OTCOGNISHIELD / ENGINEERING GUIDE
How we validate passive OT monitoring
A transparent acceptance method, with clear boundaries between examples and measured results.
Published 4 November 2026 · OTCogniShield engineering notes
FOR BUSINESS LEADERS
Business value
Understand what has actually been tested before making a purchasing or deployment decision.
What to ask
Ask for the test scope, conditions, recorded results and acceptance work still outstanding.
Important boundary
Software and recorded-capture checks do not replace acceptance of the appliance, traffic feed and operating arrangements at your site.
| Document type | Engineering validation method |
|---|---|
| Performance benchmarks | Not published; no throughput or detection-rate claim |
| Release status | Gate14 HOLD; dedicated-appliance acceptance remains open |
Prove one boundary at a time
Our validation method separates image and dependency maintenance, isolated application checks, packet-processing tests and physical appliance acceptance. Passing one category cannot close another. Container health alone does not establish live capture, detection coverage or absence of outbound traffic.
Use a traceable test record
For each case, retain the input identity, software image identity, configuration scope, expected result, observed result and limitations. Preserve a rollback path. Compare expected normal activity with an explicitly defined policy deviation; check missing and malformed input as well as a successful example.
What a future benchmark must disclose
A meaningful performance publication needs the exact appliance, NIC, storage, capture source, protocol mix, packet sizes, load duration and software version. It must report loss, resource use, collection freshness and recovery behaviour. An attractive animation or synthetic dataset is not a throughput benchmark.
Current public boundaries
The architecture diagram distinguishes uploaded captures from intended live monitoring. Dedicated-interface capture, sustained performance and installed air-gap behaviour still require acceptance. Command-level policies need packet-to-finding validation. The website UI examples are invented and are not represented as test results.
The latest targeted SASL maintenance deployment was verified for collector, worker and scheduler. That bounded maintenance result does not close Gate14, establish licensing clearance or validate physical factory operation.
Readiness review
A factory pilot should agree scope, operational safeguards, owner responsibilities, retention, recovery and stop criteria before connection. Public benchmark results will be added only when a reproducible method and reviewable evidence are available.