// service · Assessment Technology
Sensory OT host collection
Collect from a live HMI without affecting the operator
Sensory collects asset and configuration data from live OT Windows hosts with a 5 percent CPU cap, no network traffic, and one output file on USB.
// how the engagement runs
- 01
Reconnaissance
Sensory reads the operating system, available capabilities, and a resource baseline before it collects anything. Host role and current load select the collection profile.
- 02
Governed collection
Five modules run under a resource governor that wraps every operation. When the host gets busy, collection pauses. When headroom returns, it resumes.
- 03
Single output
Everything lands in one SQLite file on operator-designated removable media. The run refuses to start if the target is a fixed, network, or system volume.
- 04
Offline analysis
The drive comes back to the analyst workstation. Parsing, entity resolution, and CVE matching happen in Prism, offsite, against an offline vulnerability cache.
// who does the work
Led by senior OT practitioners
-
Engagement lead
-
Lead assessor
-
Security engineer and architect
-
Analyst
Propose running a collector on a live HMI and the controls engineer says no. That answer is usually right. Commodity collectors were built for corporate endpoints, and a CPU spike on an operator console can cause a missed alarm.
We built Sensory from that constraint outward. It runs from a USB drive, yields whenever the host gets busy, and leaves with the drive. A four-hour run with zero impact beats a ten-minute scan that stuttered the HMI.
What Sensory will not do
- Send network traffic of any kind. It reads interfaces and never uses them.
- Write to the registry. A permission failure is logged and skipped.
- Install drivers, services, scheduled tasks, or DLLs. It runs in userspace only.
- Prompt for elevation or escalate privilege. It reports what it could not see.
- Write anywhere on the host beyond the one designated output file.
A technical annex for controls engineers covers the design laws, resource profiles, and assurance package. We walk your plant team through it before anyone touches a host. Sensory is one of four evidence sources in OT asset discovery and network visibility. Pair it with passive network capture to join host results to what talks on the wire. Book a consultation to start.
// after the engagement
The findings keep moving
Clients who want help running the fixes can put the findings in Resilion, the platform we use to run programs. Each fix gets a named owner at a named site, and the evidence lands as it closes.
See how Resilion works
// FAQ
Questions about Sensory OT host collection
- Is Sensory safe to run on an HMI or engineering workstation?
- Sensory was built for that case. The gentle profile caps it at five percent CPU and fifty megabytes of memory, and a resource governor pauses collection whenever the host gets busy. It makes no network calls, writes nothing to the registry, and installs no drivers or services.
- Where does the data go?
- Into one SQLite file on removable media that your operator designates. Sensory checks the drive type at startup and refuses to run against a fixed, network, or system volume. Analysis happens offsite in Prism, our offline workbench.
- How do we prove it did no harm?
- Every run produces an assurance package with a before-and-after host state diff, throttle events, and peak resource use. Your team can check it independently.
Talk to the people who do this work
Thirty minutes with a senior OT security practitioner. We confirm fit, plant scope, and who should be in the room. If it is not a match, we say so.