Engineering · OT Audit Appliance
A box that listens in — and delivers the audit evidence with it.
From my engineering practice, I developed my own tool: a portable, purely passive appliance for security and compliance audits in the plant network. It automatically inventories the communicating devices, monitors industrial traffic, reports anomalies in plain language — and generates the audit-ready report for your NIS2 risk management. Entirely on-premise, no cloud.
01 The Starting Point
Built from practice, not on a drawing board.
In consulting, I keep seeing the same fundamental problem: before anyone can talk about NIS2 measures, compliance or architecture, the foundation is missing — a complete, reliable picture of what actually exists in the OT network and what communicates with what. Classic IT tools don't fit, because they can cause damage in a production plant. So, as an engineer, I built my own tool that closes exactly this gap.
The Problem
Active scans are taboo in OT — any intervention in the network can disrupt a controller or trigger a plant shutdown. At the same time, NIS2 and IEC 62443 require a complete asset inventory and demonstrable risk management. Many companies face exactly this contradiction: they're expected to create visibility but must not touch the plant while doing so.
The Idea
An appliance that only listens — a copy of the network traffic via a SPAN port and the log messages from firewalls, switches and servers. From this pure listening it builds a complete operational picture: devices, communication relationships, vulnerabilities, anomalies. It sends nothing into the OT network itself and technically cannot disrupt production.
02 Key Features
Six characteristics that make the difference.
Purely passive
The box only listens and never sends packets into the OT network. It technically cannot disrupt, block or trigger production — the most important principle in any plant.
On-premise
No cloud backend, no phone-home. All data stays in the plant. Internet is only optional, to update vulnerability and threat lists — and even that works offline.
NIS2-focused
One automatic inventory, one finished PDF report, targeted audit preparation — prepared for NIS2 risk management and usable for IEC 62443, BSI and other frameworks.
Audit-ready
Presentable evidence at the push of a button: executive summary, incidents, critical alerts, MITRE overview and zone status — instead of days of manual work in Excel.
OT-native
Understands the industrial language of machines (Modbus, S7, EtherNet/IP, DNP3 …), detects process anomalies and maps every device to the Purdue model — not just the surrounding IT traffic.
Complements the SIEM
Not a competitor to existing security systems, but the OT supplier: the box forwards its findings to the central SIEM via Syslog, CEF, LEEF or webhook.
03 How It Works
From the wire to an assessable incident.
Every single observation passes through the same chain. That's the core: a raw event becomes, step by step, an understandable, classified incident — enriched with asset role, open vulnerabilities and threat context.
Capture
Different log formats are translated into a unified event (normalization).
Assess
Baseline (what's normal?), rules (what's forbidden?) and process anomalies check every event.
Alert
Anything notable becomes an alert — with asset role, vulnerabilities, threat matches and priority.
Correlate
Related alerts are bundled into an incident and mapped to MITRE ATT&CK for ICS.
04 A Look Inside the Product
This is what it looks like in action.
Three views of the interface — captured in a simulated plant environment in which the appliance detects an attack in progress.
ALL SCREENSHOTS FROM A SIMULATED PLANT ENVIRONMENT — NO CUSTOMER DATA.
05 Modules
Each view its own tool.
The appliance bundles several specialized modules — each a distinct perspective on the same passively captured data.
01 Asset Inventory
The automatic register of all devices on the network — the basis of every audit. Devices are detected and added from every event, manageable with zone, criticality and owner.
02 Network Topology
An interactive map: who talks to whom? Switchable to the Purdue model view. Forbidden zone crossings are instantly highlighted in red — the classic in any OT audit.
03 OT Protocols
The view into the industrial language of machines. Detects protocols and function codes — such as read versus write commands to a controller, or program downloads on the network.
04 Process Anomalies
OT-specific anomalies directly at the production process: sudden standstill, slow drift, activity outside shift hours or a reading outside the permitted range.
05 Vulnerabilities
Detected products are matched against the official CVE database and the "actively exploited" list (CISA KEV) — prioritized by actual risk.
06 Audit Report
The finished evidence as a PDF at the push of a button — with executive summary, incidents, MITRE overview and zone status, mapped to NIS2, IEC 62443 and BSI.
06 The Core
FlowSR — where deterministic methods hit a wall.
Rules, signatures, baselines — deterministic methods are the foundation of all detection, and they are good. But in real plants they are not enough: the traffic is incomplete, the sensor coverage patchy, and the decisive question stays open — what is this device, really, and what does this connection do?
So I built an extra layer on top of them and gave it a name: FlowSR — Flow Signal Reconstruction. A machine-learning core I built to reconstruct network flows and infer device roles from incomplete traffic. Where the deterministic methods hit a wall, FlowSR fills the gaps.
Four questions FlowSR answers from raw flows
Device role
Is this a PLC, an HMI, a historian, an engineering workstation or a network device? — recognized by its communication fingerprint.
Function
Does a connection probably read, write, download a program or send a control command?
Traffic shape
Cyclic control, bulk transfer, request/response or data stream — independent of the port used.
Machine vs. human
Is there an automated process behind a connection, or a human at the keyboard?
A connection becomes meaning.
A bare connection becomes an understandable classification — e.g. “probably engineering workstation → PLC, program download, manual, outside shift hours — worth checking”. Without new hardware, without cloud, without intervention in production.
And everything existing gets smarter.
The baseline, rule and process-anomaly engines know what's normal and what's suspicious — FlowSR adds the missing semantic layer on top and says what a device is and what a flow does. So “a connection is unusual” becomes a prioritizable “write access to a suspected PLC”.
FlowSR enriches the network map by role, adds context and blast radius to alerts and incidents, and enables role-aware baselining — for instance when a PLC that normally only responds suddenly starts initiating connections itself.
The principle: maximum from minimum. The leverage is greatest exactly where the least sensor coverage is available.
07 Deployment & Role
Where the appliance comes into play.
In the assessment
I deploy the appliance in my assessments wherever it is the fastest route to an OT situational picture — portable, connected in minutes, non-intrusive. The results feed directly into your NIS2 risk management: asset inventory, communication matrix, vulnerability overview, audit-ready report.
In continuous operation
For continuous OT monitoring I recommend — vendor-neutral — the platform that fits your plant, your team and your budget, whether Claroty, Nozomi, Dragos or another. The appliance does not replace that decision; it delivers the data foundation for making it on solid ground.
Access control
A box inside a sensitive OT network must meet the highest standards itself: role-based login (RBAC), API tokens and a complete audit log of every single action — part of the design from day one.
Traceable
Every detection is substantiated and traceable back to the triggering event — no black box. That is exactly what makes the findings audit-ready.
Curious how this would look in your plant?
I'd be glad to show the appliance in a live demonstration and discuss how passive OT visibility translates concretely to your environment.