Resilion Demo (English)

This video walks through every major area of Resilion, Hillstrong’s OT execution platform, in about 19 minutes. It starts with a map of every site in the fleet, then follows an OT security standard from draft to signed approval, runs assessments and reports, and tracks risks, tasks and evidence. It also covers process workflows, the Drawing Hub, frameworks and Kalman, the assistant built into Resilion.

Each person sees what their role needs. A CISO sees the whole program, and a plant manager sees their own site.

The demo runs in a demonstration tenant with example content for a company called Alder Forge.

Book a demo to see Resilion with your own sites, or contact us with questions.

Transcript

Welcome and dashboards (0:00)

Welcome to your demo of Resilion, Hillstrong’s OT execution platform. Over the next twenty minutes or so, I’ll walk you through every part of the product. We’ll use a live demo tenant for an example manufacturer called Alder Forge, so everything you see is the real software with realistic data. Everything starts from the menu on the left. Home holds the dashboards, followed by your organization, governance, the document library, assessments, risks and reports. Your inbox sits at the bottom of the menu, with tasks, communication and notifications. Global Site Visibility shows your entire fleet at a glance. Alder Forge has 201 sites on several continents, and every one of them is on this map. Clusters show how many sites sit in each region, so you can see where your footprint is concentrated without opening a single spreadsheet. The legend counts every site by type: 138 manufacturing plants, 45 distribution centers, six R and D facilities, and 12 corporate offices. A filter in the corner narrows the map to a single continent. Choose Europe, for example, and the map zooms in to show the sites in each country. Click any cluster, and it opens into individual sites, each marked by type. Click a site, and you see its name, location, type, plant manager and tier. Fort Worth Forging and Precision is a tier two plant, managed by Taylor Brooks. Executive Risk is the leadership view. Across the top, it shows open and critical risks, the number of frameworks in use, and remediation progress across the organization. The trend chart tracks open risks across whatever date range you choose. Response cost estimates show the cost band recorded for each risk response, without inferring exposure or return. Framework performance lists every framework in use. Each one keeps its own scoring method, so scores stay on their own scale. Every chart on the page follows the date range at the top right, so you can compare any period you like. The Health Dashboard narrows the view to a single site. Here, we’ve picked Fort Worth Forging and Precision. Site health combines three parts: coverage, maturity and risk. The page shows how much each part counts, and a button explains how health is calculated. Priority risks lists the open risks with the highest exposure at this site, along with their status and score. Further down are the site’s own assessments, with status, progress and last update. There’s also a health trend, which fills in as daily observations are collected. Tasks, in your inbox, brings the work together in one place. The summary shows total and overdue tasks, the completion rate, and the average time it takes to resolve a task.

Your organization and who sees what (2:51)

Next, let’s look at how Resilion models your organization, its sites and its tiers. Resilion starts with context, because every recommendation depends on knowing the business. Program Context holds the organization’s program profile, first set during onboarding, and you can edit any field to keep it current. Each operational site has its own card. Open one, and you see the plant-level detail that Resilion uses throughout the platform, from risk scoring to report wording. For Fort Worth, the site profile names the plant manager, the address and the time zone. The site and workforce section covers what the plant makes, its operating schedule, and how many people work there. Regulatory context lists the regulations and standards that apply to this site, written in plain language. Production impact records the business value of the site, including what an hour of downtime costs. That figure helps leadership weigh a cybersecurity risk in operational terms. And supply chain details capture whether other sites depend on this one, and how much buffer it has before deliveries slip. Site Management is the master list of every location. Sites are grouped by type: distribution centers, corporate offices, manufacturing plants and R and D facilities. The team reviews and confirms each one. The cards at the top count confirmed sites by type. At Alder Forge, every site of every type has been confirmed. Every site gets a risk tier. Tier one holds the highest-risk sites, and tier three the lowest. Tiers let one standard set stronger requirements where the stakes are higher. The table shows each site’s type, location, plant manager and tier, and you can filter by any of them. Plant managers are assigned site by site, and the people named here show up again in assessments, risks and tasks. The tiers themselves are defined during program setup. Each has a written description, so every team applies them the same way. Resilion shows each person what they need to see. A CISO sees the whole program across every site, while a plant manager sees their own site, and nothing beyond it. Access goes down to the individual. Here, a plant expert works as a viewer, with read access and no controls to change tiers or add sites.

Your OT security standard (5:12)

Next, we’ll build an OT security standard and take it from first draft to signed approval. The Launch Wizard builds an OT security standard one question at a time. It starts from the company’s own records, and alongside each question, Resilion flags what needs a decision first. Asked which framework the CISO uses for the enterprise, Resilion recommends NIST CSF 2.0, and explains why. You can accept the recommendation or choose another framework. When it suggests overlays, it cites the company policy behind each answer. And when you ask how mature the program is, it tells you what the evidence can’t prove yet. Next, you define site tiers, and keep baseline protections even at the lightest tier. Then Resilion maps 106 controls across those tiers. Each control comes with a written rationale, so reviewers can see why it applies at each level. The result is a 29-page draft standard, ready for the team to review. Ask whether to approve it, and Resilion recommends independent review first. Every document lands in Document Hub, including policies, procedures and processes. The My Work tab shows the documents you’re working on, and how many are waiting on you. Each document shows its type, your role, its stage and who it’s waiting on, from draft through review to published. At the top is a third-party remote access process, still a draft. We’ll see how that process was built a little later. From here you can open the Document Builder, upload an existing document, or check reading compliance. Open a document, and you see its owner, its contributors, and the path from draft to published. On each document, the program owner decides who contributes, who reviews and who approves. Progress lists each contributor, and shows who the draft is waiting on. Reviewers comment on the exact line they’re reviewing. Every comment, from people and from Resilion, stays with the document. And the team can talk it through in a chat linked to the standard. All Documents shows every document and where it sits in its lifecycle. Only program owners, tenant admins and executives see this tab. The Library tab is open to everyone, and shows only the published documents shared with each person. This policy was published after its contributor, reviewer and approver each signed. Signing happens inside Resilion, so there’s no separate approval form to chase. Every signature is dated and recorded, and the published version is read-only. The audit log shows who signed, down to the minute. Reading Compliance then tracks who must read each published document, and who has acknowledged it. Page opens count as telemetry only, never as proof of reading.

Assessments and reports (8:01)

Next, let’s look at assessments, and how they turn into reports. Assessment Studio is where you author your own assessments. This tenant has six templates and a library of 118 questions, built for its sites and frameworks. Templates can be surveys or facilitated interviews, and each one lists the controls it covers. You can edit, duplicate or export any template, and publish it when it’s ready. The question library holds every question, written as a statement a site can confirm or not. Clear statements make answers easier to compare from site to site. Each question maps to specific framework controls, and shows whether it’s custom or comes from a standard library. Filters narrow the library by question type, source and framework, which helps when one library serves several frameworks. You can author questions yourself, or have Resilion draft them for you. Assessment Tracker runs and monitors assessment initiatives once they’re launched. This tenant has five, and four of them are complete. Each row shows the framework, status, scope and progress. Open one, and you see each site in scope, with its plant manager, tier and assessment type. At the site level, this assessor-guided assessment shows six of six blocks complete. It ran as six interview blocks, one for each NIST CSF function, from govern through recover. Each block has a named stakeholder, a meeting type, a schedule and a status. Reports turns finished assessments into documents people can share. Draft reports save your place, so you can stop and resume at any step. The report builder has five steps. Select the assessment, set filters and scope, choose what to redact, then set branding and delivery. Reports carry the company’s own logo, fonts and colors, and you can start from a template library. The preview shows the cover before anything is generated. Here’s a finished example: a baseline assessment across three plants, written as a report leadership can read. It opens with the overall score and its band, the number of items assessed, and how many were fully covered. Then it explains each area in plain language, with the strongest and weakest areas called out.

Risks, tasks and evidence (10:16)

Next, we’ll follow risks, tasks and evidence. The OT Risk Register holds every operational risk in one place. The summary shows total risks, the mitigation rate, the top risk category and the average risk score. Each risk has a domain, status, likelihood, impact, exposure, plant and response, and you can view them together or by plant. Switch to View by Plant, and the same register is grouped site by site, so each plant manager can focus on their own risks. Open a risk, like this one on vendor remote-access governance at Fort Worth. The description records the scenario in detail: what could go wrong, the controls already in place, and the potential effects on production and delivery. Below it are the domain, exposure, response cost, plant, and the person responsible. The risk response records the treatment plan. Here, the plant manager proposed mitigation. Evidence attaches to the risk itself. And the history shows every change, who made it, and when. Risk Appetite sets limits for each category of risk: availability, compliance, cybersecurity, environmental, quality and safety. Each category carries its own written policy. The configuration tab is where you set each category’s policy and limits. The dashboard tab shows how the organization is tracking against them. Each card shows active risks, how many need action, and how many are out of tolerance. The organization roll-up repeats that view for every plant, with its tier and average exposure. Risks and findings become tasks, so someone owns the next step. Each task has a site, priority, due date, status and assignee. Tabs split the list into your own tasks, all tasks, and exception requests, so exceptions are tracked alongside the work. Inside a task, the assignee attaches evidence, and the history keeps the record. The Evidence Registry gathers all of it in one place. Files are grouped by the risk or assessment they support, so you can see what backs each record. Each file shows who added it, when, and whether it’s been verified. You can search by filename or by the text inside a document, and filter by type, status and source.

Processes (12:40)

Next, let’s turn everyday OT work into processes that capture their own evidence. Process Hub brings everyday OT processes into governance, such as change management, remote access and incident response. Active, overdue and completed runs sit at the top. Each process is a published workflow, and every run keeps its own deadlines, decisions and evidence. The Runs board shows each case at its current step, and who it’s waiting on. Open a run, and the work, the person accountable, and the progress are all on one page. Each run also has its own evidence and a timestamped history. Because the evidence is captured as the work happens, teams spend less time on administration, and you don’t need to add headcount to run the program. New processes start in the Process Builder. Here, we ask Kalman, inside Resilion, for a third-party vendor remote access process, one of the riskiest ways into a plant’s control network. Before drafting anything, Resilion asks confirmation questions, using this company’s real sites. It offers the actual roles, so we choose who requests access and who approves it. Each answer is summarized for review before Resilion uses it. A second round covers evidence, frameworks like IEC 62443 and NIST CSF 2.0, and notifications. Then Resilion proposes a complete twelve-step workflow, with approval and rejection paths. Nothing changes until a person confirms. Confirm, and the builder fills in the name, description, frameworks and site scope. The visual flow is linked, and every step names the evidence it must capture. Each evidence requirement maps to an artifact, such as an SOP, a request form or a checklist. One click drafts the full process document, and reviewers can still edit it on the page. Save it, and the draft enters the same approval lifecycle in Document Hub.

Drawing Hub (14:39)

Next, let’s open the Drawing Hub. The Drawing Hub holds engineering drawings and document figures for the tenant, such as zone diagrams, process flows and recovery dependencies. Each card shows the kind of drawing, its revision, its last update, and the result of its checks. Use New Drawing to start one, and search, sort or filter the list as the collection grows. Open one, and you see the drawing along with its approval and check status. This process flow shows the vendor remote access steps, from the request through to expiry. Revision history keeps every version of the drawing, who made each one, and its check result, so you can trace how it changed over time. The details panel records the drawing’s kind and type, its revision number, and when it was created and last updated. This recovery dependency drawing maps what a Fort Worth line needs to come back, with unproven items marked pending. The Figure Gallery offers twenty-four figure types to start from, rendered in the tenant’s own brand. Pick one, such as a comparison, a crosswalk, or a hub and spoke, and fill in your own content.

Frameworks, strategy and communication (15:48)

Next, we’ll cover frameworks, strategy and communication. Frameworks lists each framework in the program, with its version and methodology. Here, that’s CIS Controls version 8, NIST CSF 2.0, and NIST SP 800-82. On the maturity tab, you set target maturity levels, which Resilion uses for gap analysis across all plants. Add Framework brings in another framework when the business needs one, such as a new customer requirement or regulation. Crosswalk and Strategy uses your existing program to answer high-stakes framework questions, using the controls and evidence you already have. Check Our Alignment shows how your program lines up with frameworks like NIST CSF or IEC 62443. Evaluate a New Framework estimates what’s new if you add or switch frameworks, and the effort involved. Analyze Control Reuse shows which controls and evidence cover the most frameworks. And Prepare a Report builds CISO, board or customer views from the program you already have. Communication keeps the conversation inside the platform, next to the work it’s about. Chats with the team sit at the top. Below them, collaborations are tied to a specific document, assessment or task. In this thread, a plant’s control systems expert points out that a green backup status doesn’t prove a successful restore. Resilion turned the plant’s open questions into specific evidence requests. Notifications flag what needs your attention, such as overdue tasks and documents that were just published. Approval requests link straight to the document or task. And mentions bring you into the conversation where you’re needed. Each notification has a button that opens the related task, document or conversation, and you can mark everything as read once it’s handled.

Kalman, the Resilion assistant (17:40)

Last, let’s look at Kalman, Resilion’s assistant, and how it works across the platform. It opens from any page in Resilion. It works from the company’s own records, the same sites, documents and assessments you’ve seen in this demo. Ask it a question, and it answers from those records, and tells you what the evidence can’t prove yet. It drafts assessment questions in Assessment Studio. It proposes complete workflows in the Process Builder. And it turns open questions into evidence requests. In the wizard, it explained why it recommended NIST CSF 2.0, and the choice stayed with the team. Before it uses an answer, it shows a summary you can review and correct. And when it proposes a change, it waits. You can confirm it, reject it, or ask for changes. In every case, people make the decisions. Resilion recommends independent review before approval, and nothing changes until someone confirms. That covers the main areas of Resilion: dashboards, sites, documents, assessments, risks, processes, drawings, frameworks and communication. Resilion works with the team you already have, so running it doesn’t require adding headcount. Everything you saw came from a Resilion demonstration tenant, using example content for a company called Alder Forge. Thanks for watching. To learn more about Resilion, we’d love to hear from you. Please feel free to reach out.