Asset inventory
What is on the network, where it sits, what it talks to, and how we found it — including the parts we could not see and why.
Solutions
What an engagement actually looks like.
Services are what you can buy. This page is the shape of the work: where we start, what we hand over, and what we refuse to do to a live process.
The sequence
Inventory, zones, enforcement, watch.
Not every engagement runs the whole of it, but it runs in this order. Skipping straight to enforcement is how a segmentation project turns into an outage.
Find out what is on the network
Passive collection while the process is live: a mirror port, a span, whatever the plant will give us. Everything downstream depends on this being right, so it gets the time it needs rather than the time it is convenient to spend. The drawings are usually older than the equipment, and the laminated one inside the panel door is not an inventory.
Map it against the levels you actually have
The Purdue model is a reference, not a description of your plant. We map what is there, work out where the zones and conduits ought to sit, and say plainly which of them already exist in name only. IEC 62443 gives us the vocabulary for zones, conduits and security levels; we use it as a design language rather than as a certificate to sell you.
Cost what enforcing it would really take
A segmentation design that cannot be funded is not a design, it is a slide. So the proposal carries the switch count, the firewall rules, the maintenance windows and the disruption, and it says which parts can wait. You should be able to argue with the number, which means you have to be able to see it.
Prove where it breaks
Testing on an agreed written scope: the industrial DMZ, jump hosts, engineering workstations, and the remote-access path a vendor opened on a Friday afternoon and forgot. Anything touching live control gear either waits for a window that was already booked, or gets tested on a bench.
Write it down, then keep watching
Every rule gets a reason next to it, because segmentation nobody documented decays into a flat network within about two site visits. Then either your team runs it with the handover pack, or our desk watches it 24×7 and a person calls you when something changes.
Constraints we work inside
Control networks are not IT networks.
Most security advice is written for IT. It assumes you can patch on a Tuesday, reboot when you feel like it, and that the worst case is a lost afternoon.
Control networks do not work like that. A controller gets a maintenance window twice a year if you are lucky. An active scan pointed at the wrong device can fault it, and faulting it is not a ticket, it is a stopped line. The engineer who commissioned the cell has long since moved on, and the only surviving documentation is a laminated drawing taped inside the panel door.
We would rather spend a week on a mirror port than take a production risk to save ourselves a day.
So we work the way the plant works. Passive collection while the process is live; active work on a bench, or inside a window that was already booked for something else.
Handover
What you are left holding.
Whoever inherits the estate should be able to tell a decision from an accident. That is the test every deliverable has to pass.
Annotated rule set
Every firewall rule and every zone boundary with the reason it exists next to it, so the next engineer does not delete it to make a problem go away.
Source and drawings
For custom software you get the source. For design work you get the drawings that match what was actually built, not the ones drawn before the change orders.
Next
Start with the inventory.
If you are not sure where to begin, that is where. Tell us what the site is and what you are worried about, and we will say what we would do first and roughly what it costs.