Security built for the factory floor
Know whether the plant can keep running before you shut it down.
Levels
| Purdue level | What lives there | ARRTECH |
|---|---|---|
| 4 and 5 | Directory, mail, ERP, VPN and the internet edge. | Full fit: SIEM, Detection, DLP and SOAR. → |
| 3.5 | Firewalls, jump hosts, remote access, historian replicas. | SIEM receives syslog, flow and Windows logs; Detection baselines them. → |
| 3 | Engineering workstations, HMIs, OT domain controllers. | Windows logs by agent or WEF, where your control system vendor allows. → |
| 0 to 2 | PLCs, RTUs, safety systems, field devices. | Not read. ARRTECH never talks to a controller. → |
IT/OT incident
Decide whether the plant can keep running
After an intrusion, the key question is whether the attacker crossed from office IT into plant systems. ARRTECH shows what crossed the network boundary, so you decide on a restart from evidence.
IEC 62443
Monitor OT without touching controllers
IEC 62443 is the international standard for securing industrial control systems. ARRTECH only reads the logs your boundary systems and plant computers already send, and never talks to a controller.
Removable media
Control USB on plant computers
USB drives are a common way for malware to reach plant computers. ARRTECH DLP approves each device by serial number, and a manager signs off on each exception.
Remote plants
Keep collecting when a site goes offline
Plant links can drop for hours. The ARRTECH agent holds logs while a site is offline, sends them when the link returns, and shows when each source last reported.
By rule
4 and 5
Directory, mail, ERP, VPN and the internet edge. ARRTECH: Full fit: SIEM, Detection, DLP and SOAR.
3.5
Firewalls, jump hosts, remote access, historian replicas. ARRTECH: SIEM receives syslog, flow and Windows logs; Detection baselines them.
3
Engineering workstations, HMIs, OT domain controllers. ARRTECH: Windows logs by agent or WEF, where your control system vendor allows.
0 to 2
PLCs, RTUs, safety systems, field devices. ARRTECH: Not read. ARRTECH never talks to a controller.
Questions
What will you touch on the control network?
Nothing on the machines that run production. ARRTECH SIEM only receives the logs your boundary systems and plant computers send. Cyberdroid AI Detection reads a copy of those logs and changes nothing.
What if a site loses its connection?
The agent holds the logs and sends them when the link returns, and you can see when each source last reported.
Can we control USB drives on plant computers?
Yes. ARRTECH DLP allows or blocks each device by make or serial number, with a manager approving exceptions, on Windows computers your control system vendor allows.
Who decides containment?
A person. ARRTECH SOAR emails the approver up to five options and waits. Nothing runs until they reply.
What stays with you?
The production controllers themselves, your OT asset inventory and industrial protocol monitoring. Cyberdroid AI Detection reports about once an hour and never blocks.
Sources
Guide
What is IEC 62443?
IEC 62443 is the international standard series for industrial automation and control system security.
How do you monitor OT without disrupting production?
Collect logs passively from the IT/OT boundary and site computers, and never connect to controllers.
Does NIS2 apply to manufacturers?
Yes. NIS2 covers manufacturers of machinery, vehicles, electronics, chemicals, food and medical devices.
Next steps
Spot unusual behavior early. Learns what normal looks like for every user, computer and application from your SIEM, and flags what changes.
Get the evidence fast. Investigates each finding with read-only queries and hands a person the evidence. It never approves its own work.
Keep sensitive data in. Checks email, uploads, USB drives and AI prompts before sensitive data leaves the computer.
Respond with a person in charge. Runs incident response steps through your existing tools, with a person approving each decision.
See every system. Collects and signs logs from more than 500 source types and links related events, with a verification tool for every export.
