Skip to content
Pilot
How it works

Three steps from mirror port to explained alert.

Parse at the edge, think in the cloud. The sensor does what must survive an outage or must not leave the plant raw. The cloud does what needs fleet context and heavy compute.

PlantOT network
  • L3Site operations
  • L2SCADA · HMI
  • L1PLCs · drives
  • L0Process

Sensor listens · L1–L3 · SPAN / TAP

mirror copy
Edge sensorMini PC or VM
  1. Capture NIC · rx-only
  2. Protocol parsers
  3. Normalise · roll up · rules
  4. Disk queue · 30 days

↳ Full packet captures stay in the plant

outbound mTLS
EU cloudEU-owned
  1. Ingest · mTLS per device
  2. Enrich · CSAF · baseline
  3. Correlate · explain
  4. Alerts · reports · connectors

↳ Sentinel · Splunk · Syslog · Webhook

Fig. 2 — Architecture, simplified

Step 01 / 03

Mirror the traffic

A SPAN port or network TAP gives the sensor a copy of the plant traffic. The capture interface is receive-only with no IP address, so it cannot transmit onto the process network.

  • SPAN or TAP
  • Receive-only capture NIC
  • No IP on the capture side
  • Listens to Purdue levels 1–3

1–5 kbps

Typical metadata uplink for a small site. Ship kilobits, not packets.

Deployment

Installed in an afternoon. Not a six-month project.

One box, two cables and a claim code. No changes to the process network, no inbound firewall rules, no VPN.

  1. 1

    Unbox

    A pre-configured mini PC arrives with a claim code. Prefer a VM? Use the virtual appliance.

  2. 2

    Connect

    Capture port to a SPAN port or TAP. Management port to your IT or DMZ network.

  3. 3

    Call home

    The sensor dials out over HTTPS. Nothing needs to reach in.

  4. 4

    Claim and watch

    Enter the claim code. Assets start appearing in the console.

Target: under two hours from box to first asset.

Hardware options

  • Standard

    Mini PC for the server room

    • 6-core Intel
    • 32 GB RAM
    • 1–2 TB NVMe
    • TPM 2.0

  • Industrial

    Fanless DIN-rail PC for control cabinets

    • 24 V DC
    • Wide temperature
    • Fanless
    • DIN rail

  • Virtual

    Appliance image for your own hypervisor

    • OVA
    • Same software
    • No hardware
    • Bring your own server

30-day offline buffer

If the internet link drops, the sensor keeps capturing and detecting, can send alerts to a local syslog, and backfills in priority order when the link returns.

Put a sensor on one line. See what it finds.

A pilot is a real, passive deployment at one of your sites. Tell us a little about your plant and we will get back to you to scope it.

Request a pilotProduct

Passive only. Nothing on your process network changes.