The article
Your controls vendor wants a permanent remote connection to the line's PLCs. Corporate IT wants its new security agent on every computer, including the ones that run the line. The maintenance lead says nothing touches the machines during a production run. Each of them is partly right, and none of them owns the decision. That is the moment for OT cybersecurity consulting: someone who stands between the office and the plant floor and turns three opinions into one plan.
I have been building software for 18 years. Since 2017 my team of 70+ specialists has delivered 150+ projects, and clients rate us 5.0 on Clutch from 26 verified reviews (as of September 2026), none of them negative. Below is how we approach a plant, and the red flags that should stop any OT cybersecurity consulting firm, us included, before it touches your network.
OT cybersecurity consulting: the short version
| What | How it works |
|---|---|
| For whom | Manufacturers, utilities and facilities whose controllers, HMIs and networks run a physical process |
| What we look at | Your control systems, the link between office IT and the plant floor, remote access for vendors and staff |
| How risks are rated | Against IEC 62443 and NIST's guide to OT security |
| How we work | Passive methods first; anything active is agreed with your engineers and scheduled |
| What you get | An inventory, rated risks and a roadmap that fits your maintenance windows |
| Price | The first call and the rough estimate are free; the work is estimated before it starts |
| After that | Your team, your vendors or our industrial cyber security services put the plan in place |
Why a plant is not an office
An office can restart a laptop at lunch; a production line cannot stop because a security tool wants a reboot. NIST's guide to operational technology security (SP 800-82, revised in September 2023) names what sets these systems apart: performance, reliability and safety. In practice:
- Equipment lives for decades, often on software its maker no longer updates.
- A patch needs a stop: the vendor's approval and a maintenance window, and some devices cannot take one at all.
- A scan can do harm: network probing that a laptop ignores can hang an older controller.
- Safety has its own owners, and any security change goes through them.
On the office side, laptops, email and cloud accounts fall under cybersecurity in general.
What our OT cybersecurity consulting services cover
Five pieces of work, in this order, because each one rests on the one before it:
- An inventory of controllers, HMIs and the networks between them: what each device runs and who can reach it. A device nobody listed is a device nobody protects.
- The link between office IT and the plant floor: every path down to the machines from the office, the cloud or the internet, drawn or not.
- Remote access for vendors and staff: who connects, how, with whose approval, and whether anyone sees what they changed.
- Risks rated against IEC 62443. Its risk assessment part, 62443-3-2, splits a system into zones - equipment with the same security needs - and conduits, the connections between them, and gives each a risk rating and a target security level.
- A roadmap that fits your maintenance windows: each change with its window, its owner and a test with your engineers before it touches production.
How it goes
- A free first call about your sites, your lines and who maintains what. If you need an NDA, we sign it before you share any details.
- Documents first: network drawings, asset lists, vendor contracts and remote connections. Whatever is missing, drawing it is the first piece of work.
- A passive look: interviews with operators and maintenance staff, configuration files and copies of network traffic your engineers provide. Nothing is sent to a controller.
- Active steps by agreement only: a scan or a test of a remote access path is scheduled into a window and run with your engineers.
- Ratings and the roadmap, zone by zone; then the changes, made by your team, your vendors or our engineers, one window at a time.
From your side: one engineer who knows the line, the documents you have, your maintenance calendar and a person who approves each active step.
What the price depends on
The work is estimated before it starts. What moves the estimate:
- how many sites, lines and networks are in scope;
- whether drawings and an asset list exist or have to be made;
- how many vendors connect remotely, and how;
- whether the assessment stays passive or needs active tests;
- whether you want our engineers to carry out the roadmap too.
Red flags before anyone touches your plant network
In October 2026 I read the first five company pages Google showed for this search. All five sell monitoring. Two name IEC 62443, two mention passive methods, and only one mentions remote access at all; none mentions maintenance windows, and none publishes a price. Five pages are a small sample, so hold anyone you consider, us included, to the table below.
| Red flag | Why it matters | Ask for instead |
|---|---|---|
| An active scan of the production network in the first days | An older controller can hang under a scan | Passive discovery first; active steps scheduled and watched |
| "Patch every controller" as step one | Patches need the vendor and a stop; some devices cannot take one | Zones and access rules that protect a device while its patch waits |
| A roadmap with dates but no maintenance windows | Operations will set it aside | Every change tied to a window and an owner |
| Office security tools installed on plant computers as they are | An agent can slow or break the software that runs the line | Anything new on plant machines tested first with your engineers and the vendor |
| Remote access through a shared password or a connection that is always open | Nobody can say who connected or what changed | Named accounts, approval for each session and a log |
What should stay yours
Whoever you hire, the results belong to the plant, not to the consultant. Ask in writing for the inventory and the drawings as files your engineers can edit, the remote access accounts in your company's name, and a roadmap whose owners are your people, so it outlives any contract.
When you need something else
- One machine, no network. If nothing connects to a controller, lock the cabinet, control its USB ports and keep a copy of its program.
- Protection run day to day. Zones, secure remote access, monitoring of plant traffic and a practiced recovery plan are industrial cyber security services, not consulting.
- A rule that names your assessor. If a regulation or a contract says who must assess your sites, that party does it; ask your compliance advisor whether one applies. Our compliance consulting prepares the evidence.
- The office is the worry. Laptops, email and cloud accounts belong to cybersecurity consulting in general, or to risk consulting that rates them next to the plant.
Where to start
Start with the site whose downtime costs the most, or the one with the most remote connections; its roadmap becomes the template for the rest. Around it sit a security strategy for the whole company, an incident response plan tested before you need it, and monitoring consulting that decides what to watch on the plant network before you buy a tool.
On weekdays from 9 am to 6 pm Miami time we reply to a new request within 30 minutes. Tell us about your sites, and we reply with how we would assess them and a rough estimate, free.
