Industrial / OT
In a plant, a careless port scan can stop production, and a failure means physical damage. We assess industrial systems the way they have to be assessed — safety first, passive by default, and never at the expense of the process.
Book a ConsultationSafety first, then availability — security is built around both
Operational technology inverts almost every IT assumption. The order of priorities is safety, then availability, then integrity, then confidentiality. OT systems often stay in service for 10 to 15 years and can exceed 20, patching often waits for an annual outage or a vendor, and a reboot can mean shutting down a process. A tester who brings IT habits onto a process network will eventually cause an incident.
Regulation is catching up. In the EU, NIS2 covers energy, transport and water operators, chemicals, and manufacturers of electronics, electrical equipment and machinery; the Cyber Resilience Act already requires makers of connected industrial products to report actively exploited vulnerabilities, with its full obligations from December 2027.
The intrusions that actually reach industrial sites rarely start with an exotic controller exploit. They come through the IT/OT boundary, remote and vendor access, engineering workstations and removable media. That is where most of the value of an assessment is — and we will tell you so, even when it makes the engagement smaller. For grids, pipelines, water and grid-edge devices, see Energy & Utilities.
Three services, tuned to the plant
Artificial Intelligence Security (AI-BOM)
AI beside the control loop and inside it: predictive-maintenance and optimization models fed by plant data, assistants on engineering workstations, and agents with a path to operator actions. We test what the AI can reach and change, not just what it says.
Learn more →Post-Quantum Cryptography Readiness (CBOM)
A cryptographic inventory across the estate: firmware signing, device certificates, remote-access VPNs, and the secured protocols your control systems use. A controller installed this year may still be running when today’s public-key algorithms are retired, so the roadmap follows your capital-refresh cycle, not an IT one.
Learn more →Product Penetration Testing
For equipment makers: controllers, gateways, HMIs, and the engineering software and cloud services around them, tested on your bench. For operators: the IT/OT boundary, remote and vendor access, engineering workstations, and the process network itself — passive by default, active only in a lab, on spare hardware, or in an agreed outage window.
Learn more →Built for process networks, not adapted from IT
Safety systems are out of bounds
Safety instrumented systems — emergency shutdown, fire and gas, burner management, protective relays — are reviewed on paper only. No scanning, probing or test equipment on their networks, and we will say no in writing if asked.
Passive by default
Most findings are proven without touching the process. Active testing needs a specific reason, your authorization, and a safe environment — a lab, spare hardware, a digital twin or an agreed outage window. Never the live process.
Consequence-driven
We start from the physical outcome that must not happen and work back. A protocol with no authentication is a design fact, not a finding — the finding is that it is reachable from somewhere it should not be.
Fixes your plant can schedule
Every finding carries a compensating control and its residual risk, and the roadmap is split three ways: now, next outage, and capital refresh. We never recommend patching a controller like a server.
The frameworks your assessment answers to
Industrial security is shaped as much by engineering standards as by law — and the law is arriving fast. Current as of October 2026.
| Framework | Instrument | What it means for you |
|---|---|---|
| Engineering standard | IEC 62443 series | The international series for industrial automation and control system security: asset-owner security programmes (62443-2-1, new edition 2024), risk assessment by zones and conduits (3-2), system security levels (3-3), and secure development and component requirements for product makers (4-1, 2018; 4-2, 2019 — European amendments to align both with the Cyber Resilience Act are in preparation). |
| United States | NIST SP 800-82 Rev. 3 (2023) | NIST’s guidance on OT security; it is not a regulation. It warns that active scans “may cause device instability or interfere with the device process state” and should be scheduled during planned outages whenever possible. An initial public draft of Rev. 4, published in September 2026, is open for comment until 30 November 2026; Rev. 3 remains the current guidance. |
| European Union | NIS2 — Directive (EU) 2022/2555 | Energy, transport, drinking water and waste water are sectors of high criticality; chemicals, and manufacturers of electronics, electrical equipment, machinery and vehicles, are other critical sectors. Whether you are an essential or important entity depends on sector and size. Member states had to apply it from 18 October 2024; it binds organisations through national law. Most have transposed it. Ireland, Spain and France are before the EU Court of Justice following referrals in July 2026 (the Dutch referral was closed in October 2026). Targeted amendments proposed in January 2026 are still before Parliament and Council. |
| European Union | Cyber Resilience Act — Reg (EU) 2024/2847 | Applies to industrial products with digital elements sold in the EU. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, including for products already on the market; full application from 11 December 2027. Most controllers and HMIs fall in the default category, while firewalls, routers and switches are listed as important products. No harmonised standard has been cited yet. |
| European Union | Machinery Regulation — Reg (EU) 2023/1230 | Applies from 20 January 2027 to machinery and related products placed on the EU market or put into service. Manufacturers must design them so that software and data critical to meeting the essential health and safety requirements are identified and adequately protected against accidental or intentional corruption, and so that control systems can withstand, where appropriate to the circumstances and the risks, reasonably foreseeable malicious attempts by third parties that could lead to a hazardous situation. |
| US — electricity | NERC CIP standards | Mandatory for the bulk electric system. CIP-015, approved in 2025, adds internal network security monitoring inside the electronic security perimeter, with compliance phased in over the following years; its extension, CIP-015-2, was approved in August 2026. |
| US — pipelines and rail | TSA security directives | Binding directives for designated pipeline and rail operators, renewed again in 2026. A permanent rule proposed in November 2024 is not yet final. |
| US — water | No binding federal cybersecurity rule | Under America’s Water Infrastructure Act, community water systems serving more than 3,300 people must assess their risks — including the security of their electronic, computer and other automated systems — certify to the EPA that they have done so, and review the assessment at least every five years. There is no federal cybersecurity standard they must meet. |
| United Kingdom | NIS Regulations 2018 Cyber Security and Resilience Bill | The NIS Regulations cover operators of essential services in energy, transport and water. The Bill that would extend them is in the House of Lords and is not yet law. |
| AI in OT | Principles for the Secure Integration of AI in OT (December 2025) | Joint guidance from CISA, the Australian Cyber Security Centre and partners in the US, Canada, Germany, the Netherlands, New Zealand and the UK: understand AI, consider whether it belongs in the OT domain, govern and assure it, and build in oversight and fail-safes. |
| Post-quantum | CISA — Post-Quantum Considerations for OT (October 2024) | CISA guidance, not a rule. It warns that OT may be among the last platforms to reach post-quantum standards because of long patch cycles and hardware replacement times, and recommends crypto-agility and factoring quantum mitigation into platform update schedules and upgrade lifecycles. There is no OT-specific deadline; the general timelines on our PQC page are the reference points. |
What you get
- Asset reconciliation — what passive discovery found against your inventory and drawings, including the devices nobody can explain
- Consequence-ranked findings — rated on physical consequence, reachability and likelihood, each with a compensating control, its residual risk, and a now / next outage / capital-refresh roadmap
- Product security evidence — for equipment makers, test results and fixes your customers’ security reviews and EU market access will ask for
- Cryptographic bill of materials — OT and engineering-network cryptography in CycloneDX format, with a post-quantum roadmap aligned to your refresh cycles
- AI bill of materials — the models, data sources and tools behind your industrial AI, delivered as a CycloneDX ML-BOM
- Two briefings — one for engineering on consequences and what we did not touch, one for security and leadership on the entry paths
Find the path in before it reaches the process.
An industrial engagement starts with your process, its consequences, and the paths into it — not with a scan.
Get in Touch