Yes, you can inventory OT assets and assess their vulnerabilities without installing sensors. For an OT Snapshot, your engineer records shop-floor traffic for 24 to 72 hours from a switch mirror port with free capture software and uploads the file. We return a device inventory, the published vulnerabilities that affect those devices and a map of remote access. Nothing is sent into the network.
An OT Snapshot is the first step of a loop: record, analyse, fix what is yours to fix, re-check with a new recording as proof, and monitor over time. Findings in the AI-assisted report cite the traffic that produced them, and Netbase JSC, the company behind SoftWSP, can connect your own AI tools to your results as a custom service. Large customers ask more and more about their suppliers' cyber security, and so do insurers. Yet the shop-floor network is where few people look: PLCs, HMIs, robots, control PCs, and remote connections that a contractor set up years ago. An OT Snapshot gives you a clear picture, without installing sensors and without touching production.
At a glance
24 to 72 hours to record
Passive only — nothing sent into the network
Delivered remotely, worldwide
The problem
Plants tell us the same things.
- A stop in production costs money every hour, and an infection can spread from the office to the shop floor.
- Nobody has a full list of what is connected, or which firmware it runs.
- Machine vendors and contractors reach the plant remotely with tools and 4G modems that nobody manages.
- Old Windows systems on HMIs and control PCs cannot be updated.
- The IT team and the engineering team each assume the other one owns the topic.
- Customers and insurers ask for evidence, and there is none to show.
Active network scanning is the usual way to find out what is on a network, but it can disturb sensitive industrial equipment. That is why we do not do it.
We analyse a network recording, known as a pcap file, that your own engineer captures from a mirror port on a shop-floor switch. We read the industrial protocols in the traffic and extract what the devices reveal about themselves.
Delivery timeline
RecordYour engineer records 24 to 72 hours of traffic from a mirror port, with free software, following our guide. UploadYou upload the file to SoftWSP over an encrypted channel, under a confidentiality agreement. ReportWe analyse it and send you the report, then go through it together with an engineer.
What do you need to prepare?
- One engineer who can configure a mirror port on a switch and run capture software for a day or more.
- A computer with enough disk space for the recording.
- A decision on the time window, ideally covering normal production and, if possible, a shift change.
- Permission, internally, to share the recording with us.
What you receive
A device inventory
A list of every device found on the shop floor, with vendor, model and firmware identified where the traffic reveals them, and how confident the identification is for each one.
Published vulnerabilities
affecting those devices, based on CISA ICS advisories and public vulnerability data.
A remote access view
Who connects from outside: TeamViewer, AnyDesk, VPNs, 4G modems or unknown internet connections.
A network separation check
Whether office and shop-floor networks are mixed, shown by what traffic actually crosses between them in the recording.
Risky behaviour
Unencrypted protocols, and write or program-download commands that come from machines that are not engineering stations.
What to do first
A short version written for the plant manager, and a detailed version for engineers and for your customers' audits.
What is in scope?
Supported
- A passive recording (pcap) taken at a switch mirror port with free capture software
- Recordings of 24 to 72 hours, or longer
- Devices you add manually to the inventory
Not included
- Active network scanning
- Installing sensors, agents or appliances
- Operating on running machines or production networks
- Applying changes such as network separation, configuration changes or firmware updates, which your engineers decide and carry out
- Patching PLC, robot or CNC firmware: we point you to the official fix from the vendor
- Devices that stay silent during the recording
Extra services
- A re-check with a new recording as proof
- Monitoring over time
See a sample report
Sample Machine SBOM & Vulnerability Report
Scope and responsibilities
The report reflects only the traffic seen during the recording. A device that stayed silent during that time will not appear. SoftWSP does not operate on running machines or production networks. Any change, such as network separation, configuration changes or firmware updates, is decided and carried out by your engineers under your plant's safety procedures and shutdown schedule. We do not patch PLC, robot or CNC firmware; we point you to the official fix from the vendor. See our disclaimer.
All the work at the plant is done by your own engineer. Nothing is ever sent into the production network.
How does a quote work?
RequestSend the quote form with OT Snapshot: Passive Shop-Floor Network Assessment preselected, or use the email and WhatsApp options on this page. Tell us about your product or site and what you need. Scoping callA short call with our engineer to confirm the inputs, the scope and what is not included. Fixed quoteYou receive a written quote for the agreed scope. Contracts and invoices are issued by Netbase JSC. DeliveryWe agree the timing with you before work starts, then deliver as set out in the delivery timeline above.
Delivered by Netbase Solution Services
- Founded
- 2012
- Reach
- Clients in around 80 countries
- Delivery model
- Remote, worldwide
- Parent company
- A brand of Netbase JSC (Netbase Enterprise Solutions and Applications Joint Stock Company)
Frequently asked questions
Do you send anything into our production network?
No. The recording is passive. Your engineer copies traffic from a mirror port on a switch. Nothing is sent into the network, and we never connect to running machines.
How long does the recording need to be?
Usually 24 to 72 hours. Longer captures show more devices, because a device that does not communicate during the recording does not appear in the report.
What software is needed?
Free capture software on a computer connected to the mirror port. Our guide lists the steps for common switches.
What about sensitive production data in the file?
The upload is encrypted and covered by a confidentiality agreement, and the file is deleted after the agreed period. Our guide also explains how to leave out office traffic you do not want to share.
Will you tell us how to fix what you find?
Yes, as recommendations. Your engineers decide whether and when to apply them, under your plant's safety procedures.
Can you identify every device?
Not always. Identification depends on what the devices reveal on the network. The report states how confident each identification is, and you can add devices manually.
Can you build an OT asset inventory without installing sensors?
Yes. The OT Snapshot works from a passive recording taken at a switch mirror port. No sensor, agent or appliance is installed, nothing is sent into the production network, and we never connect to running machines.
Can SoftWSP deliver an OT Snapshot to a company in my country?
Yes. An OT Snapshot is delivered remotely, worldwide: you send the inputs over an encrypted channel and we do the work from our side. Netbase JSC, the company behind SoftWSP, has worked with clients in 80 countries.
Do you work with companies in my industry?
Yes, if your plant runs PLCs, HMIs, robots or control PCs on a shop-floor network: discrete manufacturing, food and beverage, packaging, plastics, logistics and utilities alike. The method only needs a switch with a mirror port.
How do I pay for an OT Snapshot?
Contracts and invoices are issued by the company, Netbase JSC. You pay by bank transfer to the company account or by PayPal Business. Unless the order says otherwise, invoices are payable within 15 days.
Who do I talk to about an OT Snapshot?
Huy Nguyen (David), CEO of Netbase JSC, by WhatsApp at +84 937 869 689 (wa.me/84937869689) or by e-mail at [email protected].