Who authorised this path?
Access owner and permitted destination remain unconfirmed.
INTERACTIVE EXAMPLES
Explore the review workspace.
Inspect illustrative assets, zones, commands and management views. These browser examples use synthetic records and have no connection to a factory.
INSPECT THE ENGINEERING WORKFLOW
Follow the evidence.
Keep the decision accountable.
One continuous example, from a represented communication path to a draft action. Click through each stage.
SENSE / REPRESENTED OBSERVATION
A path appears in the agreed scope.
SOURCEMaintenance workstation
192.0.2.10DESTINATIONPLC-DEMO-01
192.0.2.20 / TCP/502COLLECTION BOUNDARY
Illustrated packaging-cell switch mirror. Other segments and intermittent traffic are not represented.
| Record | What is represented | What remains unverified |
|---|---|---|
| E-01 / inventory | PLC-DEMO-01 / 192.0.2.20 / PLC / Modbus TCP | Device identity and firmware |
| E-02 / flow | 192.0.2.10 to 192.0.2.20 / TCP/502 | Request type and approved access |
ANALYSE / FINDING F-01
Maintenance access approval.
E-02 represents a communication path. It does not establish approved access or a malicious session. A protocol alone does not establish read-only behaviour.
Was it an agreed window?
Maintenance timing and session controls remain unconfirmed.
What is the consequence?
No plant-specific likelihood, consequence or risk score has been established.
Linked evidenceE-01 inventory / E-02 flow / E-03 scope / E-04 approval not supplied
ADVISE / DRAFT ACTION REGISTER
A clear owner. Reviewable closure.
A-01 / LINKED TO F-01
Confirm maintenance access approval.
Engineering Lead / before the next maintenance window
CLOSURE EVIDENCE
Reviewed access register and recorded approval decision, with reviewer, date and any conditions.
| Action / owner | Draft action | Target / status |
|---|---|---|
| A-01 / Engineering Lead | Confirm maintenance access approval. | Before next window / Pending |
| A-02 / Asset Owner | Confirm device and firmware before evaluating a vulnerability lead. | Agree at review / Pending |
| A-03 / OT Support | Confirm collection scope and blind spots. | Agree at review / Pending |
No live plant connection. Authored records; no packets are captured or parsed. Real actions require authorised engineering review and change control.
Illustrative interactive simulation
Explore the
Command Centre demo.
Inspect example assets, declared zones and a command-review scenario. Run the same Modbus write in two policy contexts to see why the context matters.
OTCogniShield / Command CentreIllustrative website workspace
Synthetic example · no plant connectionInvented records.
Local browser interaction.
No live telemetry.
Example inventory
3 invented assetsStart with the device.
Select an example to inspect its declared identity and role.
PLC-01 · example controller
- IP address
- 192.0.2.20
- Declared zone
- Control cell A · Level 1
- Example protocols
- Modbus TCP / S7
- Vendor / model
- Not assigned in this simulation
Roles and zones are declared for this example. A real installation requires identity and placement review.
Declared example boundaries
Review the communication context.
Purdue levels help explain the example; they do not automatically establish security zones.
Level 3
Engineering
ENG-01
192.0.2.10Controller writes require an approved maintenance context.
Level 2
Supervision
HMI-01
192.0.2.30Example HMI-to-PLC write permitted by the declared policy.
Level 1
Control cell A
PLC-01
192.0.2.20Declared destination for the example command observations.
Two example conduits, two review contexts
HMI-01 PLC-01: permitted in the example. ENG-01 PLC-01: maintenance approval required. These are invented policy assumptions, not a discovered network or a deployed segmentation control.
Run an invented policy example
A command needs context.
Choose a scenario, then run the browser simulation. No traffic is sent or analysed.
No example has been run.
Ready to explore
Run a scenario to inspect the review card.
- Observation
- Not run
- Example policy
- Not evaluated
- Why it matters
- Function codes alone do not establish authorisation.
Next check
Select a scenario and run the simulation.
Invented observation fields
{
"synthetic": true,
"status": "not_run",
"plant_connection": false
}Illustrative fields, not actual parser output. Register addresses and S7 offsets have no established process meaning in this example.
Simulation only. It does not demonstrate shipped detection coverage, packet processing, live capture or a physical process change.
Review current detection limitsRecorded engineering captures remain available below.
Inspect recorded engineering viewsONE EVIDENCE BASE · THREE LEVELS OF REVIEW
Factory detail.
Management perspective.
Move from an executive summary to a site review and the engineering decisions behind it.
Invented records · no live connection
Review report
Generate a snapshot of this example, including scope, scores, owners and open decisions.
Inspect generated report
Presentation prototype. Scores use invented likelihood and consequence values on a 4 × 4 matrix. They are review priorities, not a measured security rating or compliance result. Scheduled delivery, roles and multi-site data integration are not connected in this website preview.
VIOLET HORIZON / INTERACTIVE WORKFLOW PREVIEW
From observation
to accountable action.
Inspect the context. Review the boundary. Keep the evidence.
Illustrative design examples · no plant connection
See the engineering workspace.
IEC 104 single command · review context
{"synthetic": true, "protocol": "IEC 60870-5-104", "type_id": 45,
"type_name": "C_SC_NA_1", "information_object_address": 1001,
"command_acceptance": "Not established"}Invented decoded fields, not actual protocol-analyser output. These examples do not establish shipped detection coverage, authorisation or a physical change.
Next step
Check the observation with the asset owner, the approved communications register and the maintenance window. Preserve unknown fields and the review decision.
BOUNDARY REVIEW / ILLUSTRATIVESAVED PLACEMENT · EXAMPLE PATH
Find the boundary. Check the permission.
LEVEL 0 / 1Field & basic control
Sensor-01PLC-01
LEVEL 2Supervisory control
HMI-01SCADA-01
LEVEL 3Plant operations
Historian-01
LEVEL 3.5Industrial DMZ
Access gateway
HMI-01 PLC-01 / example Modbus path
The example has no approved conduit recorded. Check the saved zone assignment and communications policy with the plant owner. Missing approval evidence is not proof of a physical safety violation.
Example placement and relationships. A Purdue level is not a verified physical location, firewall rule or complete inventory.
LOCAL REVIEW SNAPSHOTEXAMPLE PACK / 001
Evidence ready for the next reviewer.
- Records
- 1 synthetic asset · 1 synthetic command
- Included context
- Time, endpoints, command and review action
- Integrity
- SHA-256 snapshot checksum
- Review status
- Human review required
Browser-generated example. No plant data is uploaded.
ILLUSTRATIVE REVIEW REFERENCES
- NIS2 Article 21(2)(a)Risk analysis and information-system security
- NIS2 Article 21(2)(b)Incident handling
- NCSC CAF A3 / C1Asset management / security monitoring
These are prompts for evidence review. A downloaded record does not establish a legal outcome, CAF achievement or certification.
Export scope and references
The working platform exports selected stored metadata as a review snapshot. This website button downloads invented sample data. It does not demonstrate a completed one-click NIS2 or CAF assessment, a packet capture or a digital signature.
NIS2 source text · NCSC CAF · Existing synthetic PDF example
Protocol-command and boundary examples are design illustrations. Supported packet-to-alert paths and live capture still require acceptance evidence. View verified engineering progress