// service · Assessments
OT asset discovery and network visibility
Know what is on the plant network before you touch it
A defensible OT asset inventory and network map built from passive, offline evidence. Plant teams approve every method before anything runs.
// how the engagement runs
- 01
Method review
Plant engineering, IS, and controls leads review every collection method before anything runs: binaries, scripts, resource ceilings, and export procedures. Site owners sign off host by host.
- 02
Evidence collection
Host collection on Windows assets, SPAN captures at the core and boundary, firewall policy and log exports, and one read-only Active Directory export. Every method is offline and passive.
- 03
Analysis and reconciliation
We parse the imports in Prism, our offline analyst workbench, resolve each asset across host, network, firewall, and directory evidence, and match vulnerabilities against an offline CVE and CISA KEV cache.
- 04
Baseline and handoff
You get a per-site asset register, network map, supportability ranking, and findings register, in formats built for NAC and monitoring onboarding.
// who does the work
Led by senior OT practitioners
-
Engagement lead
-
Lead assessor
-
Security engineer and architect
-
Analyst
Somebody logs into a plant switch to check a config and gets the factory auto-configuration prompt. Uptime reads five years. Nobody has the password to the next switch. The plant has no asset list, no network map, and no downtime window to go find out.
Taking ownership of a brownfield OT estate starts with an inventory you can defend. We build it from four passive sources: host collection with Sensory, passive network capture, a firewall policy and log analysis, and an Active Directory exposure audit. Evidence leaves the plant by hand on removable media. Nothing in the toolchain connects to your network.
How we keep it safe
- Prism reads the files your team produces and hands over. It never queries your environment.
- Collectors are code-signed and documented method by method. Your OT team reviews what runs before it runs.
- The host collector sleeps above five percent CPU or memory and writes exactly one file.
- Network collection is passive: no IP on the monitored interface, no frames originated, nothing installed on your switches.
Start with one plant, the site with the worst documentation and the least downtime available. A 30-minute consultation confirms fit, the method approval path, and pricing.
// after the engagement
The findings keep moving
Clients who want help running the fixes can put the findings in Resilion, the platform we use to run programs. Each fix gets a named owner at a named site, and the evidence lands as it closes.
See how Resilion works
// FAQ
Questions about OT asset discovery and network visibility
- Does asset discovery put production at risk?
- No. Every collection method is offline and passive. The host collector pauses above five percent CPU or memory, the network collector has no address on the wire, and our analysis workbench never connects to a plant network. Your plant engineering, IS, and controls leads approve each method before it runs.
- What evidence do you collect?
- Host collection on Windows assets, SPAN captures at the core and the boundary, firewall configuration and log exports produced by your team, and one read-only Active Directory export. We resolve each asset across all four sources.
- What can we do with the output?
- The asset register exports for CMDB import and NAC onboarding. The network map and findings register feed segmentation, monitoring, and remediation decisions, and every finding traces back to the import that produced it.
Talk to the people who do this work
Thirty minutes with a senior OT security practitioner. We confirm fit, plant scope, and who should be in the room. If it is not a match, we say so.