OT security, in plain language.

Physical or logical isolation of a network from the internet and other untrusted networks. Many nuclear, defence, water and government sites require it by regulation or contract.

Synaptic OT is air-gap native: Tier 1 runs with zero internet connectivity.

A protocol for building automation such as HVAC, lighting and access control.

A learned model of normal behaviour, such as which hosts talk, which function codes they use and the usual range of values, against which anomalies are measured.

The EU Critical Entities Resilience Directive, which requires designated critical entities in sectors such as energy, transport, water and health to assess risks and strengthen their resilience against disruption, including cyber incidents.

The Indian Computer Emergency Response Team, whose directions set incident-reporting and log-retention obligations for organisations in India.

Divergence between how a system was designed or approved and how it actually behaves or is configured, such as an unauthorised logic change or a new network path.

Synaptic OT detects drift by comparing approved project files with live traffic.

An EU regulation that sets cybersecurity requirements for products with digital elements, including vulnerability handling, security updates and software bills of materials, phased in from 2026.

Cybersecurity for the Operational Technology Environment, a U.S. Department of Energy programme whose Idaho National Laboratory corpus documents real OT incidents and their observables.

Decoding network traffic beyond addresses and ports into protocol fields, for example the Modbus function code, register and value of a write.

Distributed Network Protocol 3, used heavily in electric and water utilities between control centres and outstations such as RTUs.

The computer engineers use to program PLCs and change control logic. Unexpected activity from an EWS is a high-value attack signal.

Synaptic OT lets you register authorised workstations and maintenance windows to tell planned work from attacks.

An industrial protocol carrying the Common Industrial Protocol (CIP) over Ethernet, widely used with Rockwell Automation and Allen-Bradley equipment.

A sealed bundle of packets, decodes, timelines and a signed manifest that shows what happened during an incident and that the evidence has not been altered.

A control design in which automated systems recommend actions but a person must approve them before anything changes. In running plants it prevents automated responses from causing outages or safety events.

The screen operators use to view and control a process. Good HMI practice shows normal states in grey and reserves colour for abnormal conditions.

A telecontrol protocol common in European and Middle Eastern power grids for communication between SCADA masters and substations.

The international series of standards for securing industrial automation and control systems, covering risk assessment (62443-3-2), system requirements (62443-3-3) and more.

An observable artefact, such as an address, file hash or protocol pattern, that suggests malicious activity.

The collection of control devices, networks and software that runs an industrial process, including SCADA, DCS and PLC-based systems.

Germany’s term for critical infrastructure. Under the BSI Act, KRITIS operators must deploy systems for attack detection and are audited on it.

Synaptic OT provides passive OT attack detection, logging and incident evidence.

A public knowledge base of adversary tactics and techniques used against industrial control systems.

A simple, widely used industrial protocol with no built-in authentication or encryption. A single function code 06 write can change a setpoint on a controller.

A lightweight publish-subscribe messaging protocol widely used by IIoT sensors and brokers.

Managed security service provider: a company that monitors and manages security for multiple client organisations.

The Operational Technology Cybersecurity Controls issued by Saudi Arabia’s National Cybersecurity Authority for organisations operating industrial control systems.

The UK National Cyber Security Centre’s outcome-based framework used to assess operators under the UK NIS Regulations.

Mandatory Critical Infrastructure Protection standards for the North American bulk electric system.

The UAE Information Assurance standard, originally issued by the National Electronic Security Authority, that sets security controls for critical sectors in the UAE.

A hardware device inserted on a network link that passes a copy of all traffic to a monitoring tool, without affecting the original traffic.

The EU directive on network and information security that raises cybersecurity and reporting obligations for essential and important entities, including energy, water and manufacturing.

A modern, platform-independent industrial interoperability standard with optional security features and an audit-log mechanism.

Hardware and software that monitors and controls physical processes, such as PLCs, RTUs, DCS, SCADA and safety systems, as opposed to information technology (IT) that handles data.

A system that monitors industrial network traffic for malicious or anomalous activity, using knowledge of industrial protocols rather than generic IT signatures.

Observing network traffic without sending any packets to devices. In OT it avoids the risk of crashing fragile controllers that active scanning carries.

Synaptic OT is strictly passive and never sends packets to controllers.

The standard file format for recorded network packets, used for forensic analysis and replay.

A ruggedised computer that reads sensors and drives actuators according to a control program. PLCs usually cannot run security agents, so they are protected through network monitoring.

Synaptic OT watches PLC traffic passively and compares program downloads against approved project files.

A reference architecture that layers industrial networks from Level 0 (physical process) through Level 1 (basic control), Level 2 (supervisory), Level 3 (site operations) and a DMZ (Level 3.5) to Level 4 (enterprise IT).

A field device that connects sensors and equipment at remote sites, such as substations or pumping stations, to a central SCADA system, often over DNP3 or IEC 60870-5-104.

Searching previously recorded traffic for indicators that were only discovered later, to find out whether and when an intrusion began.

Siemens’ proprietary protocol for programming and communicating with S7 PLCs.

Supervisory control and data acquisition: software and networks that let operators monitor and control geographically spread equipment from a control centre.

The team, processes and tools that monitor, investigate and respond to security events.

A virtual SOC lets a small team cover several plants from prepared cases.

A machine-readable inventory of the components inside a piece of software, used to track vulnerabilities and licences. CycloneDX and SPDX are the common formats.

Synaptic OT ships CycloneDX 1.5 and SPDX 2.3 SBOMs with every release.

A switch feature that copies traffic from chosen ports to a monitoring port, so a sensor can observe network traffic without being in its path.

A log in which each record is cryptographically linked to the previous one, so any edit or deletion breaks the chain when it is verified.

The IEC 62443 approach to segmentation: group assets into zones with common security requirements and allow communication only through defined conduits.