Industrial Defender has added internal network security monitoring and a new remediation planning function to its operational technology platform, allowing operators to connect unusual communications with information about the industrial devices involved. The capabilities, introduced on 20 October during GridSecCon in Orlando, address different stages of the same security process: identifying an unexpected change within a control network and deciding how the affected equipment should be investigated or maintained. The company’s Risk Signal tool is designed to turn selected findings into prioritised work instructions rather than leave them as isolated alerts.
Internal network security monitoring, or INSM, examines communications between devices operating inside a protected industrial network. A control system may already restrict access from the internet or corporate systems, but controllers, workstations, protection devices and servers still exchange data across the internal environment. Monitoring these exchanges can reveal an unexpected new connection, an unfamiliar protocol or a substantial change in traffic volume that conventional perimeter monitoring would not identify.
The monitoring function establishes a baseline of normal device communications, then identifies departures such as an unfamiliar connection, unexpected protocol or substantial shift in network traffic. A useful baseline must account for more than normal production hours: engineering access, maintenance, plant start-up and infrequent test operations may all create legitimate changes in network behaviour. Traffic anomalies consequently require investigation rather than automatic classification as attacks, and the updated platform links each event to information already held about the participating equipment.
That context includes device configuration, known vulnerabilities, changes in installed software and a risk assessment maintained by the operator. A previously unknown connection to a low-consequence workstation is operationally different from an unplanned connection involving a protection relay or controller responsible for a continuous process. The revised platform is designed to surface that distinction during review, although the severity assigned to an event still depends on the accuracy of the underlying inventory and the plant’s own risk rules.
Each alert review can be recorded with the responsible person, date and rationale, according to Industrial Defender. Such records provide a traceable account of how an operator assessed unusual activity, including cases where an engineering change explains the traffic. The functionality supports evidence gathering for NERC CIP-015-1, the US electricity sector standard concerned with monitoring traffic within applicable bulk electric system cyber environments. Recording a review does not itself prove that a facility meets every requirement of the standard, and each operator remains responsible for its monitoring scope and procedures.
Electricity substations and generating sites commonly contain protection and control equipment that cannot be restarted or interrogated without considering service continuity. Passive observation through network taps or mirrored switch traffic can reduce the need to communicate directly with production devices, although sensor placement still determines which flows are visible. A network segment that has not been instrumented cannot be assessed through the same traffic data. Configuration inventories and approved network diagrams therefore remain part of the monitoring design alongside the sensors themselves.
Risk Signal uses that asset and network context to help order remediation work. Industrial plants may operate controllers and workstations whose firmware or operating systems cannot be changed during a production campaign or outside an approved outage. Industrial Defender says the tool compares possible patches and upgrades using the customer’s risk model, then prepares a sequence of work intended to reduce exposure while accounting for operational effort. The resulting instructions can be passed into an existing maintenance or work management system, where engineering teams can plan and authorise the changes.
A vulnerability finding is not equivalent to an instruction to patch equipment immediately. Some components control processes that must run continuously, while others can be updated during a short maintenance window. Network segmentation or a configuration change may temporarily address an exposure when a vendor patch cannot be installed safely. By correlating the affected device, its role, the vulnerability and observed communication patterns, the software is intended to support that choice without replacing a site’s formal testing, safety assessment and change approval procedures.
Industrial Defender also says the system verifies completed patches and refreshes the affected asset’s risk score. Verification requires a reliable record of the installed software or configuration after work has taken place. The company’s established asset monitoring technology collects detailed information including firmware, operating system versions and local security settings, which it can use to check whether the expected change is visible. A changed version number provides useful evidence, although full remediation may also depend on successful functional testing and on-site acceptance procedures.
Outside regulated power utilities, the same basic monitoring sequence can be applied to water treatment sites, refineries, chemical plants and manufacturing facilities. Their control networks differ in topology, operating cycles and tolerable interruption, while their regulatory duties are not identical to NERC CIP requirements. Industrial Defender has not reported a customer-wide reduction in cyber incidents attributable to these functions, so the launch establishes product capability rather than a measured security improvement across installed sites.
Deployment will require each facility to choose which internal network links are observed, identify the assets associated with the traffic and assign responsibility for investigating deviations. Remediation work must then enter the maintenance process already governing software changes, protection testing and equipment isolation. The platform provides a common record from anomaly to proposed action, but the reliability of that record depends on asset inventory quality, monitoring coverage and confirmation of the work carried out.
