OT security and plant uptime · Domain Intelligence Pack
Plants keep producing while attacks on controllers and remote access are stopped, and the control room keeps the final say.
Overview
A stopped line costs money every minute, so plants cannot patch on the office’s schedule. Vendors keep remote access open for convenience. Ransomware that starts in the office can halt production even when no controller is touched, because nobody can be sure the plant is safe to run. Plant and IT teams get the same facts from Ollandi. Threats stop at the plant boundary, and every process decision stays with the people who run it.
By listening passively, Ollandi learns each zone’s normal traffic, which devices talk to which, and which vendors connect when.
Ollandi raises a case for an unapproved logic change, a vendor session that outstays its job, or office malware creeping toward the plant. Equipment faults that warn of an unplanned stop get the same attention.
Every case is framed in plant terms: the line, the asset, the permit, and what it could mean for production and safety.
Ollandi’s reach stops at access and network paths. Process and safety decisions belong to your operators.
In an incident
An illustrative case, step by step, from the first signal to a confirmed result.
At 1 a.m., a vendor’s remote session writes a new setpoint to a pump controller. No permit covers it.
Ollandi ties the write to the jump host, the vendor account, and this week’s permits. The process is stable, but the session came from an address the vendor has never used.
The remote session is ended at the jump host. The setpoint change and a recommendation go to the control room, where operators decide what happens to the pump.
Controller state, access, and every decision are kept for the site’s safety and security review.
Connections
Ollandi reads passive network sensors in your plant zones, asset inventories, historians, and jump hosts, alongside office identity and network data. Nothing is installed on controllers, and plant data can stay on site under an on-premises license.
Domain Intelligence Packs
Packs check one another’s work. A strange sign-in found in one domain can confirm, or rule out, what another domain found.
Close the cloud gaps attackers look for first: public storage, open ports, and roles with more access than they use.
Stolen credentials stop working at the first sign of misuse, whether they came from phishing, a SIM swap, or a leaked key.
An intruder moving between servers is stopped at the next hop, and a failing link is flagged before transactions fail.
Ransomware contained on the first device it lands on, long before it can reach a file server or a backup.
The legacy systems the business still depends on stay up and defended, including the ones nobody on the team owns anymore.
Reachable flaws in your code and dependencies come with a fix ready to merge, and bots and account takeovers stop at sign-in.
When a stolen account starts copying customer records, the leak stops early, with evidence ready for your regulator.
Get dark sites back on air faster, with crews sent to the real fault and signaling fraud shut down as it starts.
Engineers go out only when a visit will fix the fault, and jackpotting is cut off before the cassettes empty.
FAQ
No process change happens without your control room. Ollandi acts at the access and network layer, such as ending a remote session, and only within your rules. Anything that touches the process reaches operators as a recommendation, with the evidence.
No. Ollandi listens to plant networks and reads asset inventories, historians, and remote-access records, so field devices run exactly as before.
Yes. Every vendor session is checked against permits and maintenance windows. Sessions that run late or come from new places are flagged, and can be ended at the jump host when your rules allow.
Get started
Bring a vendor session or controller change that worried your team. We will lay it against your permits and process data, and show what Ollandi would have done.
