OT SecurityOT Security
We reconstruct how your plant is wired and validate how far an attack can reach
No scanning of production systems. No downtime.
01
Who it is for
You have network diagrams, but they are scattered across departments and no one sees the whole picture.
Your asset inventory does not match the equipment actually running.
You have taken measures, but cannot tell management whether they are enough.
Some equipment cannot be stopped, so you cannot deploy assessment tools.
02
Why now
Attackers already use AI. Mapping an internal environment and designing an attack path, which used to take a skilled human days, now takes hours. When a water and wastewater utility in Mexico was breached, a commercial AI discovered an industrial gateway from inside the IT environment, analyzed its authentication, and proposed how to get through it (Dragos, published 2026).
On the OT side, active scanning, patching, and agents cannot be deployed, because the equipment cannot be stopped and breaks when touched.
Only the attackers are getting faster.
03
Our approach
Evaluation
A typical assessment returns an evaluation: "this item is not in place."
Validated result
We return a validated result: "along this path, an attack actually reached this far."
From the configuration data you provide, we rebuild your plant as a digital twin and run real attack procedures in that virtual environment. We never touch production equipment.
04
Process
Go on site and reconstruct the configuration
We consolidate your scattered network diagrams, asset inventories, and firewall configurations, and our engineers verify them on site to produce a single configuration diagram. It covers the IT/OT boundary, maintenance vendors’ connection paths, and where end-of-support operating systems are still running. Your existing documents can be outdated or incomplete. Reconstructing them is the point of this step.
Validate attack paths
From the reconstructed configuration we build a digital twin and run attack procedures in a virtual environment. We confirm whether an attacker can reach critical equipment from each entry point, by validation rather than assumption. This step also identifies the conditions that allow reach: always-on maintenance connections, flat segments, end-of-support operating systems, and internet-exposed assets.
Set priorities
For each path found, we rate every countermeasure on two axes: how many paths it removes and how much burden it places on the plant floor. Instead of a thick report that assumes you will do everything, you get a document that settles what to do first, and we walk you through it in a review meeting.
05
No impact on operations
- No scanning
- We send no assessment traffic into your production network.
- No agents
- We install nothing on control equipment or endpoints.
- No downtime
- All validation runs in a virtual environment.
06
Deliverables
Consolidated network diagram, asset list, and IT/OT boundary map
List of attack paths from entry points to critical equipment, with whether each one reaches
Map of countermeasures by paths removed and burden on the plant floor
Executive summary, in a format you can attach to an approval request as is
07Standards we follow
Standards
- NISTSP 800-82r3Guide to Operational Technology Security
- CISAPrimary Mitigations for OT2025
- METICyber/Physical Security Guidelines for Factory Systems
08
What we need from you
| Item | Complimentary assessment | Full engagement |
|---|---|---|
| Network diagram | Required | Whatever you have (we reconstruct it) |
| Asset inventory / equipment list | Required | Whatever you have |
| Firewall configuration | Optional | Whatever you have |
| On-site escort | Not needed | Needed |
Network diagram
- Complimentary assessment
- Required
- Full engagement
- Whatever you have (we reconstruct it)
Asset inventory / equipment list
- Complimentary assessment
- Required
- Full engagement
- Whatever you have
Firewall configuration
- Complimentary assessment
- Optional
- Full engagement
- Whatever you have
On-site escort
- Complimentary assessment
- Not needed
- Full engagement
- Needed
Your documents do not need to be current. Having only outdated documents, or documents scattered across departments, is itself the usual starting point.
09
Complimentary assessment
Start with a complimentary assessment
Without touching production, we show you where an attack gets in and how far it reaches.
Send us your data
Send your network diagrams and asset lists.
We rebuild it as a digital twin
We build a virtual environment from the data you provide.
We validate attack paths
Using real techniques, we test whether an attack can reach your critical equipment.
We present the report
You receive the attack paths, the risks, and the order in which to address them.
Complimentary vs. full engagement
| Item | Complimentary assessment | Full engagement |
|---|---|---|
| Scope | One site, one main line | All sites, all lines |
| Input | Documents you provide only | Includes on-site reconstruction |
| Site visit | No | Yes |
| Dependency interviews | No | Yes |
| Measured recovery and degraded operation | No | Yes |
| Output | Attack paths and countermeasure priorities | The above, plus a dependency map that feeds your cyber BCP |
| Fee | Complimentary | Quoted per engagement |
Scope
- Full engagement
- All sites, all lines
- Complimentary assessment
- One site, one main line
Input
- Full engagement
- Includes on-site reconstruction
- Complimentary assessment
- Documents you provide only
Site visit
- Full engagement
- Yes
- Complimentary assessment
- No
Dependency interviews
- Full engagement
- Yes
- Complimentary assessment
- No
Measured recovery and degraded operation
- Full engagement
- Yes
- Complimentary assessment
- No
Output
- Full engagement
- The above, plus a dependency map that feeds your cyber BCP
- Complimentary assessment
- Attack paths and countermeasure priorities
Fee
- Full engagement
- Quoted per engagement
- Complimentary assessment
- Complimentary
10
Pricing
Quoted per engagement.
11
Data handling
We store the configuration data you provide in Japan under a non-disclosure agreement and use it for no other purpose. We do not share it with third parties. We submit it to generative AI services only within the scope you have agreed to in writing in advance. We return or destroy it at your request.
12
What comes next
See our Cyber BCP service →Validated attack paths feed directly into your cyber BCP. Once you know which paths reach how far, you can decide what stops and what to restore first based on validation rather than assumptions.
Contact
Start with a 15-minute conversation.
In a 15-minute meeting, we walk you through our services, how we handle your information, and pricing.
