OT SOC FAQ

No. We monitor the platform you already own. No new sensors or software required. Your platform keeps doing the passive visibility and detection. We do the part that needs people: reading the alerts, deciding what matters and telling you.

The leading OT visibility and threat detection platforms. Tell us what you run and we'll confirm fit on the first call.

Yes. If your sites run different OT visibility platforms, we can monitor them together and give you one escalation path and one monthly report.

Yes. Continuous coverage is the full service: every hour, weekends and holidays. If you do not need that, we also offer nights and weekends, or a single shift.

Yes. Many teams start with the hours their own people are off, then expand once they see the value. The onboarding work carries over.

Under 24/7/365 coverage, holidays are covered like any other day. Under nights and weekends or single shift, we agree the holiday schedule with you during onboarding.

Yes. We work with organizations that have one site and those with several. Each site gets mapped into the escalation procedure and contact tree. Sites with different time zones, shift patterns or remote assets are fine. We confirm how each one reports during the platform review.

No. Analysts work through read-only access inside your environment. Alerts and logs stay with you. Customer data is never stored on analyst endpoints. A data processing agreement spells out what alert data leaves the environment, if any.

Through your secure remote access platform or a hardened jump host. Never a plain VPN. Access is least-privilege, MFA is on every account, and sessions are logged and recorded.

Our L1/L2 analysts work from a secured SOC in the Philippines. Leadership and OT escalation are US-based.

We escalate to your named contacts through the procedure we agree on during onboarding, with the context your team needs to act. Confirmed findings go to US-based OT specialists first, so the message you get is written by someone who understands the process.

We monitor, triage and escalate. Response and remediation stay with your team. We can connect you with response partners if you need help.

Alerts we handled, findings we escalated, the rationale behind severity calls, and platform connectivity issues we saw. A quarterly asset true-up keeps the baseline current.

An IT SOC watches endpoints, email and cloud. Our analysts watch OT alerts from your plant networks, and they know what a PLC, an HMI and an engineering workstation should be doing.

A deployed OT security platform and a secure remote access option. If you don't have remote access set up, we'll recommend one. We also review the platform with you, so we know what it sees and what it does not.

It depends on your environment. We'll give you a plan and timeline after the first call.

By the size of your environment and the coverage you need. We'll quote after a short scoping call.

Yes. Ask for a virtual walkthrough.

We'll tell you during onboarding. If it needs work, we can scope a readiness project before monitoring starts.

Teams that already own an OT visibility platform but have nobody watching it consistently. Usually one to ten sites and a lean OT or IT security team. Often the platform was bought after an assessment or a compliance push, and the alerts now sit unread on nights and weekends.

Yes. Engineering firms and integrators can offer it under their name or ours and keep the client relationship. See the partners page.

No. Deployment, upgrades, sensor maintenance and detection engineering are not part of the service. Detection engineering and extensive tuning are also outside the service. If the platform needs that work first, we can scope a readiness project.