Skip to content
Pilot
OT network detection & response

OT network detection for manufacturers.EU-hosted. Installed in under two hours.

A passive sensor listens to a mirrored copy of your plant traffic. It has no IP address on the process network and never transmits there. The heavy analysis runs in an EU-owned cloud, so the box in your cabinet stays small and quiet.

Request a pilotSee how it works

Pilot programme open to EU manufacturers with 50–250 employees.

LiveData path, plant to cloud
Assets
143
Open alerts
2
Uplink
3.1 kbps
Plant networkPurdue L1–L3
PLC-Line1
PLC-Line2
HMI-01
EWS-02
OT switchSPAN
Mirror copy · one-way
Aragog sensorrx-only
  • capture NIC · rx-only · no IP
  • parse · roll up · rules
Outbound only · mTLS · ~3 kbps
EU cloudenrich · match · baseline · explain

Narrative feed

14:02:07S7commwrite_varNew

HMI-01 wrote 3 values to DB12 on PLC-Line2. First time in 30 days.

  • Passive

    Never touches the process

    The capture port has no IP address and cannot transmit.

  • Sovereign

    EU-owned, EU-hosted

    Product data stays on EU-owned infrastructure in the EU.

  • CRA

    CRA Class II by design

    SBOM, disclosure policy and signed updates from the first release.

  • < 2 h

    Install in under two hours

    From unboxing to the first discovered asset.

The problem

IT security tools weren’t built for a plant floor.

Manufacturing networks run on equipment installed to last twenty years, not to be patched every month. That changes what monitoring can look like.

  1. 01

    No agents. Ever.

    A fifteen-year-old S7-300 can’t run an endpoint agent, and nobody stops a production line to try. Anything that installs software on controllers is off the table.

  2. 02

    A mirror port is the only safe view.

    The safe vantage point is a copy of the traffic from a SPAN port or a TAP. Most IT tools can’t read S7comm, Modbus or PROFINET from it. They see bytes, not commands.

  3. 03

    NIS2 made it an obligation.

    Continuous monitoring and an accurate asset inventory are now expected of in-scope manufacturers, and auditors ask for evidence, not intentions.

Why now

  1. Oct 2024

    NIS2 in force in Italy (D.Lgs. 138/2024), supervised by ACN.

  2. Sep 2026

    Cyber Resilience Act vulnerability reporting obligations apply.

  3. Dec 2027

    CRA conformity required for products with digital elements.

Explore

From mirror port to auditor-ready evidence.

Start with how the sensor stays passive, or go straight to what the console shows, what auditors receive and how MSSPs run it at scale.

Put a sensor on one line. See what it finds.

A pilot is a real, passive deployment at one of your sites. Tell us a little about your plant and we will get back to you to scope it.

Request a pilotSee how it works

Passive only. Nothing on your process network changes.