Platform
One pipeline from first packet to audit proof.
Synaptic OT is a single on-premises platform. Every packet, vendor alert and project file travels the same path, so detection, forensics, response and compliance always agree on the facts.
How it works
Seven stages, one record.
Each stage is deterministic and logged. The same data that triggers an alert is the data that ends up in the evidence pack.
- 01
Sources
SPAN or TAP on the OT network, uploaded PCAPs, engineering project files, Nozomi and Claroty alerts, Splunk, syslog and SNMP traps.
- 02
Dissect
Eight protocol dissectors decode traffic into a common event model. Project files become an engineering model of assets, connections and tags.
- 03
Enrich
Asset lookup, baseline context, tag names from your projects and vulnerability matches. Credentials in payloads are stripped before anything else sees them.
- 04
Detect
Protocol anomaly, CyOTE correlation and protocol compliance run independently. No step can block another, and none depends on AI.
- 05
Record
The Wire DVR keeps rolling capture, locks the window around each incident and indexes every packet for search and retro-hunt.
- 06
Respond
Critical alerts become incidents and match playbooks. Every action waits for a person, with blast radius and exact rule text.
- 07
Prove
Approvals, notes and evidence land in an HMAC-chained audit log and roll up into per-framework evidence packs.
Inputs
Protocols on the wire
- Modbus TCPThe most common industrial protocol
- DNP3Utility SCADA and electric grids
- OPC UAModern industrial, wire and audit log
- IEC 60870-5-104Telecontrol for power transmission
- Siemens S7commSiemens S7 PLC engineering and control
- MQTTIIoT sensors and brokers
- BACnet/IPBuilding automation, HVAC, access
- EtherNet/IPRockwell and Allen-Bradley lines
Inputs
Engineering project files
Read from the open exports your engineers already produce. Each file is stamped with an honest fidelity level.
- Rockwell L5X
- Rockwell ACD
- Schneider XEF
- Schneider ZEF
- PLCopen XML
- Siemens IEC 61850 SCD
- PROFINET GSDML
- EtherNet/IP EDS
- AutomationML
- CSV tag databases
AI, used carefully
The assistant explains. The rules decide.
Detection in Synaptic OT is deterministic. The same traffic always produces the same alert, which is what an auditor, a safety engineer and a court expect.
An AI assistant then writes plain-language alert explanations, incident summaries and tuning suggestions for your analysts. It runs inside your deployment, including fully air-gapped sites, and its output never reaches the detection pipeline. It cannot suppress an alert or change a severity, and if it is unavailable, analysts get template explanations while detection carries on.
New detection rules suggested by the assistant go through validation, replay against recorded traffic and human approval before they are promoted.
Workspaces
A view for everyone who touches an incident.
Role-based workspaces with SSO (SAML or OIDC) and TOTP multi-factor authentication. The interface is available in eleven languages, including Arabic with right-to-left layout.
SOC analyst
Alert queue, triage and investigation, retro-hunt, remediation cards.
OT engineer
Asset register, project baselines, maintenance windows, protocol decoder.
Shift manager
Approval queue with blast radius, incidents, handovers, SLA risks.
CISO and executives
Risk score and trend, heat map across sites, board-ready exports.
Compliance lead
Control scorecards, attestations, auditor evidence packs.
MSSP operator
Multi-tenant console, client consent, branding, usage metering.
Deployment
Four tiers, one product.
Full air gap, semi air gap, hybrid multi-site and MSSP. The difference between them is configuration, not a different edition.
Deployment tiers →Trust
Built like it will be audited.
Signed offline installer, generated secrets with no defaults, deny-by-default egress, published SBOMs and zero copyleft in the shipped runtime.
Trust & security →See it on your own traffic.
Request an evaluation licence and run Synaptic OT on a mirror port or a PCAP from your plant. Fully offline if you need it to be.