Assessment Modalities — Scoped to Production Risk
- Passive assessment (zero-touch). Traffic capture at strategic aggregation points, protocol decoding (Modbus, DNP3, S7, OPC-UA, IEC 61850, EtherNet/IP, PROFINET), asset fingerprinting, and exposure analysis without sending a single packet into the control network. The default starting point in any live production environment.
- Active assessment (controlled). Authenticated and unauthenticated scanning calibrated to equipment tolerances; protocol-aware tooling; explicit exclusion of safety-critical assets unless separately scoped under an outage.
- Configuration review. PLC, RTU, HMI, historian, engineering workstation, jump server, and industrial firewall configuration audit against IEC 62443-3-3 SR mapping.
- Penetration testing — IT/OT boundary. Exploitation scoped to the iDMZ, remote-access broker, Active Directory adjacent to OT, and jump-host infrastructure. The boundary is where 80% of real incidents begin; most of the test budget belongs here.
- Penetration testing — OT-internal. Authorised, staged, and run on isolated replicas, pre-production twins, or during planned shutdowns. Never assumed safe on live plant. • Wireless and RF assessment. Industrial Wi-Fi, LoRaWAN, cellular gateways, and proprietary RF (where in scope).
- Wireless and RF assessment. Industrial Wi-Fi, LoRaWAN, cellular gateways, and proprietary RF (where in scope).
- Physical and social-engineering vectors. Badge, tailgate, USB, and vendor-impersonation scenarios — scoped explicitly and HR-coordinated.
Device & Firmware Testing (cross-linked with EmbedShield™ where in scope)
- Firmware extraction and static analysis for PLCs, RTUs, IEDs, and industrial IoT devices
- Protocol fuzzing against vendor implementations
- CVE triage and exploitability validation against the specific site configuration — not generic CVSS
- SBOM review and third-party component exposure (log4j-class failures in OT are a live risk)
- MITRE ATT&CK for ICS-aligned scenario design
- Tabletop-plus-technical exercises for SOC and plant-engineering joint response
- Ransomware-in-OT scenario (air-gap failure, backup integrity, RTO under contested conditions)
- Nation-state-grade scenarios for critical-infrastructure operators (scoped under NDA, never blog-published)
- Rules of Engagement signed by site engineering, IT security, and the named operator
- Emergency-stop protocol with a single point of contact on each side, tested before go-live
- Change-window alignment to planned maintenance, not our schedule
- Evidence preservation and chain-of-custody suitable for regulator disclosure or insurance claim