OT Snapshot: see what is really on your shop-floor network

Last updated: 2026-10-19

An OT Snapshot is the first step of a loop: record, analyse, fix what is yours to fix, re-check with a new recording as proof, and monitor over time. Findings in the AI-assisted report cite the traffic that produced them, and MCP access for your own AI agents is coming. Large customers ask more and more about their suppliers’ cyber security, and so do insurers. Yet the shop-floor network is where few people look: PLCs, HMIs, robots, control PCs, and remote connections that a contractor set up years ago. An OT Snapshot gives you a clear picture, without installing sensors and without touching production.

The problem

Plants tell us the same things.

• A stop in production costs money every hour, and an infection can spread from the office to the shop floor.
• Nobody has a full list of what is connected, or which firmware it runs.
• Machine vendors and contractors reach the plant remotely with tools and 4G modems that nobody manages.
• Old Windows systems on HMIs and control PCs cannot be updated.
• The IT team and the engineering team each assume the other one owns the topic.
• Customers and insurers ask for evidence, and there is none to show.

Active network scanning is the usual way to find out what is on a network, but it can disturb sensitive industrial equipment. That is why we do not do it.

What we do

We analyse a network recording, known as a pcap file, that your own engineer captures from a mirror port on a shop-floor switch. We read the industrial protocols in the traffic and extract what the devices reveal about themselves.

What you receive

• A device inventory. How many devices are on the shop floor, with vendor, model and firmware where they can be identified.
• Published vulnerabilities affecting those devices, based on CISA ICS advisories and public vulnerability data.
• A remote access view. Who connects from outside: TeamViewer, AnyDesk, VPNs, 4G modems or unknown internet connections.
• A network separation check. Whether office and shop-floor networks are mixed.
• Risky behaviour. Unencrypted protocols, and write or program-download commands that come from machines that are not engineering stations.
• What to do first. A short version written for the plant manager, and a detailed version for engineers and for your customers’ audits.

How it works

1. Record. Your engineer records 24 to 72 hours of traffic from a mirror port, with free software, following our guide.
2. Upload. You upload the file to Softwsp over an encrypted channel, under a confidentiality agreement.
3. Report. We analyse it and send you the report, then go through it together with an engineer.

All the work at the plant is done by your own engineer. Nothing is ever sent into the production network.

What you prepare

• One engineer who can configure a mirror port on a switch and run capture software for a day or more.
• A computer with enough disk space for the recording.
• A decision on the time window, ideally covering normal production and, if possible, a shift change.
• Permission, internally, to share the recording with us.

Scope and responsibilities

The report reflects only the traffic seen during the recording. A device that stayed silent during that time will not appear. Softwsp does not operate on running machines or production networks. Any change, such as network separation, configuration changes or firmware updates, is decided and carried out by your engineers under your plant’s safety procedures and shutdown schedule. We do not patch PLC, robot or CNC firmware; we point you to the official fix from the vendor. See our disclaimer.

Next step

The first five plants receive an OT Snapshot free of charge in our Design Partner programme. Ask for the recording guide and we will send it.

Join the Design Partner programme