Cyber Defense
An OT ICS security assessment in India has one hard constraint that IT testing does not: the thing you are testing is holding a physical process together. A scan that would be routine on a corporate subnet can crash a twenty-year-old PLC and take a plant down. So we start passively, and we earn the right to touch anything.
Operational technology was built for availability and safety on isolated networks, and then quietly connected: to the business network for reporting, to a vendor for remote maintenance, to a historian in the cloud. The controllers themselves cannot be patched on an IT cadence and were never designed to authenticate anything. The security has to come from architecture.
We map the estate by listening to the traffic, place every asset in the Purdue model, and test the boundaries between levels, which is where a compromise of the corporate network turns into a compromise of the process. The same work applies to IoT fleets, where the device is small, numerous and outside your building. Segmentation findings usually continue into network architecture review.
Why you need it
01 / 06A patch window on a process line may be one weekend a year, or never. Controllers run for decades on firmware that cannot be updated without vendor sign-off and a validated restart. Compensating controls and segmentation do the work that patching does elsewhere.
Modbus, DNP3, S7 and their peers were designed for trusted serial links. They authenticate nothing. Anyone who can reach the wire can read process values and, in most cases, write them. Reachability is therefore the entire control.
Remote vendor access, engineering laptops that move between networks, USB media, wireless sensors and a historian replicating to the corporate side. We regularly find a route between the business network and Level 2 that no one on either side knew existed.
The impact of an OT incident is measured in production stoppage, equipment damage and safety, not in records disclosed. That changes which findings matter and it changes how carefully they may be tested.
Instrument
02 / 06Select a Purdue level to see what typically lives there, which protocols we fingerprint passively, and which neighbours it should be allowed to reach.
What we deliver
03 / 06A span or tap port and a listener. We build the inventory from the traffic itself (device, vendor, firmware version, protocol and conversation partners) without sending a single packet at a controller. For most clients this is the first accurate OT asset register they have had.
Modbus, OPC-UA, EtherNet/IP, DNP3, S7, BACnet and IEC 60870-5-104 identified from observed traffic, with what each conversation is actually doing: reading a value, writing a setpoint, downloading logic to a controller.
Every asset placed at a level, then the boundaries tested. Level 3 to Level 2 controls, the demilitarised zone between enterprise and process, remote vendor access paths, jump hosts, and the flows that cross a boundary they should not.
Engineering workstations, HMIs and historians as the highest-value IT-like assets in the plant: patch state, shared and default credentials, removable media policy, application allow-listing, and who can download logic to a controller.
For connected device fleets: firmware extraction and analysis, hardcoded credentials and keys, update mechanism and signature verification, the provisioning and enrolment flow, wireless and radio interfaces, and the cloud API the fleet reports to.
Active work happens only on agreed targets, in an agreed window, and by preference against a test bench, a spare unit or a scheduled outage. Where a live controller is genuinely in scope, testing is stepwise with the operations team present and a stop word.
How we run it
04 / 06The process, the plant, the vendors, the constraints and the outage calendar. We also ask what has already gone wrong, because an OT team usually knows exactly which link is fragile.
Week 0Sites, cells, network segments and devices in scope, and, more importantly, what may never be touched. Safety instrumented systems are out of scope for active testing by default. Rules of engagement are signed by both the security and operations owners.
Week 0Traffic capture at the agreed points, asset and protocol identification, and a conversation map. Nothing is transmitted toward a control device during this phase.
Days 1-4Firewall and switch configuration between levels, remote access design, engineering workstation and HMI hardening, backup and recovery for controller logic, and the documented architecture compared with what the traffic shows.
Days 4-6Only where authorised: boundary testing from the enterprise side, IT-like assets in the OT network, wireless and IoT devices, and bench testing of controller models on spare hardware. Operations staff are present throughout.
Agreed windowFindings ranked by process consequence, not by CVSS, with remediation sequenced around your maintenance windows and separated into what is achievable now and what belongs in the next capital cycle.
Days 8-10Key benefits
05 / 06Built from observed traffic rather than from a spreadsheet last updated at commissioning, including the devices, and the vendor connections, that nobody documented.
Each Purdue-level crossing is tested for what actually passes, so "it is segmented" becomes a set of rules you can point at, with the exceptions written down and owned.
Recommendations sequenced around outage windows, vendor support constraints and equipment that cannot be patched, so the plan survives contact with the operations team.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Passive discovery
OT-aware assessment
IoT and firmware
Architecture and segmentation
Frameworks
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.