Observed assets
A current view of the devices seen communicating across the monitored network.
THE OTCogniShield PLATFORM
ONE CLEAR VIEW OF YOUR FACTORY NETWORK.
OTCogniShield brings observed equipment, network relationships, security activity, risk decisions and supporting evidence together in one clear interface.
Instead of moving between spreadsheets, specialist network tools and static assessment reports, your team has one place to see what has changed, understand what it means and decide what needs attention.
Illustrative pre-launch platform. Deployment is subject to readiness, agreed scope and an approved passive collection point.
INTERACTIVE PLATFORM PREVIEW
Explore the platform
Bring engineering, security, and management together around observed assets, operational risk, and clear next steps.
Where the platform fits: OT, IoT & IIoT architecture · See the topology view →
OTCogniShield PLATFORM TOURIllustrative pre-launch view · sample data
OTCOGNISHIELD APPLIANCE
Alongside your industrial network.
Passive OT, IoT and IIoT visibility from authorised capture data, with offline-capable monitoring and risk intelligence.
Capture points, site coverage and deployment requirements are agreed around your network.
NETWORK & TOPOLOGY
Follow the relationships.
Understand the evidence.
Explore a simplified ICS / SCADA relationship map, with a highlighted review example and clear visibility limits.
Recorded assets289
With recorded links21
Recorded links42
Without observed links268
Totals from the supplied platform screenshot. Missing links do not establish that an asset is offline.
See the topology view →COMMAND CENTRE
Your priorities, in one place.
Observed assets24In this example environment
Risks to review06Assigned for assessment
Priority actions03Ready for owner review
Evidence statusIn reviewApproval remains with your team
EXAMPLE PRIORITIES
HIGH
Engineering workstation exposure
01Review access to the production control zone.
MEDIUM
Controller firmware evidence
02Confirm the installed version before planning updates.
MEDIUM
Unapproved communication path
03Ask the asset owner to validate the observed flow.
OPERATIONAL CONTEXT
Security decisions need
production context.
Review asset importance, consequences and ownership before deciding what to change.
ControlSupervisionOperations
ASSET DISCOVERY
Start with what you can observe.
Bring observed device details, protocols and communication into an inventory your plant team can review.
| Asset | Role | Observed protocol | Assessment scope |
|---|---|---|---|
| PLC — Line 01192.0.2.20 | Process control | Modbus TCP | In scope |
| HMI — Packaging192.0.2.30 | Operator interface | EtherNet/IP | In scope |
| Engineering station192.0.2.40 | Maintenance | OPC UA | In scope |
| Telemetry gateway192.0.2.50 | Sensor aggregation | MQTT | Review required |
Observed details depend on the capture, protocol and available traffic. Your team validates asset identity and scope.
RISK ASSESSMENT
Prioritise consequences, not just alerts.
EXAMPLE SCENARIO
Unauthorised changes to a production controller
Assess the likelihood and operational consequences, record existing measures, and give the next action a named owner.
- Asset
- PLC — Line 01
- Consequence to evaluate
- Process interruption
- Next action
- Review engineering access
- Risk owner
- Plant engineering
Select likelihood and consequence to show a rating.
| Likelihood | 1 Minor | 2 Moderate | 3 Significant | 4 Major |
|---|---|---|---|---|
| 4 Likely | ||||
| 3 Possible | ||||
| 2 Unlikely | ||||
| 1 Rare |
Local assessment bands: Low 1–4 · Medium 5–8 · High 9–12 · Critical 13–16. These are illustrative bands, not an IEC-defined universal scale. Acceptance requires the responsible owner’s decision.
EVIDENCE & REPORTING
Make the findings useful beyond the screen.
OT Security & Risk Intelligence
Assessment evidence
Production cell
risk review
01 Management summary
02 Observed asset scope
03 Threat scenarios & risk ratings
04 Recommended actions
05 Evidence & owner approval
ILLUSTRATIVE REPORT OUTLINEFor the people who need to make a decision.
Connect technical findings to scope, consequences, recommendations and evidence. Support conversations with management, auditors and insurers.
- Printable assessment outputs
- Evidence and responsibility in one workflow
- Clear next steps for your team
Evidence supports review. It does not establish certification or legal compliance by itself.
Illustrative platform tour. Relationship totals from the supplied stored-evidence screenshot.
COMMAND CENTRE
START WITH WHAT NEEDS YOUR ATTENTION TODAY.
The Command Centre brings the most useful operational and security information to the front.
See newly observed devices, changes waiting for review, open risks, recommended actions and appliance health — without having to interpret raw network traffic first.
AT A GLANCE
Changes to review
New or unusual activity worth checking.
Open risks
Security and operational issues still waiting for a decision or action.
Recommended actions
Clear, prioritised next steps for your team.
The technical detail is always there when you need it.
But you should not have to wade through it to understand what needs attention.
ASSET DISCOVERY
SEE WHAT IS COMMUNICATING ACROSS YOUR PLANT.
OTCogniShield continuously develops an inventory from the factory network traffic it observes.
As equipment communicates, the platform builds a richer picture of PLCs, HMIs, engineering workstations, industrial computers, gateways and other connected devices.
For each observed asset, your team can review and add context such as:
- Device and network identity
- Manufacturer and protocol information, where available
- Observed communication paths
- Operational role and network location
- Asset criticality
- Ownership, review history and engineering notes
Your engineers remain in control of the record — confirming, correcting and adding operational context as the picture develops.
HONEST VISIBILITY
Passive monitoring can only report on traffic available at the approved collection point.
Quiet devices, isolated networks or information that never crosses that point may not appear immediately.
OTCogniShield makes those visibility boundaries clear rather than pretending the inventory is complete.
EXPLORE ASSET DISCOVERY →NETWORK TOPOLOGY
SEE HOW YOUR PRODUCTION NETWORK FITS TOGETHER.
A list of devices only tells part of the story.
OTCogniShield maps the communications it observes, giving your team a visual view of how equipment, systems and network areas relate to one another.
Move from the whole site down into:
Sites → Network zones → Subnets → Individual assets → Communication paths
FROM ADDRESSES TO RELATIONSHIPS
Instead of asking:
“What is 10.20.14.32?”
your team can start asking:
“Why is this engineering laptop communicating directly with the Line 2 PLC?”
That is where technical network data becomes a useful operational security conversation.
EXPLORE NETWORK TOPOLOGY →SECURITY ACTIVITY
SPOT THE CHANGE. ADD THE CONTEXT.
Not every unexpected communication is a cyber attack.
And not every newly observed device is a threat.
OTCogniShield surfaces activity that deserves a closer look and gives your team the context they need to decide what it means.
REVIEW
- Newly observed devices
- Unexpected or unusual communications
- Changes in established network relationships
- Relevant vulnerability information
- Previously reviewed and accepted activity
The platform recommends where attention may be needed.
Your team makes the decision.
OTCogniShield does not automatically block network traffic, isolate controllers or send control commands to production equipment.
RISK ASSESSMENT
TURN VISIBILITY INTO PRACTICAL DECISIONS.
Finding a vulnerability or unexpected connection is only useful if you understand what it could mean for the operation.
OTCogniShield brings observed assets and network context into a structured industrial risk workflow aligned to IEC 62443-3-2.
For each risk, record:
WHAT COULD HAPPEN?
Define the realistic threat scenario.
WHY COULD IT HAPPEN?
Record the vulnerability, weakness or route that could make it possible.
WHAT WOULD THE CONSEQUENCE BE?
Assess the potential impact on production, safety, quality or the wider business.
WHAT ALREADY PROTECTS YOU?
Record the technical, physical and procedural controls already in place.
HOW SIGNIFICANT IS THE RISK?
Assess likelihood and impact.
WHO OWNS IT — AND WHAT HAPPENS NEXT?
Assign responsibility and record the agreed action.
A LIVING RISK REGISTER
Update the assessment as equipment changes, controls improve or operating conditions change.
No rebuilding the same spreadsheet every year.
EXPLORE RISK ASSESSMENT →VULNERABILITY INTELLIGENCE
FOCUS ON THE VULNERABILITIES THAT MATTER TO YOUR PLANT.
A global list containing thousands of security vulnerabilities is not an action plan.
OTCogniShield brings relevant vulnerability intelligence alongside the assets you actually observe, using manufacturer, product and version information where that information can be identified.
That gives your team a much more useful set of questions:
- Does this vulnerability relate to equipment we actually use?
- Is that equipment exposed in a way that matters?
- What could the operational consequence be?
- Do we need to patch, introduce another control, investigate further or accept the risk?
Vulnerability intelligence supports the decision.
It does not replace engineering judgement.
EVIDENCE & REPORTING
KEEP THE EVIDENCE BEHIND EVERY DECISION.
Industrial cyber security creates questions long after the initial review.
- What did we find?
- Who reviewed it?
- What did we decide?
- What evidence supported that decision?
- What action was taken — and what still needs to happen?
OTCogniShield keeps those answers connected to the work.
Record assessments, attach supporting evidence, track review status and produce clear reports for internal and external assurance.
BUILT FOR REPEATABLE ASSURANCE
Support evidence preparation for:
- IEC 62443-aligned assessments
- Cyber Essentials and Cyber Essentials Plus preparation
- NIS2-related evidence workflows, where applicable
- Customer and supply-chain security reviews
- Insurer and management assurance
OTCogniShield supports evidence and preparation. Formal certification and legal compliance remain with the relevant external bodies.
EXPLORE COMPLIANCE & EVIDENCE →LOCAL BY DESIGN
YOUR OPERATIONAL DATA STAYS UNDER YOUR CONTROL.
OTCogniShield runs locally on an on-site appliance.
Day-to-day monitoring does not depend on continuously sending sensitive production-network data to a public cloud.
The platform can continue building its operational picture without a permanent internet connection.
ON-SITE PROCESSING
Network analysis and operational records are processed and stored locally on the appliance.
NO CONTINUOUS CLOUD DEPENDENCY
Monitoring continues without a permanent internet connection.
CONTROLLED UPDATES
Software and security updates are introduced through a controlled process designed for offline-first industrial environments.
APPLIANCE HEALTH & RECOVERY
KNOW THAT THE APPLIANCE ITSELF IS HEALTHY.
A monitoring appliance is only useful if you know it is working properly.
OTCogniShield provides a clear view of its own operational state and keeps a record of key maintenance and recovery activity.
MONITOR
- Capture and service health
- Local storage and database status
- Software and update state
- Backup readiness
- Recovery evidence
So your team can see not only what the appliance is monitoring, but whether the appliance itself is ready to do its job.
PROTOCOL-AWARE VISIBILITY
BUILT TO UNDERSTAND INDUSTRIAL NETWORKS.
Factory networks do not behave like ordinary office IT.
OTCogniShield is designed to recognise the industrial protocols used by operational equipment and use that information to add context to the communications it observes.
Initial protocol support includes:
- Modbus/TCP
- Siemens S7 communications
- EtherNet/IP
- BACnet
- OPC UA
- MQTT
Protocol coverage will continue to develop through testing across different industrial environments.
THE OTCogniShield WORKFLOW
SEE IT. UNDERSTAND IT. DECIDE. RECORD IT.
01 — OBSERVE
Build a picture passively from the network traffic available at the approved collection point.
02 — UNDERSTAND
See observed devices, relationships, changes and relevant security information.
03 — ASSESS
Add operational context and decide what the risk actually means for your plant.
04 — ACT
Give the right person a clear, prioritised next step.
05 — RECORD
Keep the evidence behind the decision and record what happened next.
THAT IS THE CORE OF OTCogniShield.
Not another stream of technical alerts.
A clearer picture of your production network and a practical way to act on what you find.
DEPLOYMENT & INTEGRATION
Start with a defined scope.
Leave with a usable baseline.
One-time engagements connect your plant’s architecture, team and evidence requirements to the platform. Platform deployment is currently being prepared through controlled pilots.
Platform deployment
- On-site installation
- SPAN / TAP configuration
- Network integration
- Initial baseline setup
- First 30 days of monitoring, within the agreed scope
Compliance onboarding
- Map observed assets into the platform
- Configure CE+, NIS2 and IEC 62443 evidence mappings
- Train the customer team on the Simple View
- Establish an evidence baseline
OT architecture assessment
- Review available passive discovery evidence
- Deliver a Purdue-aligned architecture review
- Identify segmentation gaps
- Recommend zones and conduits
Incident response retainer
- Named OT incident responder
- Agreed escalation path for critical detections
- Annual tabletop exercise
- Post-incident forensic support
PLATFORM DEMONSTRATION
READY TO SEE WHAT YOUR FACTORY NETWORK IS TELLING YOU?
See how OTCogniShield turns complex industrial network traffic into information your team can understand and use.