OT/ICS security operations · air-gap native
Synaptic OT watches your industrial network without touching it, records every packet, and turns an attack into evidence and a firewall rule your team approves. One platform, fully on-premises, for plants that cannot send their data to a cloud.
The engineering workstation sends a Modbus FC 06 write to PLC-07 at 02:34, hours outside its normal pattern. Synaptic OT sees it on a mirrored copy of the switch traffic. It never sends a packet to a controller.
modbus/tcp 10.0.0.55 → 10.0.0.107:502 function 06 write single register register 40001 ← 4000 (baseline 3200–3450)
The protocol anomaly layer flags a first-seen value at an off-hours time and opens an incident. The assistant then writes a short explanation for the analyst. It annotates. It never decides.
protocol_anomaly HIGH
reasons first_seen_value · off_hours
incident INC-0412 · playbook matched
summary Setpoint write from EWS-02 at 02:34,
above the learned range for PLC-07. The Wire DVR already holds the traffic. Retro-hunt runs the new indicator across the last fourteen days and finds two earlier writes from the same workstation to PLC-03 and PLC-05. The response now covers three controllers, not one.
retro-hunt src=10.0.0.55 · tcp/502 · writes window 14 days of recorded traffic matches 2 → PLC-03 · PLC-05 pending review
Packets, decodes and the timeline are sealed into an evidence pack with an Ed25519 signature and a Merkle root. Anyone can verify it offline, with no call back to us.
evidence-pack/INC-0412
├─ pcap/ 02:31–02:37
├─ decode.json timeline.json
├─ manifest.json sha-256 per file
└─ manifest.sig Ed25519 · verifies offline The remediation card shows what to block, why, and the blast radius. The shift manager approves it and Synaptic OT exports the rule for FortiOS, Cisco ASA or PAN-OS. Nothing is pushed to a firewall automatically.
# FortiOS · exported, applied by your team
config firewall policy
edit 0
set srcaddr "EWS-02"
set dstaddr "PLC-03" "PLC-05" "PLC-07"
set service "MODBUS-TCP-502"
set action deny
next
end Adversaries now write directly to controllers over plain industrial protocols. Regulators have responded by asking for proof, not intentions: logs, evidence and audit trails that most mid-size plants don't have.
Internet-exposed Unitronics PLCs taken over at US water utilities
CISA advisory AA23-335AFrostyGoop malware uses Modbus TCP to cut heating to buildings in Lviv, Ukraine
Disclosed July 2024US agencies warn Volt Typhoon has pre-positioned inside critical infrastructure
CISA advisory AA24-038AMost plants buy detection, forensics, response tooling and compliance help separately, then try to make them talk. Synaptic OT does the whole job in one product, in the order an incident actually happens.
OT protocols decoded passively
packets ever sent to your controllers
real OT incidents in the detection corpus
MITRE ATT&CK for ICS techniques mapped
engineering project-file formats
compliance frameworks mapped
Passive intrusion detection across eight OT protocols, three deterministic layers.
Continuous packet recording, with the minutes around every incident locked and indexed.
Attack-chain graph, asset context, state replay and plain-language summaries.
Playbooks and ready-to-apply firewall rules, always approved by a person.
Tamper-evident audit log and signed evidence packs mapped to your regulator’s controls.
Each pillar is strong enough to stand on its own, and every operator gets all three. Small, mid-size and large plants run the same product, with nothing sold as an add-on.
Passive monitoring that understands industrial protocols and your own engineering projects. Synaptic OT listens on a SPAN port or TAP and never sends a packet to a controller.
What the platform does every hour of every shift: decode, detect, record, hunt, seal and hand a decision to a person.
fc=06 write_single_register reason first_seen_value reason off_hours 02:34 → incident INC-0412
Deny EWS-02 → PLC-03/05/07 on TCP/502
Illustrative values
Four or five separate purchases plus specialist staff is what OT security costs today. Most mid-size plants cannot fund all of it, so they go without. Synaptic OT gives every operator the full suite.
Upload the PLC and HMI project files your engineers already export. Synaptic OT turns them into an approved baseline, resolves registers to tag names, and catches logic downloads and connections the design never allowed.
project Line3_Packaging.L5X v2 vs v1 (active baseline) + tag write EStop_Interlock SAFETY_TAG_WRITE TIER_1 + connection IT-VLAN → PLC-07 UNAUTHORIZED_PATH TIER_2 - connection PLC-07 → Historian config drift TIER_4 decision pending engineering approval
These are architecture decisions, enforced in code. They are why regulated operators can put Synaptic OT on their control network.
The installer, threat intelligence, AI assistant and licence all work with zero internet. Air gap is the default deployment, not a reduced edition.
Visibility comes from mirrored traffic and project files. Active PLC drivers are blocked from the codebase by an automated check.
Detection is deterministic and explainable. Every response step waits for approval, and firewall rules are applied by your team.
The same installer and the same features in every tier. Choose the architecture your regulator and network allow; licensing stays the same.
Tier 1
Zero internet. Nothing leaves the site, ever.
Built forNuclear, defence, water, government and any site that forbids external connectivity
The same platform protects a refinery, a substation and a water district. Already run an OT sensor? Synaptic OT ingests Nozomi and Claroty alerts and adds forensics, response and compliance around them.
Request an evaluation licence and run Synaptic OT on a mirror port or a PCAP from your plant. Fully offline if you need it to be.