OT Security · Plan / Build / Operate

Cisco OT security you can actually see

In many plants nobody knows exactly what is on the network — until something stops. We make your OT network visible and segmented: with Cisco Cyber Vision, straight from the switches, without touching the machines.

Discuss OT security

4 services · OT Security

Protect production without working around it.

We make assets and communications visible, design controlled boundaries and embed security in the workflows shared by IT, maintenance and production.

Discuss your requirements

The exact scope follows your environment and its dependencies. Pricing, service hours and response targets are agreed in the proposal.

Scope

OT security from unknown network to governed zones

The path to an OT environment you know and control — made visible, contained in zones, operated audit-ready.

Asset inventory & communication map

Every PLC, HMI and fieldbus device with vendor, firmware and conversation partners — collected automatically, always current.

Vulnerabilities & risk picture

Known vulnerabilities per component, weighted by exposure and role in the plant — a working list, not a PDF graveyard.

Segmentation per IEC 62443

Zones and conduits derived from the real communication map — enforced with firewalls and Cisco ISE.

Sensor rollout in your estate

Enable Cyber Vision sensors on Catalyst IE switches and routers — no SPAN cabling, no additional appliances.

Hook-up to IT security

Events and asset context flow into ISE, firewall and SIEM — OT incidents land where your security team already works.

Operations & audit readiness

Runbooks, responsibilities and reports for audits: NIS2 reporting duties and 62443 evidence become routine instead of fire drills.

How we work

How we approach it

OT security rarely fails on technology — it fails on touching running plants. So everything starts passive, and every change knows its maintenance window.

Listen passively
Cyber Vision reads along inside the switch; the plant never notices. A complete first inventory stands within a few weeks.
Assess & prioritise
Vulnerabilities, legacy systems and risky connections ranked by impact — together with maintenance and production.
Build the zones
Segmentation in waves: non-critical areas first, then core processes — every rule checked against the real communication map beforehand.
Hand over operations
Alerts, baselines and reporting paths in steady state; your team takes over with runbooks, we stay on call.

In plain language

Why OT networks need their own security

Production networks follow different laws than office IT: availability beats everything, components live for decades, and a reboot costs real money. Put in context by engineers who know both worlds.

Why office-IT recipes fail on the factory floor

In the office the answer is: patch, reboot, replace the device if need be. In production, a controller often runs for ten or twenty years — on software that no longer receives updates, attached to machines that must not simply stop. A virus scanner on a PLC is not an option. OT security therefore works differently: it observes the network instead of touching endpoints, and protects legacy systems by controlling their surroundings — who may talk to whom, and who definitely may not.

How Cyber Vision sees without interfering

Classic OT monitoring needs mirror ports and dedicated collection appliances — effectively a second network just for watching. Cisco takes a different route: the sensor is software inside the network switch itself. Catalyst IE switches and routers observe traffic where it originates, decode more than 180 industrial protocols — from PROFINET and Modbus to OPC UA — and report only compact metadata to the central console. Your plant never notices.

Zones and conduits: segmentation per IEC 62443

IEC 62443 thinks of production networks in zones: areas with similar protection needs, connected through controlled transitions called conduits. It sounds abstract, but it is the most effective defence for the day something goes wrong — a compromised office PC simply must not reach a controller. We derive the zones from the real communication map rather than a whiteboard, and enforce them with firewall rules and Cisco ISE, step by step, without interrupting production.

What NIS2 demands from your production

The EU's NIS2 directive turns cybersecurity into a legal duty for many industrial and utility companies: risk management, a reliable picture of your own systems, reporting significant incidents within 24 hours — with management personally accountable. This is exactly where visibility pays off: an automatically maintained asset inventory and documented zones are the foundation of almost every NIS2 obligation. We build the technical base your evidence stands on.

Tools & platforms

Cisco Cyber Vision
Catalyst IE series
Cisco ISE
Cisco Secure Firewall
Splunk / SIEM
IEC 62443 & NIS2

FAQ

Frequently asked about OT security

Does the analysis disturb running plants?

No. Cyber Vision starts out purely passive: the sensors read along inside the switch and send only metadata to the console. Active discovery — targeted, protocol-conformant queries for extra detail — is only enabled deliberately, agreed with your maintenance team and never during critical process phases.

Do we need new switches for this?

Not necessarily. If Catalyst IE hardware already runs in your production, the sensor is enabled there as software. Elsewhere we start with a few sensor-capable switches at the most important points — often as part of modernisations that are due anyway. A separate collection network with its own appliances is not required.

What about legacy systems that never get updates?

They remain a reality — a fifteen-year-old controller does not become secure, it becomes protected. The tool is segmentation: the zone around the legacy system is drawn so tightly that only the necessary connections remain. Cyber Vision shows beforehand which ones those are — so no rule breaks production.

Does this concretely help with NIS2 or an IEC 62443 audit?

Yes, very directly: the automated asset inventory, the vulnerability overview and documented zones are exactly the evidence auditors ask for first — and they come from the live system instead of last quarter's spreadsheets. The organisational duties, like processes and reporting paths, we build on top of that together.

What role do ISE and the firewall play?

Cyber Vision sees and understands; enforcement happens elsewhere. Asset groups and zones flow into Cisco ISE and the firewall: ISE decides which device may join the network at all and which zone it belongs to, while the firewall controls the transitions between zones. That turns visibility into actual control.

How quickly do we see first results?

The first communication map appears within days of starting the sensors; a reliable inventory after two to four weeks of listening — depending on your plants' cycles. From then on we work with real data instead of assumptions.

Articles on this topic

OT Security · Operations

Cyber Vision as a data source: OT visibility that keeps working

Zones that ISE and the firewall enforce; baseline differences as a change watch; inventory and risk scores for evidence: what the Cyber Vision API provides — and what to connect it to.

5 min read OT security · Supply chain

CRA reporting is in force: how OT operators can respond.

The reporting duty is in force. How operators can assess vendor advisories and respond using inventories, zones and controlled communication paths.

7 min read

Related services

Security & AccessFirewalls, segmentation, NAC with Cisco ISE and vulnerability management Enterprise NetworksCampus, WAN, SD-WAN and wireless — from design to sign-off

Next step

Do you know what is on your OT network?

The first step is visibility — passive, with zero risk to the plant. After that, you decide on facts.

Ask about OT security

Assessment → first dependable change