewal delivery, evidence access, support and update rights in the written agreement.

[00:11:01.314] Do not assume free continuing updates, an unlimited support entitlement or a particular expiry behaviour. The accepted agreement and validated supplied arrangements govern the deployment.

[00:11:14.967] The first-year plan starts with preparation, observation and the joint pilot decision. It does not automatically commit the factory to an annual service.

[00:11:25.626] If a paid package is selected, schedule the agreed support and engineering activity, update arrangements, operational responsibilities and review points for that term.

[00:11:36.687] Supported’s scheduled reviews and refresher belong to that purchased package. Keep renewal planning, outstanding actions and any additional work visible before the term ends.

[00:11:49.112] After the initial pilot, your team can request a separate commercial proposal or end the evaluation. There is no obligation to buy and no automatic paid subscription.

[00:12:00.966] Follow the pilot plan for appliance removal or return, access closure, evidence handover and agreed retention or deletion. Assign owners to those exit actions.

[00:12:12.251] Any case study, customer name, logo or site publication requires separate written permission. Participation in the pilot does not itself grant publication rights.

[00:12:24.923] The local AI direction is planned assisted OT threat hunting: using existing telemetry and approved baselines to help explain unusual devices, commands and communication paths.

[00:12:38.021] The intended workflow links explanations and draft reports to source records, timestamps, confidence and visibility limits, with human review before export or customer communication.

[00:12:50.627] This planned local capability is separate from the website’s online assistant. Availability, hardware requirements and commercial terms need validation and agreement; it is not promised within the pilot price.

[00:13:05.268] The Manufacturing and Robotics module is a planned add-on, released only after validation, with additional supported protocol decoders and engineering reports within its contracted scope.

[00:13:18.052] The proposed model separates a perpetual licence for the purchased module version from optional annual maintenance. Any Core dependency and the separate rights must be stated before order.

[00:13:30.418] Optional fieldbus capture hardware is separately priced and needs bus, driver and interface compatibility validated. Buying an interface alone does not enable a protocol decoder.

[00:13:44.221] IIoTCogniShield is a planned wireless visibility companion, intended to help plant teams review observed wireless activity, unexpected devices and useful evidence kept locally.

[00:13:57.693] The concept explores Wi-Fi, supported Bluetooth and BLE activity, and feasibility for selected radio-frequency sensor visibility. Tested radios, channels, decoders and placement will determine coverage.

[00:14:11.955] It is not yet available for purchase or deployment. Hardware, pricing and release timing remain unconfirmed, and it is not included in the current pilot or package prices.

[00:14:24.658] Before starting, ask for the written monitoring scope, safeguards, responsibilities, data plan, deliverables and acceptance criteria, together with any customer-side costs.

[00:14:36.537] For paid continuation, compare the annual package, hardware, deployment, travel, tax and extras. Keep planned products separate, with their own validation, availability and commercial decisions.

[00:14:49.517] A useful pilot leaves your team with reviewed evidence, practical actions and a clear decision about what happens next. Thank you.


[00:15:00.000] End card: Thank you.
