Manufacturing & industrial operations
Manufacturing security fails in a very specific way: the control that protects an office network is the same control that halts a production cell. Guardian Sentinel maps the plant floor passively, enforces IEC 62443 zones and conduits, and contains intrusions using actions rated for equipment that cannot be rebooted between shifts — so the incident ends at the OT boundary instead of on the shop floor.
IT/OT convergence
MES needs order data from ERP. Predictive maintenance needs vibration telemetry in the cloud. The OEM needs a remote session into the cell it commissioned. Every one of those is a legitimate business requirement, and every one of them is a conduit that crosses the Purdue boundary. Guardian instruments the boundary itself rather than pretending it is closed.
Plant engineers and SOC analysts see the same incident from opposite ends. Guardian presents an asset as a controller with a firmware revision and a criticality tag to one, and as a node with a process tree and a network path to the other — from a single record, so nobody argues about whose alert it is.
Explore network securityThe OT sensor is receive-only by design. It reads a mirrored port, never opens a session to a controller, and never issues a read request that an S7-300 might interpret as load. Active polling exists, is off by default, and only runs inside a maintenance window that you define and sign off.
How detection worksGuardian's OT playbooks act on the layer above the compromise: kill the session on the jump host, revoke the OEM's token, drop the conduit at the DMZ firewall. The cell keeps producing while the path in is closed behind it, and the operator gets a plain-language note on the HMI-adjacent dashboard explaining what changed.
See response playbooksICS & SCADA visibility
A NetFlow record tells you two IP addresses exchanged 4 kB. That is useless on a control network, where the difference between a routine poll and a sabotage attempt is a single function code. Guardian decodes 27 industrial protocols to the command level and evaluates every one against the behaviour that engineering approved.
| Protocol | Where it runs | Extracted passively | Detection it enables |
|---|---|---|---|
| Modbus/TCP | PLC to HMI and SCADA across Levels 1–2 | Function codes, unit IDs, coil and holding-register ranges, slave inventory | Write to a holding register from a host that has only ever read |
| EtherNet/IP & CIP | Rockwell control networks, ControlLogix and CompactLogix | Identity objects, firmware revision, connection paths, class and service codes | Firmware download or processor mode change outside a change window |
| PROFINET IO / PROFIsafe | Siemens distributed I/O and drive networks | Station names, GSDML roles, alarm frames, update cycle times | A rogue device claiming a station name already held by a live node |
| S7comm & S7comm-plus | Siemens S7-300, S7-400, S7-1200 and S7-1500 controllers | Run and stop transitions, block upload and download, CPU diagnostics | Program block download originating from an unapproved workstation |
| DNP3 | Large-site SCADA and on-premise substation links | Object and variation, cold restart, unsolicited response configuration | Cold restart or time-set issued by an outstation that is not the master |
| OPC UA | Level 3 aggregation, MES and historian integration | Endpoint URLs, negotiated security policy, certificate chains, subscription rates | A session negotiated with security policy None on a signed endpoint |
| BACnet/IP | Plant HVAC, clean rooms and building management | Device instance numbers, object lists, priority-array writes | Priority-array override on a clean-room air handler at 03:00 |
| IEC 61850 MMS & GOOSE | On-site substations feeding heavy plant | Logical nodes, dataset references, GOOSE stNum and sqNum |
GOOSE spoofing betrayed by non-monotonic sequence numbers |
Scroll the table sideways to see every column.
The full list also covers FINS, MELSEC, Hart-IP, CC-Link IE, EtherCAT, POWERLINK, IEC 60870-5-104, ROC, BSAP and nine vendor-proprietary engineering protocols. See the OT protocol datasheet for field-level coverage.
Legacy & unpatchable equipment
A press brake commissioned in 2004 will still be making parts in 2034. Any security programme that starts with “first, patch everything” is not a manufacturing security programme. Here is how Guardian handles the estate you actually have.
Talk to an OT consultantGuardian ships a hardened legacy agent supporting Windows XP SP3, Server 2003, Windows 7 and Server 2008 R2, with a resident footprint under 60 MB and no kernel driver on the oldest builds. It provides application allow-listing, USB device control and process telemetry without requiring an OS patch or a vendor re-certification.
Where even that is refused by contract, the machine is wrapped instead of instrumented: the sensor watches every packet to and from it, and the conduit policy limits it to the three partners it has spoken to in the last ninety days.
Correct, and Guardian does not try. Controllers are protected by controlling who may speak to them. Guardian derives an engineering-access policy from observed behaviour, pins the approved engineering workstations by device identity and user, and alerts within two seconds on any program download, mode change or firmware write from anything else.
Every controller also carries a firmware and project-checksum baseline. If the logic in the controller stops matching the logic in your version control, you know before the next quality inspection does.
This is the most common initial-access path Guardian's incident responders see in manufacturing, ahead of phishing. Vendor accounts tend to be shared, permanent, unmonitored and identically named across every customer that vendor serves.
Guardian brokers third-party access through the DMZ: each session is bound to a named human, time-boxed to a work order, fully recorded, scoped to a single cell, and terminated automatically when the window closes. Revoking a compromised vendor across all forty plants is one action, not forty phone calls.
In 640 plant assessments, Guardian has confirmed a genuine air gap eleven times. The usual findings are a cellular modem installed by an integrator for diagnostics, a historian replicating to a cloud analytics tenant, an engineering laptop that alternates between the corporate VPN and the control network, and a wireless access point serving handheld scanners on the same VLAN as the SCADA server.
The two-week passive assessment produces the list. Most customers find it more persuasive than any argument we could make.
They do, and banning removable media in a plant simply moves it out of view. Guardian enforces device control by hardware ID rather than by policy poster: approved, serial-numbered media are permitted on nominated machines, everything else is read-only, and every file that crosses is hashed, scanned and logged with the operator, machine and time.
Kiosk integration is included, so a supplier's stick is cleaned at the gatehouse before it ever reaches an engineering workstation.
Segmenting a live plant by hand is how outages happen. Guardian proposes zones and conduits from observed traffic, then runs the policy in monitor mode for a full production cycle — including the quarterly shutdown, the batch changeover and the one weekend when maintenance does things differently.
You promote the policy to enforcement only after the simulation shows zero would-be blocks on legitimate flows. Median time from first sensor to enforced segmentation across our manufacturing base is 71 days.
Production continuity
This is a composite of three Guardian incident-response engagements at tier-one automotive suppliers during 2025. The tradecraft is real, the timings are median values from the engagements, and the outcome is the one that matters: no line stopped, no ransom paid, no OT device touched by the attacker or by us.
A maintenance planner approves a push notification at 21:47 after the eleventh prompt in four minutes. The session is legitimate by every check the identity provider performs. Guardian records it and scores it as unremarkable — for now.
The same identity enumerates the file shares of the engineering group, then queries Active Directory for computer objects whose names match the plant naming convention. Guardian's identity model flags the combination — a planner account performing engineering reconnaissance from a device it has never used — and raises the session to high risk.
The attacker recovers a cached OEM service token from the planner's workstation and authenticates to a jump host in Level 3.5. Guardian correlates the token to a vendor whose maintenance window closed six weeks earlier, and opens an incident with the OT on-call rota already attached.
From the jump host, an S7comm enumeration sweep begins against the Level 2 range. The OT sensor sees read requests to CPU diagnostic blocks from a host that has never spoken S7comm in the ninety-day baseline. Severity goes critical and the automated playbook arms.
Guardian kills the jump-host session, revokes the OEM token at the identity provider, and drops the DMZ-to-Level-2 conduit to its pre-incident allow list. No controller is written to, no cell is stopped, and no operator sees anything except an advisory note on the plant status board.
The compromised workstation is reimaged during the shift change. Guardian's incident narrative — every command, every authentication, every packet on the conduit — is exported for the group CISO, the plant manager and the cyber-insurance adjuster in a single signed bundle.
IEC 62443 & regulatory alignment
IEC 62443-3-3 defines system security requirements against four security levels. Auditors do not accept a product brochure as evidence; they want the artefact that proves the requirement operates. This table is the mapping Guardian's compliance team supplies to your assessor.
| Foundational requirement | Typical SL-T | Guardian capability | Assessment artefact |
|---|---|---|---|
| FR 1 — Identification & authentication control | SL 2 | Human and service identities unified across IT and OT, with brokered vendor sessions bound to a named person and work order | Per-zone identity inventory with last-authentication and authorisation source |
| FR 2 — Use control | SL 2 | Engineering-action policy: which identities, from which workstations, may download logic to which controllers, within which windows | Signed engineering-action log with approval state and deviation list |
| FR 3 — System integrity | SL 3 | Firmware and project-checksum baselining on controllers, file-integrity monitoring on HMIs and historians | Drift report showing every controller whose logic differs from version control |
| FR 4 — Data confidentiality | SL 2 | Classification and egress monitoring for recipes, CAD, process parameters and quality records | Sensitive-data movement report by zone, destination and user |
| FR 5 — Restricted data flow | SL 3 | Zone and conduit enforcement derived from observed traffic, simulated before enforcement | Conduit matrix with permitted flows, observed flows and denied attempts |
| FR 6 — Timely response to events | SL 3 | OT-aware detection with a 3-minute managed SLA and containment actions that never write to a controller | Incident register with detection, notification and containment timestamps |
| FR 7 — Resource availability | SL 3 | Receive-only sensing, bandwidth-capped telemetry, and enforcement designed to degrade toward availability | Sensor impact statement plus the zero-stoppage record for your sites |
Scroll the table sideways to see every column.
Manufacturers of medical devices, electronics, machinery and motor vehicles are important entities under NIS2. Guardian supplies the incident-reporting timeline — 24-hour early warning, 72-hour notification, one-month final report — as a generated artefact rather than a manual scramble.
Compliance advisoryRevision 3 folds OT into the broader NIST CSF structure and puts real weight on asset inventory and network monitoring. Guardian maps its OT telemetry to the CSF 2.0 functions so one control set answers both frameworks.
See our compliance postureAutomotive OEMs increasingly run TISAX-style assessments on their suppliers, and insurers now ask for OT segmentation evidence before quoting. Guardian exports both from the same console, scoped per site.
Read the OT whitepaperDeployment
Guardian deploys into manufacturing estates in a sequence designed around the reality that you cannot take the plant down to install security. Phases one and two are entirely passive.
A sensor is connected to a SPAN port or a network TAP at the DMZ and at each Level 2 aggregation switch. Nothing is installed on a controller and nothing is transmitted to the process network. Within fourteen days you have a complete, evidence-backed asset inventory — usually the first one the plant has ever had.
Guardian proposes zones and conduits from observed communication, grouped by cell, function and criticality. Your controls engineers correct the model where the traffic lies — every plant has one flow that exists because of a decision made in 2011 that nobody documented.
The policy runs in monitor mode across a full production cycle, including a changeover and a planned shutdown. Guardian reports every flow that would have been blocked. You promote to enforcement only when that report is empty or explained.
Enforcement goes live at the conduits, agents cover the IT and DMZ layers, and Guardian MDR takes the 24/7 watch with an OT-qualified escalation path into your plant on-call rota. Median elapsed time across our manufacturing base: 71 days.
We had spent two years being told to segment the plant and two years refusing, because nobody could promise the line would survive it. Guardian simulated the policy through a full model changeover before we enforced a single rule. When we finally switched it on, the shift did not notice. That is the whole story.
Two weeks, one SPAN port, zero packets injected. Guardian returns a complete OT asset inventory, a conduit map and the list of every path into the control network that nobody documented. You keep the findings whether or not you buy anything.