Platform deployment
- On-site installation
- SPAN / TAP configuration
- Network integration
- Initial baseline setup
- First 30 days of monitoring, within the agreed scope
OT · IoT · IIoT SECURITY & RISK INTELLIGENCE
OT Security &
Risk IntelligenceFrom floor to boardroom.
Specialist OT consulting. Passive OT, IoT and IIoT visibility—turning evidence into action.
13 years of OT security experience · ISA/IEC 62443 ExpertFounder’s qualifications and experience
Assessment support: IEC 62443 · NIS2 readiness · NIST SP 800-82
- Passive monitoring
- Offline-capable
- OT · IoT · IIoT
- Practitioner-led
Example production cellILLUSTRATIVE PLATFORM PREVIEW
Command Centre
Sample assets and risk priorities24Observed assets
6Risks to review
3Priority actions
Priorities for your team
- HIGHEngineering accessReview the production control zone.
- MEDIUMController firmwareValidate the installed version.
- MEDIUMCommunication pathConfirm the flow with its owner.
Asset Discovery
Observed example assetsStart with authorised capture data, then validate identity and scope with your plant team.
| Asset | Protocol |
|---|---|
| PLC — Line 01 | Modbus TCP |
| HMI — Packaging | EtherNet/IP |
| Engineering station | OPC UA |
| Telemetry gateway | MQTT |
Capture coverage determines what can be observed.
Risk Assessment
Example scenarioILLUSTRATIVE 4 × 4 RISK MATRIX
Select likelihood and consequence to show a rating.
| Likelihood | 1 Minor | 2 Moderate | 3 Significant | 4 Major |
|---|---|---|---|---|
| 4 Likely | ||||
| 3 Possible | ||||
| 2 Unlikely | ||||
| 1 Rare |
Local assessment bands: Low 1–4 · Medium 5–8 · High 9–12 · Critical 13–16. These are illustrative bands, not an IEC-defined universal scale. Acceptance requires the responsible owner’s decision.
Illustrative sample data · pre-launch platformFull platform tour
Industrial expertise meets passive risk intelligence. Assess your environment, strengthen the architecture, and build evidence for informed decisions. Consulting available now; platform pilots in preparation.
Standards-informed consulting and evidence workflows
- IEC 62443
- NIST SP 800-82
- NIS2 readiness
01
Passive at the coreVisibility from authorised OT capture data.
02
Offline by designKeep production operation independent of the internet.
03
Evidence you can useBring technical findings into practical decisions.
CONSULTING SERVICES
Specialist OT expertise.
From assessment to handover.
Work with OTCogniShield on OT security, architecture and delivery. OTCogniShield adds a platform for ongoing visibility and evidence alongside the consulting engagement.
Consulting engagements available
Choose a focused review or support across the project lifecycle. Scope, deliverables and fees are agreed around your environment.
01IEC 62443 compliance consultingSecurity management, systems and product security
Translate the relevant IEC 62443 requirements into a practical programme, with clear responsibilities, assessment evidence and a plan for implementation.
- IEC 62443-2-1 — security management
- IEC 62443-2-3 — patch management
- IEC 62443-2-4 — service provider requirements
- IEC 62443-3-2 — risk assessment
- IEC 62443-3-3 — system security requirements
- IEC 62443-4-1 / 4-2 — product security processes and requirements
02OT security architecture designZones, conduits and secure industrial connectivity
Develop an architecture that reflects the way your plant operates, including access needs, legacy constraints and the boundaries between IT and OT.
- Zone and conduit design
- Purdue-aligned network segmentation
- OT DMZ design
- Secure remote access
- Unidirectional controls
- IT / OT integration
03Risk assessmentOperational consequences, priorities and ownership
Agree the assessment scope, understand the threats and consequences, and develop recommendations that your engineering and management teams can review.
- IEC 62443-3-2 aligned risk assessment
- Assessment informed by NIST SP 800-82
- TS 50701-aligned rail cybersecurity assessment
- NIS2 readiness and gap assessment
04Project deliveryFrom early design through commissioning and handover
Bring OT security requirements into project decisions and supplier interfaces, with support through design assurance, testing and acceptance.
- Front-end engineering design (FEED) support
- Detailed design and design reviews
- Supplier coordination and assurance reviews
- Factory, site and integrated site acceptance testing (FAT / SAT / ISAT)
- Commissioning support
- Handover and acceptance evidence
05Compliance and audit preparationReadiness, gap reviews and evidence preparation
Identify gaps, organise the supporting evidence and prepare your team for an assessment or audit. Certification decisions remain with the relevant assessment bodies.
- Cyber Essentials Plus preparation
- NIS2 readiness assessment
- IEC 62443 certification preparation
DEPLOYMENT & INTEGRATION
Start with a defined scope.
Leave with a usable baseline.
One-time engagements connect your plant’s architecture, team and evidence requirements to the platform. Platform deployment is currently being prepared through controlled pilots.
Compliance onboarding
- Map observed assets into the platform
- Configure CE+, NIS2 and IEC 62443 evidence mappings
- Train the customer team on the Simple View
- Establish an evidence baseline
OT architecture assessment
- Review available passive discovery evidence
- Deliver a Purdue-aligned architecture review
- Identify segmentation gaps
- Recommend zones and conduits
Incident response retainer
- Named OT incident responder
- Agreed escalation path for critical detections
- Annual tabletop exercise
- Post-incident forensic support
ONGOING SERVICES & SOFTWARE
Keep the assessment useful.
Keep the evidence current.
Combine consultancy with an annual platform licence, managed monitoring or continuing evidence support. The platform subscription offering is being developed alongside early pilots.
OTCogniShield subscription
Local visibility and an evidence workspace for your team.
- Passive OT monitoring
- Register-change tracking
- Compliance evidence generation
- Incident response workspace
- Simple / Analyst views
Managed platform service
Practitioner support to operate the platform and review the findings.
- Platform operation and maintenance
- Monitoring of agreed OT visibility
- Detection review and response support
- Monthly compliance evidence reports
Compliance-as-a-Service
Maintain a reviewable record as your environment changes.
- Ongoing compliance evidence preparation
- Monthly Cyber Essentials Plus readiness reports
- NIS2 evidence preparation
- IEC 62443-3-2 risk assessment maintenance
For offline environments, monitoring, reporting and escalation arrangements are designed around agreed local access and controlled evidence transfer.
Explore the full service catalogue 15 services
| Service | Engagement | Commercial basis |
|---|---|---|
| IEC 62443-3-2 risk assessment | Consulting | Day rate |
| OT network architecture design | Consulting | Day rate |
| Zone and conduit design | Consulting | Day rate |
| NIS2 readiness assessment | Consulting | Day rate |
| Cyber Essentials Plus preparation | Consulting | Day rate |
| IEC 62443 certification preparation | Consulting | Day rate |
| Supplier assurance reviews | Consulting | Day rate |
| FAT / SAT / ISAT support | Consulting | Day rate |
| OTCogniShield deployment | One-time, pilot-stage platform engagement | Project fee |
| OTCogniShield subscription | Planned recurring platform licence | Annual licence |
| Managed monitoring service | Recurring, subject to agreed platform scope | Monthly retainer |
| Compliance evidence service | Recurring | Monthly retainer |
| Incident response retainer | Recurring | Annual retainer |
| Annual architecture review | Recurring | Annual retainer |
| Executive reporting | Recurring | Quarterly retainer |
Fees, deliverables, coverage and service terms are agreed after scoping. Platform-dependent services follow pilot readiness and the agreed release scope.
CONSULTING + PLATFORM
OT Security in a Box.
An assessment. A roadmap.
A route to continuous monitoring.
Combine practitioner-led consulting with OTCogniShield in one scoped engagement. Begin with the plant’s risks and architecture, then agree how ongoing monitoring and evidence can support the team.
Scope a combined engagementA practical set of deliverables
- Observed asset inventoryScope and coverage validated with your team.
- IEC 62443-3-2 aligned risk assessmentThreats, consequences, responsibilities and actions.
- Architecture and segmentation reviewZones, conduits and a prioritised roadmap.
- Compliance readiness reportEvidence and gaps against the agreed requirements.
- Platform pilot and monitoring planAuthorised collection, handover and ongoing support.
Assessment fees, annual platform licensing and managed service support are scoped separately. Deployment timing and operational safeguards are agreed before work starts.
WHO WE WORK WITH
Industrial security for smaller teams.
Manufacturers with 20–250 employees, including UK and West Midlands factories with small IT teams. Our approach combines specialist support, passive visibility and offline operation, with engagements scoped around your site’s priorities and resources.
ONE CONNECTED PICTURE
Understand your environment.
Prioritise what matters.
Bring engineering, security, and management together around observed assets, operational risk, and clear next steps.
Where the platform fits: OT, IoT & IIoT architecture · See the topology view →
OTCogniShield PLATFORM TOURIllustrative view · sample data
OTCOGNISHIELD APPLIANCE
Alongside your industrial network.
Passive OT, IoT and IIoT visibility from authorised capture data, with offline-capable monitoring and risk intelligence.
Capture points, site coverage and deployment requirements are agreed around your network.
NETWORK & TOPOLOGY
Follow the relationships.
Understand the evidence.
Explore a simplified ICS / SCADA relationship map, with a highlighted review example and clear visibility limits.
Recorded assets289
With recorded links21
Recorded links42
Without observed links268
Totals from the supplied platform screenshot. Missing links do not establish that an asset is offline.
See the topology view →COMMAND CENTRE
Your priorities, in one place.
Observed assets24In this example environment
Risks to review06Assigned for assessment
Priority actions03Ready for owner review
Evidence statusIn reviewApproval remains with your team
EXAMPLE PRIORITIES
HIGH
Engineering workstation exposure
01Review access to the production control zone.
MEDIUM
Controller firmware evidence
02Confirm the installed version before planning updates.
MEDIUM
Unapproved communication path
03Ask the asset owner to validate the observed flow.
OPERATIONAL CONTEXT
Security decisions need
production context.
Review asset importance, consequences and ownership before deciding what to change.
ControlSupervisionOperations
ASSET DISCOVERY
Start with what you can observe.
Bring observed device details, protocols and communication into an inventory your plant team can review.
| Asset | Role | Observed protocol | Assessment scope |
|---|---|---|---|
| PLC — Line 01192.0.2.20 | Process control | Modbus TCP | In scope |
| HMI — Packaging192.0.2.30 | Operator interface | EtherNet/IP | In scope |
| Engineering station192.0.2.40 | Maintenance | OPC UA | In scope |
| Telemetry gateway192.0.2.50 | Sensor aggregation | MQTT | Review required |
Observed details depend on the capture, protocol and available traffic. Your team validates asset identity and scope.
RISK ASSESSMENT
Prioritise consequences, not just alerts.
EXAMPLE SCENARIO
Unauthorised changes to a production controller
Assess the likelihood and operational consequences, record existing measures, and give the next action a named owner.
- Asset
- PLC — Line 01
- Consequence to evaluate
- Process interruption
- Next action
- Review engineering access
- Risk owner
- Plant engineering
Select likelihood and consequence to show a rating.
| Likelihood | 1 Minor | 2 Moderate | 3 Significant | 4 Major |
|---|---|---|---|---|
| 4 Likely | ||||
| 3 Possible | ||||
| 2 Unlikely | ||||
| 1 Rare |
Local assessment bands: Low 1–4 · Medium 5–8 · High 9–12 · Critical 13–16. These are illustrative bands, not an IEC-defined universal scale. Acceptance requires the responsible owner’s decision.
EVIDENCE & REPORTING
Make the findings useful beyond the screen.
OTCogniShield / Assessment evidence
Production cell
risk review
01 Management summary
02 Observed asset scope
03 Threat scenarios & risk ratings
04 Recommended actions
05 Evidence & owner approval
ILLUSTRATIVE REPORT OUTLINEFor the people who need to make a decision.
Connect technical findings to scope, consequences, recommendations and evidence. Support conversations with management, auditors and insurers.
- Printable assessment outputs
- Evidence and responsibility in one workflow
- Clear next steps for your team
Evidence supports review. It does not establish certification or legal compliance by itself.
Illustrative platform tour. Relationship totals from the supplied stored-evidence screenshot.
THE BUSINESS COST OF DISRUPTION
When production stops,
the costs keep moving.
A cyber incident can interrupt output, delay deliveries and put recovery pressure on your team. Bring those operational consequences into your risk assessment.
Discuss your factory’s risk prioritiesMANUFACTURING & PRODUCTION · 2025 STUDY
US$1.3 million
Mean ransomware recovery cost,
excluding ransom payments.
Sophos surveyed 332 manufacturing and production organisations affected by ransomware. Respondents represented organisations with 100–5,000 employees across multiple countries.
An organisation-level benchmark, not a forecast for an individual factory or a UK small-business average.
Source: Sophos manufacturing report (2025)WHY OTCOGNISHIELD
Industrial experience.
Protection within reach.
Founded by an ICS/OT cybersecurity practitioner with experience defending industrial environments against cyber adversaries across oil and gas, rail, manufacturing and the chemical industry.
Small and medium-sized businesses are part of the same threat landscape. They deserve strong protection for their operations, even when budgets and specialist resources are limited.
Our aim is to make enterprise-level OT security expertise accessible and affordable for smaller manufacturers, with practical advice, clear priorities and a scope that fits the plant.
Discuss your plant’s needsBUILT AROUND YOUR OPERATIONS
Experience that understands the factory floor
- Practitioner-led supportIndustrial cybersecurity experience across demanding sectors.
- Production-aware assessmentPassive visibility and an agreed scope, shaped around your operational constraints.
- Clear priorities for smaller teamsUnderstand what matters, what to address next and what evidence to keep.
- Proportionate engagementScope and deliverables agreed around your needs and available resources.
PRACTICAL SECURITY FOR SMALLER PLANTS
Built around your operations.
Designed for your team.
Give your team the context to understand your OT environment and focus on the risks that matter to production.
Discover with care.
Use authorised PCAP data or a planned passive capture arrangement. Agree the visibility scope with engineering before collection begins.
PASSIVE DISCOVERY
Put risk in context.
Combine asset information and threat scenarios with the consequences that matter to your operation. Prioritise actions your team can review.
OPERATIONAL PRIORITIES
Keep control locally.
Designed for offline and air-gapped production environments, with controlled update packages and a local evidence workflow.
OFFLINE OPERATION
No permanent internet connection required.
Build visibility and evidence around your plant’s connectivity rules. Agree collection, updates and recovery as part of the pilot.
DECISIONS YOU CAN EXPLAIN
Operational evidence.
Confidence in every review.
Connect technical observations, risk decisions, and supporting evidence in a clear record for engineering, management, and audit review.
Explore reportingEngineering & operations
Understand observed assets, communication and recommended actions in the context of production.
Management & ownership
Bring risk priorities, responsibility and next steps into a conversation your decision-makers can follow.
Compliance & audit review
Organise assessment records and control evidence for review against your applicable requirements.
Risk workflow informed by IEC 62443-3-2.Compliance tools support evidence preparation. Applicability, compliance decisions and certification require the appropriate review.
EARLY PILOT PROGRAMME
Real factory insight.
A focused pilot partnership.
Up to three SMB manufacturing sites in the West Midlands and across the UK. A no-cost, scoped IEC 62443-3-2 aligned assessment, passive deployment and direct founder support.
Applications open · Deployment subject to readiness and agreed scope
BEFORE WE TALK
Your questions, answered.
Can we engage you for consulting now?
Yes. Consulting services include IEC 62443 assessments, OT architecture design, project delivery and audit preparation. The platform remains in pre-launch validation, with controlled factory pilots and subscription services being prepared separately.
Can we combine consulting and the platform?
Yes. A combined engagement can include an observed asset inventory, an IEC 62443-3-2 aligned risk assessment, architecture review, readiness report and a scoped platform pilot. Deliverables, fees, access arrangements and readiness are agreed before deployment.
Does the platform need an internet connection?
Production operation is designed to work offline, including air-gapped environments. Update delivery and verification should follow an agreed controlled process.
Will a pilot actively scan our control network?
The discovery approach is based on passive visibility and authorised capture data. Collection arrangements and any separately authorised diagnostic activity are agreed before the pilot. The pilot includes review of operational impact.
Does it make our factory compliant?
No tool can establish compliance on its own. OTCogniShield helps organise risk assessment and supporting evidence. Your organisation still needs to determine applicable obligations, review controls and obtain specialist advice or certification where required.
What would you need from our factory?
An engineering or operations contact, an agreed scope, and an authorised way to provide relevant capture data. We will agree success criteria, access boundaries and data handling before testing begins.
LET’S TALK ABOUT YOUR FACTORY
Move your OT security
forward with confidence.
Tell us about your consulting project, architecture challenges, evidence needs, or interest in a factory pilot.
info@otcognishield.comConsulting engagements, deployment planning and ongoing services.