Monitoring that understands what the process should be doing.

Monitoring built around the process, not a generic baseline

Detection is designed from your operational consequence model: which functions must keep running, what normal traffic looks like between which zones and conduits, which engineering actions are expected and which are not. A configuration download to a controller outside a maintenance window means something specific in a plant; in an enterprise baseline it means nothing at all. Collection is passive throughout — network observation, log and event sources, and existing platform telemetry. We do not scan production networks, and we do not place anything in line with a control path.

Security control effectiveness, measured rather than assumed

Controls degrade quietly. Firewall rules accumulate exceptions, a sensor stops receiving from a segment after a switch replacement, a log source drops out, an allow-list drifts after a vendor visit, a backup job fails silently for months. Shield tracks whether each control in scope is still doing what it was installed to do, and reports the gap the week it opens rather than at the next assessment. Where a control has stopped working, you get the operational consequence of that gap, not just the technical finding.

Firewall management — policy lifecycle, not rule editing

Rule base ownership across the IT/OT boundary and between industrial zones: change request review against a documented policy intent, business and engineering justification recorded per rule, rule hygiene and removal of what is no longer needed, and object and naming discipline so the policy stays readable to whoever inherits it. Every change is raised, reviewed and implemented inside your change control and within your maintenance windows. We propose and prepare; your process approves.

Active Directory management for the OT domain

The OT domain is frequently the single most consequential and least maintained system on a plant network. Shield covers privileged account inventory and review, service account governance including the accounts that exist because a historian or an HMI needed one years ago, group policy baseline and drift, authentication and logging configuration, and the trust relationship with the enterprise domain. That last item is where most IT/OT exposure actually lives, and it is a design decision rather than a setting.

Escalation and incident coordination with decision rights agreed in advance

Who is called, in what order, within what time, and who is permitted to decide what — written down and tested before it is needed. When something is detected, you receive the observation, the affected operational function, the credible interpretations including the operational ones, and containment options with the production consequence of each option attached. The decision belongs to operations. A service that quietly isolates a segment at three in the morning is not a mature service.

Reporting, documented blind spots and continuous tuning

Coverage is stated as what is monitored and, explicitly, what is not — unmonitored segments, serial links, air-gapped cells, systems whose vendor agreement prevents log collection. Named blind spots can be funded and closed; assumed coverage cannot. Detection logic is tuned on a standing cadence as the plant changes, because a turnaround, a new line or a migration will invalidate a baseline that nobody revisits.

An alert nobody is authorized to act on is a record, not a defense.

What it covers

• Analyst attention during your working day, in your site's time zone, on the working days agreed in the service definition.
• Monitoring, control effectiveness measurement, firewall policy management and OT Active Directory management, all four delivered in full.
• Detection continues to run and events continue to be collected outside those hours. What pauses is the analyst reviewing and escalating them, not the collection.
• Queued events are triaged at the start of the next covered period, with severity ordering applied so the oldest is not automatically the first.

Who it suits

The gap is real and we state it in the service definition rather than in a footnote: an event beginning on a Friday evening may not be reviewed by an analyst until Monday morning. Whether that is acceptable is a consequence judgment your operations leadership makes, not a judgment we make for you.

• Operations where the loss of a critical function takes hours rather than minutes to become a safety or production event, and where a process upset would be noticed by shift staff long before a security analyst saw it.
• Sites that do not run continuously, or that run unattended overnight with limited change activity.
• Organizations with no one available to receive a call at three in the morning. Round-the-clock detection escalating to a phone nobody answers buys the appearance of coverage rather than coverage.
• Estates where the honest first priority is monitoring quality and blind-spot closure during working hours, before extending the clock.

What it covers

• Analyst attention at every hour, including nights, weekends, public holidays and the periods when industrial estates are least staffed and most changed.
• The same four capabilities as 8×5. Nothing is withheld from the lower model and nothing additional is unlocked by the higher one.
• Escalation against the agreed matrix at any hour, which only produces value where your side of that matrix is also staffed at any hour.
• Turnaround and shutdown periods covered as they run, when vendor access, temporary connections and out-of-hours engineering activity are all at their peak.

Who it suits

What 24/7 does not change: containment authority still sits with operations, no analyst makes a production decision at any hour, collection remains passive, safety systems remain out of scope, and firewall and directory changes still run through your change control and your maintenance windows. A faster clock does not create authority that the service was never designed to hold.

• Continuous processes where minutes matter: operations in which loss or manipulation of a function moves toward a safety, environmental or major production consequence faster than a working-hours review cycle can respond.
• Organizations with their own people on shift who can receive a call and act on it, because escalation is only as fast as the slowest link in it.
• Regulated entities whose obligations require demonstrable detection and response capability outside working hours.
• Multi-site estates spanning time zones, where any single working day leaves another region uncovered.

Alerts that reach the right person

Escalation paths and decision rights agreed in advance and exercised, so a detection at two in the morning produces a phone call to someone with authority rather than a ticket waiting for Monday.

Control drift caught in weeks, not years

A failed log source, an orphaned firewall exception or a stale privileged account surfaces as a reported gap with its operational consequence, instead of appearing in the next audit.

Coverage you can state accurately

A written, current picture of what is monitored and what is not. Being able to name your blind spots is what allows them to be funded and closed.

A team that keeps its own capability

Your people stay in the escalation path and in the service reviews, so knowledge of the environment accumulates inside your organization rather than only inside ours.