Infrastructure hardening
OT infrastructure hardening for systems that must keep running
Direct answer
OT infrastructure hardening should reduce cyber exposure without putting the physical process at risk. Start with the process, safety constraints and actual connections. Then control the paths into and between systems, monitor without disruption, and rehearse recovery with the engineers who must keep the site operating.
Begin with process consequence
Identify the processes whose loss creates a safety, service or national consequence. Map their controllers, supervisory systems, engineering workstations, supporting identity services, vendor links and dependencies on power, time and communications. Discovery methods must be approved by the operator because control equipment may react badly to scans that are routine on an office network. The output is not just an asset list. It is an owned view of which system performs each function, who can change it, what it communicates with and what must remain available during maintenance or incident response.
Reduce and govern the paths
Use the inventory to define zones and the minimum conduits between them. Separate business services, control, safety and remote support according to consequence rather than convenience. Remove forgotten routes, broker vendor access, require named and time-bound sessions, and record changes to control logic and engineering tools. Where a legacy asset cannot be patched or authenticated safely, document the compensating control around it. Passive monitoring should establish normal communications and alert on meaningful deviation without injecting traffic into the process.
Prove the site can recover
A hardening engagement should leave tested operating procedures, not only a report. Confirm offline and protected copies of controller logic, configurations and critical documentation. Test restoration on suitable equipment or a controlled environment. Run an exercise that includes operations, engineering, safety, security and executive decision makers. Measure whether the site can isolate a suspect connection, continue in a safe mode and restore trusted control. Procurement should specify the final architecture, exclusions, training, update mechanism and support model, with ownership of data and configuration made explicit.
Next action
Request an operator-led scoping session covering the physical process, safety constraints, remote access and recovery priorities.
Sources
Related capability
View all →
Applications it supports
Capability comparisons
Questions buyers ask
What is critical infrastructure hardening?
Hardening is the work of shrinking the attack surface of the control systems behind power, water, transport and finance, rather than only watching them. It runs as an assessment of the estate as it actually is, prioritised reduction of exposure, segmentation between control and corporate networks, and verification that the fixes held. Monitoring platforms tell you what is on the network and what looks wrong; hardening changes the thing that was wrong. Our teams do that work on live grids and payment networks, with 3 GW or more of generation defended and 7.5 billion financial accounts secured.
See: What infrastructure hardening coversOT security as a capability
Best OT security vendor for SCADA and industrial control systems
The market is dominated by monitoring platforms, and two of them are genuinely good: Dragos publishes a protocol coverage list detailed enough to check against your own substations, and Claroty xDome offers passive monitoring, Edge querying and CMDB integration in one modular platform. Neither document promises to change the configuration of a relay. The Cybersecurity Group works from the same protocol depth into the control systems themselves, on estates where a reboot is not available, with substation-security technology validated by a government laboratory and deployed in the field.
See: Dragos, Claroty and the cyber group comparedIT security patterns versus OT reality
Dragos alternatives for government infrastructure
Dragos is a strong platform with deep published protocol coverage, including IEC 61850 GOOSE, IEC 60870-5-101 and 104, DNP3 and Modbus. Governments look elsewhere for two reasons: a US-headquartered platform vendor sitting inside grid telemetry, and the fact that monitoring on its own does not reduce exposure. Our hardening work covers the same protocol families, is performed on the control systems themselves, and comes from an independent, non-aligned supplier. Plenty of operators sensibly run a monitoring platform and a hardening programme together.
Which industrial protocols does the hardening work cover?
IEC 61850, Modbus and DNP3, including air-gapped networks where a false positive is treated as unacceptable rather than tolerable. Dragos publishes a longer list in public, taking in IEC 60870-5-101 and 104, OPC UA and DA and a set of vendor-specific protocols from ABB, OMRON and others, and we say so on the comparison page. Claroty's data sheet claims the broadest coverage without naming protocols. Give every bidder your own protocol inventory and make them answer against it line by line.
OT security for air-gapped networks that cannot be rebooted
Passive monitoring works anywhere you can span a switch, which is why every credible vendor leads with it. What breaks in isolated environments is the cloud dependency: xDome is described as a SaaS platform, and the Dragos brochure describes sensors and virtual appliances without stating air-gap operation. Our brief specifically covers air-gapped networks with zero tolerance for false positives, because in a substation or a payments switch acting on a bad alert can trip generation or stop settlement. Make air-gap operation and the signature update path written requirements.
See: Air-gapped and connected estates comparedHow each vendor handles isolation
Substation cyber security for IEC 61850 environments
Substations are where the IT-security playbook fails most visibly, because the protocols are real-time and the equipment predates the threat model. The Cybersecurity Group has substation-security technology built for IEC 61850 environments, validated by a government laboratory and live-deployed rather than piloted. That sits alongside zero-day discovery work credited on the US NIST register with two CVEs. Ask any bidder which of your protocols its researchers have personally broken.
See: Substation-security technology and validationResearch record compared
How is infrastructure hardening priced against an OT monitoring subscription?
Nobody in this comparison publishes prices, so compare the shape of the spend rather than a headline. xDome is a modular SaaS subscription, so cost recurs and scales with sites and assets. Hardening is scoped engineering work with a defined end state, plus whatever monitoring you choose to run afterwards. A SaaS platform in a nationally sensitive or isolated estate also carries a hosting and data-residency conversation that has to be priced, and the honest comparison is total programme cost over five years.
Does hardening replace a security operations centre?
No. Hardening reduces what an attacker can reach; monitoring and response deal with what still gets through. The two are complements, which is why many operators run a detection platform alongside a hardening programme rather than choosing between them. Our defensive practice runs alongside the hardening work, with security operations blocking more than 100,000 threats a day across grids, regulated finance and fleets at sea.
See: Defensive cybersecurity and incident responseCritical infrastructure resilience
Cyber security for power generation and payment networks from one supplier
Grids and payment systems fail differently, and the discipline underneath them is closer than most buyers expect: both are real-time, both are unforgiving of downtime, and both are defended by too few people. Our practice covers power and energy, financial infrastructure, industrial control systems and national infrastructure from one team, with 3 GW or more of generation defended and 7.5 billion accounts secured. That breadth is worth checking rather than assuming, so ask which named engineers work across both.
See: Sectors covered by the hardening practiceCyber defence for financial institutions
Our grid control systems were installed by a foreign vendor and we have no reliable documentation. Where does a hardening programme even start?
It starts with the estate as it actually is, not as the drawings claim, and that assessment is most of the value in the first phase. From there the work is prioritised reduction of exposure, segmentation between control and corporate networks, and verification that the fixes held. The knowledge produced belongs to you rather than staying with the vendor who built the plant. Our teams do this on running infrastructure, including 3 GW or more of generation, so the sequencing assumes you cannot take the system down to suit a consultant's plan.
See: How a hardening programme is runThe infrastructure hardening brief
Can a ministry use a United States OT security platform without exposing grid topology to a foreign government?
It is a procurement question rather than paranoia, and the vendor documents raise it themselves. Dragos is US-headquartered and offers Neighborhood Keeper for anonymous threat-intelligence sharing across the OT community; Claroty is headquartered in New York and pushes automatic detection updates. For a private manufacturer those are benefits. For a state whose grid topology and vulnerability register are classified, the vendor's legal home and the direction of telemetry flow belong in the risk assessment. A non-aligned supplier removes that clause from the argument, and we still recommend writing the data-residency terms into any contract you sign.
What is the difference between OT security and normal enterprise IT security, and why can we not use our existing tooling?
In an office network a noisy alert costs an analyst an hour. In a substation or a payments switch, acting on a bad alert can trip generation or stop settlement, and missing a real one can do worse. Enterprise tools also assume you can patch, reboot and agent everything, none of which is true of control systems that were commissioned before the threat existed. That is why our work is OT-native and why air-gapped coverage is stated with zero tolerance for false positives rather than treating detection breadth as the goal.
How do we know a cyber supplier can actually read our protocols rather than reselling someone else's signatures?
Ask for original research and check where it was published. Claroty publishes its Team82 group, Dragos publishes its own OT threat intelligence feeding the platform, and the cyber group has two CVEs credited on the US NIST register plus substation-security technology validated by a government laboratory. All three are real credentials that mean slightly different things: a register entry proves original discovery, a threat-intelligence feed proves sustained coverage. Ask for both, and ask which of your protocols each supplier has actually broken.
Is this live work on production infrastructure or a pilot programme dressed up in case studies?
It is live work on running systems: 3 GW or more of generation defended, 7.5 billion financial accounts secured, and substation-security technology validated by a government laboratory and deployed in the field. The teams work in places where a false positive has an operational cost, which shapes how alerts are tuned and who carries the risk when one is wrong. Ask us, and every other bidder, what the false-positive rate looks like on your protocols and who is accountable when an alert stops a process.
See: Published operational scaleScale and validation compared
Can our own engineers be trained to sustain the hardening after the programme finishes, rather than renewing a contract forever?
That should be the stated end state of any national programme, and it is how ours is framed: a path to a sovereign security-operations capability rather than perpetual outsourcing. Hardening is executed with the operators who run the systems, so the estate knowledge stays with your people instead of leaving with a consultant. Live-fire training environments, including a maritime range built around bridge, navigation and OT systems, let defenders practise on realistic replicas of what they actually run.