Production lines, substations, water treatment and building systems run on controllers that were never designed to be attacked, and that cannot be patched or rebooted on a Tuesday afternoon. Aureon brings visibility, detection and response to industrial environments without ever putting the process at risk.
Most industrial networks are flat, undocumented and reachable from the corporate side through paths nobody remembers. Engineering workstations, vendor laptops and remote access tools talk directly to PLCs and safety systems. An intrusion that would be an inconvenience in IT becomes a physical safety event in OT.
We start by listening. Passive sensors at the right points of the network build a complete inventory of assets, protocols and conversations without sending a single packet to a controller. From that baseline we detect what should not be happening, validate segmentation, prioritise the vulnerabilities that matter and respond to incidents with procedures agreed with the people who run the plant.
Passive sensors on mirror ports at the industrial DMZ, the site operations layer and the control network see every conversation and never send a packet to a controller. Telemetry flows to a central console where analysts with process context triage what matters.
Attacks on industrial systems rarely start at the PLC. They start on an engineering workstation, a vendor laptop, a remote access tool or a corporate path that should not exist. Monitoring covers the whole chain, from the enterprise boundary to the safety systems.
PLCs, RTUs, DCS controllers, HMIs, SCADA servers, historians, engineering workstations, drives and IoT devices identified from network traffic, with vendor, model, firmware and role, and kept current automatically.
Deep inspection of the protocols your plant actually speaks, including Modbus, S7, EtherNet/IP, PROFINET, DNP3, IEC 104, OPC UA and BACnet, down to the function codes and registers being read and written.
A learned baseline of normal process communication, with alerts on new devices, new conversations, unexpected writes to controllers, configuration downloads, firmware changes and known attacker tradecraft against ICS.
Mapping of your network against the reference architecture: which zones exist, which conduits cross them, where corporate IT reaches control systems and which paths a firewall rule was supposed to close.
Firmware and software versions matched against vendor and government advisories, prioritised by exposure, exploitability and process impact rather than by score, with compensating controls where patching is impossible.
Visibility of maintenance sessions, vendor connections and remote tools, with alerts outside agreed windows and evidence of what was done during each session.
Industrial alerts handled by analysts who understand process context, integrated with our 24/7 detection service and with your SOC and SIEM, with response playbooks agreed with operations and safety teams.
Containment and investigation procedures that respect production and safety constraints, evidence from controllers, historians and engineering stations, and recovery coordinated with your automation partners.
Risk assessments, security levels per zone, policies and evidence for IEC 62443, NIS2 and sector regulators, built from the real inventory rather than from a questionnaire.
Design and validation of IT/OT separation, industrial DMZs, secure remote access and monitoring points, sequenced with planned maintenance windows.
Passive sensors deployed at switches and boundaries during normal operation. No scanning, no agents on controllers, no change to the process.
Complete inventory, protocol map and zone model, reviewed with automation and operations engineers who know what each device does.
Exposures ranked by process impact: unsegmented paths, exposed engineering functions, vulnerable firmware in reachable assets, uncontrolled remote access.
Continuous detection with analyst triage, playbooks agreed with the plant, and incident response that treats safety as the first constraint.
Clear, usable outputs for executives, technical teams, insurers and regulators.
No. Discovery and detection are passive: sensors receive copies of traffic from switch mirror ports or taps and never send packets to controllers. Any active check is agreed in advance, limited to specific assets and scheduled in maintenance windows.
Especially then. Knowing which vulnerable assets are reachable, closing the paths that reach them, monitoring the conversations that touch them and detecting misuse are the controls that work when patching does not.
Yes. Building management, access control, HVAC, lifts and energy systems speak the same industrial protocols and are often the least supervised part of a site.
Industrial alerts are triaged by analysts with process context and forwarded to your SOC or SIEM with the detail they need. Many clients combine it with our managed detection service so that IT and OT incidents are handled by one team.
Attackers bought search ads for the word chatgpt, published fake Custom GPTs on the real ChatGPT domain and sent users to a counterfeit Cloudflare check that ends with a PowerShell command. The domain is no longer the signal. The instruction is.
Read article
Sophos links a campaign it tracks as STAC4924 to the group behind Vice Society and Rhysida. The chain hides shellcode as English words, fetches its servers from a forum profile and leaves a Python tunnel on the host. No encryption has been seen yet, which is exactly the point.
Read article
In September 2025 a single supplier's passenger handling system went down and three of Europe's busiest airports fell back to pen and paper. A year on, September 2026 brought a state government leak, a hypervisor exploit in ransomware hands and a transport group knocked offline. The pattern holds.
Read articleWant to know what is really connected to your plant network? Ask for a passive OT visibility assessment.