Engineering Is Cyber: Closing the Gap Between OT Security Plans and the Plant Floor

Most operational technology (OT) security programmes are judged by the documents they produce, while the plant, the vessel or the pipeline is judged by whether it keeps running. Those two measures drift apart quickly. A site can hold a current risk assessment, a mapped control framework and a signed-off policy set, and still be unable to say with confidence which controllers are on the network this week, what firmware they run, or who changed a configuration last Tuesday.

At DacTAPE we start from the floor and work up. Standards such as ISA/IEC 62443, ISO/IEC 27001 and the EU Cyber Resilience Act (CRA) matter, but they only hold value when the evidence behind them comes from the systems themselves and when the work fits into the daily routine of the people who operate them. Our aim is to keep operations safe and functional first, and to let compliance follow from that.

What asset owners are dealing with

The problems we hear from operators, OEMs and integrators are consistent across oil and gas, maritime, utilities and manufacturing. Very few of them come down to a missing product.

• No trustworthy asset picture. Inventories live in spreadsheets, engineering drawings and the memory of a senior technician. They are out of date the day after the audit, and nobody owns reconciling them.
• Legacy hosts nobody wants to touch. Older Windows engineering stations and HMIs run critical processes, cannot take an agent, and are often outside vendor support. They are also the hosts most likely to be exposed.
• Tools bought, value not realised. Many sites already paid for a monitoring platform or a vulnerability scanner. The data sits in a silo, alerts lack plant context, and the team lacks the hours to tune it.
• Regulatory pressure arriving faster than budgets. NIS2 supplier requirements, the CRA for manufacturers and customer security questionnaires all ask for evidence the organisation cannot yet produce without weeks of manual work.
• Advice that does not survive contact with the site. Large assessments produce long reports written for the boardroom. The electrician offshore or the controls engineer at the plant receives a list of findings with no clear first step.
• Digitalisation and AI plans built on poor data. Digital Twin and AI initiatives assume clean, enriched asset and process data. Most organisations do not have that foundation, and the gap shows up after the investment is committed.
• Thin specialist staffing. Experienced OT security practitioners are scarce. Smaller asset owners cannot justify a full-time hire, and large ones cannot staff every site.

Why DacTAPE exists

I grew up around people who kept fishing boats, logging camps, rigs and small towns running. Over my career I worked on one of the first widely recognised industrial firewalls, built an early industrial intrusion detection system, did research on holistic asset management, and spent years on binary analysis, supply chain security and penetration testing. The lesson I took from all of it is that our industry often does cyber the wrong way round. Technology should serve the people who own, operate and maintain these systems, and good service still means what a handshake used to mean. Companies grow when they invest in their people, their facilities and their products, and we intend to earn our growth the same way: by being useful to clients first.

Founder and Chief Architect

That view shapes how we work. We give experienced, cost-effective advice even when a client is not ready to buy every feature, and we would rather solve a real problem at one site than sell a programme that looks good on a slide.

Consulting that starts with what you already own

• Technology-backed assessments - current, evidence-based view of assets, exposure and priorities, sized to the business rather than to a fixed methodology.
• Compliance audit and support as a service - Gap analysis and ongoing evidence for ISA/IEC 62443, ISO/IEC 27001 and the CRA, without a full-time compliance hire.
• OT security and digitalisation advisory - senior practitioner on call for architecture, incident questions and roadmap decisions.
• Digitalisation and AI preparation - data and corpus design, process alignment, integrations, role definitions and an investment and deployment roadmap.
• Product and appliance pre-selection reviews - independent testing, total cost of ownership and compensating controls before a purchase is committed.
• Data source and product integration - existing monitoring, scanning and historian data connected so it can be used, not just stored.
• Third-party risk analysis - a practical view of supplier and OEM risk, aligned with NIS2 supply chain expectations.
• Research and special projects - focused technical work where off-the-shelf answers do not exist.

Each recommendation names an owner, a first step and the operational effect, so the people on site can act on it and their managers can see the result.

Where the platform backs the advice

Most site teams are already stretched, and a findings report adds to their workload. Where a client wants help with that work, the DacTAPE platform takes on the asset collection, reconciliation and reporting that would otherwise fall to them, and frees engineers for the problems that need their judgement. It is the functional layer that comes before the Digital Twin: it acquires and enriches asset data so that operations, security, compliance and future AI initiatives all draw on the same trusted source.

1. Acquire. Collect asset and network data with minimal disruption, using DacTAPE Remotes, agentless collection that reaches legacy Windows hosts, or a monitoring investment the client already owns.
2. Enrich. Merge duplicate records, resolve identity and add context such as lifecycle state, patch status and known vulnerabilities, with a reviewable history of every change.
3. Augment. Turn that inventory into findings, topology and alerts that make sense to an engineer, written in the terminology the site already uses.
4. Enable. Produce compliance evidence, reports and status for leadership, and a clean data foundation for Digital Twin and AI work when the organisation is ready.

The platform runs on premises and is vendor agnostic, so sensitive operational data stays with the asset owner. The interface is designed for the person doing the work first, whether that is a controls engineer, an auditor or a remote security operations centre (SOC) analyst, and gives their managers proof of work without extra reporting effort.

Engineering is cyber, but not all cyber is engineering. We make it safe and functional.