Collection and access
Agree the source, authorised personnel, management interface and observation window. Record what is outside scope.
PILOT READINESS
Agree the details before connection.
Use this page with your plant lead to review scope, responsibilities, safeguards, data handling, acceptance and exit arrangements.
Back to the pilot overviewAGREE THE MEASURES BEFORE CONNECTION
Define what a useful result looks like.
Targets, observation windows and exclusions are agreed for your site. These are proposed evaluation checks, not claims of completed validation.
| Review area | Evidence to inspect | Joint review |
|---|---|---|
| Asset visibility | Observed devices compared with an agreed reference list; identity gaps and devices outside the feed recorded. | Plant lead and evaluator |
| Protocol coverage | Agreed sample traffic produces expected protocol records; unsupported or encrypted fields remain explicit. | Controls engineer and evaluator |
| Traffic to workspace | Trace a known capture through processing to the UI. Distinguish packet observation time from import time. | Engineering reviewer |
| Collection and recovery | Check freshness, capture-loss indicators where available, restart behaviour and the agreed stop procedure. | Site owner and evaluator |
| Useful evidence | Review exported records for scope, dates, owners, findings and limitations. | Named assessment owner |
Live capture, installed isolation, detection coverage and performance require their own acceptance evidence. Monitoring supports investigation and review; it does not block attacks or certify compliance.
YOUR PLANT / AGREED DATA BOUNDARIES
Know what is collected.
Know who can access it.
Define the data handling plan before captures or site information are exchanged. Initial enquiries need only a high-level introduction.
Review deployment responsibilitiesStorage and updates
Agree local storage, retention, backup, update transfer and any separately authorised export or support access.
Exit and publication
Agree access closure, hardware return, evidence handover and retention or deletion. Case studies need separate written permission.
ONE PAGE / NO EMAIL REQUIRED
Prepare the first conversation.
Use the deployment-readiness sheet with your engineering lead. Mark unknowns as questions for scoping; completing it does not authorise installation.
The practical outcomes we will evaluate
WHAT WE ARE TESTING
Three simple, practical outcomes.
The pilot is not about proving whether industrial cyber security matters.
It is about proving whether OTCogniShield makes it easier to understand and manage.
01 — IS DEPLOYMENT GENUINELY STRAIGHTFORWARD?
Can a pre-configured appliance be introduced into a live industrial environment without turning installation into a major IT project?
02 — DOES IT BUILD A USEFUL PICTURE OF THE FACTORY NETWORK?
Can your engineering team use observed assets, communication paths and network context to understand the agreed part of the environment more clearly?
03 — DOES IT TURN TECHNICAL EVIDENCE INTO PRACTICAL ACTION?
Can observed network activity and operational context be translated into clear, prioritised decisions your team can actually use?
IF IT DOESN’T MAKE THE WORK CLEARER, FASTER AND EASIER TO ACT ON, THE PILOT HAS TAUGHT US SOMETHING IMPORTANT.
What your team receives
WHAT YOUR TEAM RECEIVES
Real engineering value — not just a product test.
The agreed OTCogniShield pilot is delivered at no charge.
Scope, operational safeguards, responsibilities, hardware arrangements and success criteria are agreed in writing before anything is connected.
SCOPING & SAFEGUARD AGREEMENT
A clear written definition of the factory area in scope, agreed collection method, responsibilities and operational safeguards.
PASSIVE PLATFORM DEPLOYMENT
Installation of the local appliance against an approved SPAN/TAP feed, or analysis of agreed offline packet-capture files where appropriate.
No endpoint agents. No active discovery scans across production equipment.
BASELINE ASSET & RELATIONSHIP VIEW
A developing inventory of the industrial devices and communication relationships visible through the agreed monitoring point.
Your team helps confirm identities, functions and operational context.
IEC 62443-3-2 ALIGNED RISK ASSESSMENT
A structured review linking relevant threat scenarios to operational consequences, existing controls and prioritised actions.
ASSURANCE READINESS SUMMARY
Identification of evidence gaps relevant to customer security questionnaires, Cyber Essentials / Cyber Essentials Plus preparation, NIS2-related supply-chain requirements or other assurance discussions where applicable.
This supports preparation.
It is not certification, a formal Cyber Essentials Plus assessment or a legal compliance determination.
FOUNDER-LED REVIEW
Direct access to an OT/ICS cyber-security practitioner with more than 13 + years of specialist experience, including work with organisations such as ADNOC, Maersk and GKN.
Findings are reviewed with your plant lead, engineering team or relevant management stakeholders.
What we ask from your team
WHAT WE ASK FROM YOU
A straightforward, practical partnership.
You do not need an in-house cyber-security department.
You do need people who understand how the plant operates and are willing to help us test the platform properly.
NAMED PLANT CONTACT
An engineering, operations or technical lead who understands the facility and can help validate asset identities and operational context.
APPROVED NETWORK FEED
An agreed SPAN port, network TAP, other authorised traffic source or suitable offline packet capture.
OPERATIONAL CONTEXT
Enough information to help distinguish expected production activity from something that genuinely deserves investigation.
CANDID FEEDBACK
Tell us what worked.
Tell us what did not.
Tell us what made the job easier — and what still felt difficult.
FINAL JOINT REVIEW
A structured review against the success criteria agreed at the beginning of the pilot.
Your company name, logo, comments, site information or case study are never published or shared without separate written permission.
Installation safeguards and stop procedure
BUILT AROUND PRODUCTION
Nothing connects until the safeguards are agreed.
OTCogniShield is designed around passive observation rather than actively probing production equipment.
But any physical installation inside an operating industrial site still has to respect the plant.
Before deployment, we agree:
01 — MONITORING SCOPE
Which factory area or network segment is included.
02 — COLLECTION POINT
The agreed SPAN, TAP or other authorised source.
03 — AUTHORISED PERSONNEL
Who can approve and support the deployment.
04 — INSTALLATION METHOD
How the appliance is connected and physically accommodated.
05 — ACCEPTANCE CHECKS
How we confirm the deployment is behaving as expected.
06 — STOP PROCEDURE
What happens immediately if the site wants the pilot paused or disconnected.
No responsible industrial security practitioner should promise zero operational risk when introducing equipment into a live factory environment.
WE REDUCE AND MANAGE THAT RISK BY PLANNING THE DEPLOYMENT AROUND PRODUCTION.
Visibility and coverage limits
HONEST COVERAGE BOUNDARIES
Passive visibility shows what the agreed network feed presents.
Passive monitoring can only analyse the traffic available through the agreed collection point.
During the pilot, coverage depends on:
- Which network areas are presented to the appliance
- Which devices communicate during the observation period
- Which industrial protocols can be interpreted
- How much useful information is available from encrypted traffic
- Whether relevant equipment is isolated or sits outside the capture
An incomplete view is not presented as complete.
WHERE THE EVIDENCE STOPS, OTCogniShield SHOWS YOU.
The evaluation process
THE PILOT WORKFLOW
A clear process from first conversation to final review.
01 — DISCUSS
Tell us about your factory, priorities and what you want to understand.
02 — SCOPE
Agree the monitoring boundary, safeguards, responsibilities and success criteria.
03 — CONNECT
Deploy the pre-configured appliance to the approved source or begin from agreed capture files.
04 — OBSERVE
Allow normal factory traffic to build the baseline.
05 — VERIFY
Review the observed assets and relationships with the people who understand the plant.
06 — ASSESS
Turn relevant findings into practical risk decisions and prioritised actions.
07 — REPORT
Review the findings, evidence, limitations and recommendations together.
NO SURPRISES. NO OPEN-ENDED CONSULTING BILL. NO AUTOMATIC PAID SUBSCRIPTION.
What happens at the end
AT THE END OF THE PILOT
Keep the value. Decide what happens next on your terms.
At the end of the pilot, your team receives the agreed deliverables, including the asset and relationship baseline, risk-assessment outputs, assurance-readiness findings and final recommendations.
Then you decide.
IF YOU WANT TO CONTINUE
We provide a separate commercial proposal covering the appropriate OTCogniShield licence, platform updates, support and any further consulting.
IF YOU DO NOT
The pilot ends.
There are no automatic renewals and no obligation to buy.
Hardware removal or return, access closure and agreed data retention or deletion are handled according to the pilot plan.
THE PILOT SHOULD STAND ON ITS OWN AS USEFUL, COMPLETED WORK FOR YOUR FACTORY.
Is your factory a good fit?
IS YOUR FACTORY A GOOD FIT?
We are looking for real UK manufacturing environments — not perfect labs.
The initial cohort is aimed at manufacturers that:
- Operate active OT, IoT or IIoT equipment
- Can provide an authorised passive view of an agreed network area
- Have a plant contact who understands production operations
- Want a clearer view of factory-network security and risk
- Are willing to provide practical, honest feedback
You do not need perfect documentation.
You do not need a mature cyber-security programme.
And you do not need to send confidential network information with your initial application.
Programme costs and frequently asked questions
FREQUENTLY ASKED QUESTIONS
Know what to expect.
IS THE PILOT GENUINELY FREE OF CHARGE?
Yes.
There is no charge for the agreed OTCogniShield pilot deliverables or founder-led consulting time.
Any customer-side infrastructure, access or third-party costs are identified before the pilot begins.
There is no automatic conversion to a paid subscription.
HOW LONG DOES A PILOT TAKE?
The timetable is agreed around the factory, monitoring scope and engineering availability.
A typical observation period may run for around two to four weeks, followed by review and reporting, but the agreed pilot plan determines the actual duration.
DO WE NEED TO SEND SENSITIVE NETWORK INFORMATION WITH OUR APPLICATION?
No.
A high-level introduction is enough to start the conversation.
Do not send passwords, detailed network diagrams, packet captures or other sensitive plant information with your initial enquiry.
CAN YOU GUARANTEE ZERO OPERATIONAL DISRUPTION?
No responsible industrial security specialist should make that promise.
The platform is designed around passive observation, but physical deployment still requires careful planning and site change control.
Operational safeguards and an immediate stop procedure are agreed before connection.
DO WE HAVE TO BUY THE PLATFORM AFTERWARDS?
No.
There is no obligation to purchase a commercial licence or ongoing service.
Any future engagement is a separate decision and a separate agreement.