Visibility and control across your industrial OT network

Automatic discovery of all connected assets: IP, MAC, manufacturer, device type, firmware, operating system, open ports, services and more. Non-disruptive.

• Automatic discovery and tagging
• Editable properties and custom fields
• Filterable and exportable – audit-ready
• Linked to the network map, alert manager and vulnerability management

Automatic calculation of current or historical network topology. Visualises all devices, their active connections and communication flows. Newly connected devices are detected immediately.

• Visualise device-to-device connections
• Drill down into asset information
• Interactive topology with filters by protocol, asset type, subnet and more

A compliance-oriented view based on the ISA/IEC 62443 model. Devices are automatically classified by Purdue level, with severity-based alerts and detection of devices assigned to unexpected or incorrect levels.

• OT/ICS compliance perspective
• Severity-based warnings and identification of deviations from good practice

Smart View

• List of wireless devices near the sensors
• Connection type
• IDs, MAC addresses, names, activity and first/last-seen dates
• Visibility of new wireless devices or anomalous behavior.

Optional active scanner, which can be disabled at plant or device level, providing a more complete inventory.

• Detection of open ports and active services on OT assets

Identifies and prioritises vulnerabilities in OT assets using the NIST National Vulnerability Database (NVD). Includes CVE, CVSS, CWE and publication dates.

• Views by individual vulnerability, by plant node and global KPIs for tracking
• Integration with commercial scanners to leverage existing subscriptions
• Prioritisation based on CVE data and operational reality: which vulnerabilities are being actively exploited and which are associated with ransomware campaigns

Allows the technical team to configure anomaly-detection strategies: detection thresholds, IDS tuning and machine-learning adaptation to the specifics of a network.

• Enable and tune each detection technique
• Configure custom alert rules
• Train machine-learning models for the specific customer network

Security incident control centre. Alerts are generated through different strategies and presented with the information required for analysis and response.

• Active alert list categorised by severity
• Advanced search, filters, mute, resolve and add notes
• Complete alert history
• Exportable – ready for SIEM and forensic analysis
• Manage directly through the web interface or API
• Configurable proactive email notifications by severity and alert type

A low-interaction decoy system placed artificially on the network. Like a canary in a coal mine, any interaction with it may indicate that an active attacker is probing the network.

• Physical or virtualised low-interaction hardware
• Detects and records adversary behaviour, including invoked URLs, executed commands and read or modified variables

Blocks malicious external connections through direct integration with the customer’s perimeter firewall. Blocking policy is configurable: informational (notify only), manual (operator decides) or automatic (with safeguards).

• Automatic detection using external IP intelligence and reputation
• Three modes: informational · manual · automatic
• Integrations: Stormshield · Fortinet · Palo Alto · Check Point · OPNsense
• Import and export IP allowlists

All network traffic is logged and grouped by source, destination, port and protocol, enabling detailed post-incident forensic analysis.

• Complete list of communications and involved devices
• Filterable and exportable to CSV
• Supports incident handling and forensic investigations

Automated, business-oriented reports with OT security KPIs. Designed to be understandable without specialist technical knowledge.

• Latest detected alerts
• Unauthorised devices
• Detected wireless assets
• Public IPs contacted
• MAC-to-IP associations
• Risk scoring for devices
• Vulnerabilities present in the network