Platform deployment
- On-site installation
- SPAN / TAP configuration
- Network integration
- Initial baseline setup
- First 30 days of monitoring, within the agreed scope
OTCOGNISHIELD
Plug & Play. Built for your team.
No agents. No active discovery scans. Local operation with an authorised passive collection point. Platform pilots are in preparation.
PLUG & PLAY · PASSIVE BY DESIGN
Connect once. Observe locally.
No agents on your production devices. No active discovery scans. No permanent internet connection required.
- 01
Agree the collection point.
Connect the appliance to an authorised TAP or switch SPAN feed, with the scope agreed by your IT and engineering teams.
- 02
Configure and validate.
Set the capture interface, confirm the traffic coverage and validate the passive collection arrangement.
- 03
Review what matters.
Review observed assets, risk priorities and preparation evidence. Keep operation and controlled updates local.
Platform pilots are in preparation. Visibility depends on traffic available at the agreed collection point.
ONE CONNECTED PICTURE
Understand your environment.
Prioritise what matters.
Bring engineering, security, and management together around observed assets, operational risk, and clear next steps.
Where the platform fits: OT, IoT & IIoT architecture · See the topology view →
OTCogniShield PLATFORM TOURIllustrative view · sample data
OTCOGNISHIELD APPLIANCE
Alongside your industrial network.
Passive OT, IoT and IIoT visibility from authorised capture data, with offline-capable monitoring and risk intelligence.
Capture points, site coverage and deployment requirements are agreed around your network.
NETWORK & TOPOLOGY
Follow the relationships.
Understand the evidence.
Explore a simplified ICS / SCADA relationship map, with a highlighted review example and clear visibility limits.
Recorded assets289
With recorded links21
Recorded links42
Without observed links268
Totals from the supplied platform screenshot. Missing links do not establish that an asset is offline.
See the topology view →COMMAND CENTRE
Your priorities, in one place.
Observed assets24In this example environment
Risks to review06Assigned for assessment
Priority actions03Ready for owner review
Evidence statusIn reviewApproval remains with your team
EXAMPLE PRIORITIES
HIGH
Engineering workstation exposure
01Review access to the production control zone.
MEDIUM
Controller firmware evidence
02Confirm the installed version before planning updates.
MEDIUM
Unapproved communication path
03Ask the asset owner to validate the observed flow.
OPERATIONAL CONTEXT
Security decisions need
production context.
Review asset importance, consequences and ownership before deciding what to change.
ControlSupervisionOperations
ASSET DISCOVERY
Start with what you can observe.
Bring observed device details, protocols and communication into an inventory your plant team can review.
| Asset | Role | Observed protocol | Assessment scope |
|---|---|---|---|
| PLC — Line 01192.0.2.20 | Process control | Modbus TCP | In scope |
| HMI — Packaging192.0.2.30 | Operator interface | EtherNet/IP | In scope |
| Engineering station192.0.2.40 | Maintenance | OPC UA | In scope |
| Telemetry gateway192.0.2.50 | Sensor aggregation | MQTT | Review required |
Observed details depend on the capture, protocol and available traffic. Your team validates asset identity and scope.
RISK ASSESSMENT
Prioritise consequences, not just alerts.
EXAMPLE SCENARIO
Unauthorised changes to a production controller
Assess the likelihood and operational consequences, record existing measures, and give the next action a named owner.
- Asset
- PLC — Line 01
- Consequence to evaluate
- Process interruption
- Next action
- Review engineering access
- Risk owner
- Plant engineering
Select likelihood and consequence to show a rating.
| Likelihood | 1 Minor | 2 Moderate | 3 Significant | 4 Major |
|---|---|---|---|---|
| 4 Likely | ||||
| 3 Possible | ||||
| 2 Unlikely | ||||
| 1 Rare |
Local assessment bands: Low 1–4 · Medium 5–8 · High 9–12 · Critical 13–16. These are illustrative bands, not an IEC-defined universal scale. Acceptance requires the responsible owner’s decision.
EVIDENCE & REPORTING
Make the findings useful beyond the screen.
OT Security & Risk Intelligence
Assessment evidence
Production cell
risk review
01 Management summary
02 Observed asset scope
03 Threat scenarios & risk ratings
04 Recommended actions
05 Evidence & owner approval
ILLUSTRATIVE REPORT OUTLINEFor the people who need to make a decision.
Connect technical findings to scope, consequences, recommendations and evidence. Support conversations with management, auditors and insurers.
- Printable assessment outputs
- Evidence and responsibility in one workflow
- Clear next steps for your team
Evidence supports review. It does not establish certification or legal compliance by itself.
Illustrative platform tour. Relationship totals from the supplied stored-evidence screenshot.
DEPLOYMENT & INTEGRATION
Start with a defined scope.
Leave with a usable baseline.
One-time engagements connect your plant’s architecture, team and evidence requirements to the platform. Platform deployment is currently being prepared through controlled pilots.
Compliance onboarding
- Map observed assets into the platform
- Configure CE+, NIS2 and IEC 62443 evidence mappings
- Train the customer team on the Simple View
- Establish an evidence baseline
OT architecture assessment
- Review available passive discovery evidence
- Deliver a Purdue-aligned architecture review
- Identify segmentation gaps
- Recommend zones and conduits
Incident response retainer
- Named OT incident responder
- Agreed escalation path for critical detections
- Annual tabletop exercise
- Post-incident forensic support
01
Passive at the coreVisibility from authorised OT capture data.
02
Offline by designKeep production operation independent of the internet.
03
Evidence you can useBring technical findings into practical decisions.
PRACTICAL SECURITY FOR SMALLER PLANTS
Built around your operations.
Designed for your team.
Give your team the context to understand your OT environment and focus on the risks that matter to production.
Discover with care.
Use authorised PCAP data or a planned passive capture arrangement. Agree the visibility scope with engineering before collection begins.
PASSIVE DISCOVERY
Put risk in context.
Combine asset information and threat scenarios with the consequences that matter to your operation. Prioritise actions your team can review.
OPERATIONAL PRIORITIES
Keep control locally.
Designed for offline and air-gapped production environments, with controlled update packages and a local evidence workflow.
OFFLINE OPERATION
No permanent internet connection required.
Build visibility and evidence around your plant’s connectivity rules. Agree collection, updates and recovery as part of the pilot.
BEFORE WE TALK
Your questions, answered.
Can we engage you for consulting now?
Yes. Consulting services include IEC 62443 assessments, OT architecture design, project delivery and audit preparation. The platform remains in pre-launch validation, with controlled factory pilots and subscription services being prepared separately.
Can we combine consulting and the platform?
Yes. A combined engagement can include an observed asset inventory, an IEC 62443-3-2 aligned risk assessment, architecture review, readiness report and a scoped platform pilot. Deliverables, fees, access arrangements and readiness are agreed before deployment.
Does the platform need an internet connection?
Production operation is designed to work offline, including air-gapped environments. Update delivery and verification should follow an agreed controlled process.
Will a pilot actively scan our control network?
The discovery approach is based on passive visibility and authorised capture data. Collection arrangements and any separately authorised diagnostic activity are agreed before the pilot. The pilot includes review of operational impact.
Does it make our factory compliant?
No tool can establish compliance on its own. OTCogniShield helps organise risk assessment and supporting evidence. Your organisation still needs to determine applicable obligations, review controls and obtain specialist advice or certification where required.
What would you need from our factory?
An engineering or operations contact, an agreed scope, and an authorised way to provide relevant capture data. We will agree success criteria, access boundaries and data handling before testing begins.