Can it run without an internet connection?

OTMATIX runs on your own site office network with no internet connection, and the licence is validated offline against your hardware.

Where does OTMATIX actually run?

On your site business network at Purdue Level 4, outside the control network. Plant teams reach it from any browser on the office network they already use.

How is our data kept apart from other customers?

Every tenant has its own database, so one operator or site never shares storage with another.

How is OTMATIX licensed?

The licence is RSA-4096, bound to your hardware and validated offline, so it never needs to call home.

Which standards does it support?

ISA/IEC 62443, NIST SP 800-82r3, NERC CIP, NIS2, NCA OTCC-1:2022 and ISO/IEC 27001:2022 among 250+ frameworks, plus your own standards and OEM requirements.

Can we add our own framework?

Your own standards, OEM requirements and sector regulator catalogues sit beside the built-in frameworks, mapped clause by clause to the same universal control library.

Does work for one framework count for the others?

Every framework is mapped to one universal library of 1,400+ controls, so an assessment done for one counts toward the others, clause by clause.

Is OTMATIX an OT GRC tool?

OTMATIX orchestrates OT cybersecurity end to end. Governance, risk and compliance are built in, together with assessments, evidence, deviations, patch, change, supply chain and access, so a separate OT GRC tool is no longer needed.

Who assesses each control?

The asset owner, site OT security and an independent assessor can each assess a control. The most independent verdict stands, so nobody marks their own homework.

How does evidence stay current?

Every piece of evidence carries an expiry date. When it lapses it stops counting, and the Assurance Score shows how much weight each claim can bear.

What if something cannot be patched?

It is covered by a formal deviation with compensating controls on every affected asset, reviewed in stages and with an end date. Nothing stays excepted by default.

Do the AI agents make decisions?

The AI layer is optional. Agents draft findings and answer posture questions. Your team accepts or rejects every suggestion.

What can the AI layer do?

Autonomous agents review the control library and assessments and draft findings. Chat agents answer posture questions in plain language.

How do OEMs and integrators take part?

Suppliers answer through a secure link with no vendor accounts to manage, are scored across fifteen risk domains and are linked to the assets they support.

Who delivers OTMATIX?

The OT security team at OT Associates, pure play OT security, serving oil & gas, power & utilities, water, manufacturing, transportation and nuclear.

What happens in a demo?

A walkthrough built around your sites, your asset classes and the standards you answer to, on a real Purdue layout. We reply within one business day.

Request a demo

OrchestrateOT Cybersecuritywith Asset Level Precision.

Nine modules, one engine. Every asset governed, assessed and proven, everyEvery finding driven to an action, every action taking risk down.

Request a demo

Assets

396

PLC-07

Compressor train B

Governance4 apply

Default credentials removed

Online edits logged

Key switch custody logged

Remote programming blocked

Complianceassessing

Assessing PLC-07 against 4 controls…

BCMRTO 1 h

PLC-07 supports

Grid dispatch

3 dependencies · recovery plan due for test

TPRM15 domains

Supports this asset

Helix Controls

risk score · lower is safer

Deviations1 active

HMI patching waits for turnaround

compensating control · until Mar

Evidence Vault

1,284proofs

6 expiring within 30 days

Mitigation2 open

Plan segmentation of L2 and L3

Test the historian restore

Risk3 open

Closed actions land here

Flat network between L2 and L317

Unsupported Windows on nine HMIs14

No tested restore for the historian11

14.0/ 25 average

Assets

396assets

Governance

4apply

Compliance

…assessing

Evidence

1,284proofs

Mitigation

2open

Risk

14.0/ 25

Deviations

1active

TPRM

18vendor score

BCM

1 hRTO

Governance · 4 controls apply to PLC-07 · Compressor train B

The command view

Every site, every asset. One view, without touching the process.

Risk by site, cluster and asset class, with every figure traced to a real asset and a real piece of proof.

Command · Multi-site portfolio

LIVE

Command. Every site on one board, ranked by risk and backed by proof.

agents on your controllers

1,400+

controls in one library

250+

frameworks, clause by clause

Level 4

office network, never the control network

ISA/IEC 62443NIST SP 800-82r3NERC CIPNIS2NCA OTCC-1:2022ISO/IEC 27001:2022Sector regulator cataloguesCustom frameworksOEM requirementsNational CI regulationISA/IEC 62443NIST SP 800-82r3NERC CIPNIS2NCA OTCC-1:2022ISO/IEC 27001:2022Sector regulator cataloguesCustom frameworksOEM requirementsNational CI regulation

Why OTMATIX

IT security tools were never built for a plant.

Controllers run for thirty years, patches wait for turnarounds and scanners can trip a process. OTMATIX was designed around eight realities of OT.

01 / 08

The reality

Obsolescence

Controllers outlive their vendor support.

How OTMATIX answers it

Every asset carries its lifecycle state and vendor support status. Anything that cannot be upgraded is covered by a formal deviation with compensating controls, and the deviation expires on schedule.

Lifecycle state per assetVendor support statusDeviations that expire

How it works · Micro Governance

Assurance, built up from a single controller.

OTMATIX starts at the individual asset and builds upward, so every figure on the command view traces back to a real asset and a real piece of proof.

Step 01 · Bind

Every controller carries only the controls that apply.

Each asset gets its own statement of applicability. A control for a PLC is not a control for a historian.

A statement of applicability per asset
Not applicable only with a recorded reason
Drawn from one library of 1,400+ controls

Statement of applicability

PLC-201

14 of 1,400+ controls

✓SR 1.1 · Human user identification
✓SR 2.8 · Auditable events
✓SR 3.4 · Software and information integrity
✓SR 5.1 · Network segmentation
✓SR 7.3 · Control system backup
–SR 4.3 · Use of cryptography N/A · reason recorded

Step 02 · Judge

Three assessments. The most independent stands.

The asset owner, site OT security and an independent assessor can each assess a control. Nobody marks their own homework.

Owner, site security and independent assessor
The most independent verdict is the one that counts
No self-certified compliance

SR 3.4 · Software and information integrity

Asset ownerCompliant

Site OT securityPartial

Independent assessorPartial

The most independent verdict stands: Partial

Step 04 · Expire

Exceptions end. No renewal button.

Deviations and temporary access have end dates. Nothing stays excepted by default.

Every deviation and access grant has an end date
Compensating controls tracked while it runs
Closed with a fix, never quietly renewed

Deviation · HMI-07 legacy OS

Active

Compensating controls

3 of 3 in place

Affected assets

Approved by

Site OT security

Expires

in 62 days

Close with a fixRenew

Step 01 · Bind

Every controller carries only the controls that apply.

Each asset gets its own statement of applicability. A control for a PLC is not a control for a historian.

A statement of applicability per asset
Not applicable only with a recorded reason
Drawn from one library of 1,400+ controls

Statement of applicability

PLC-201

14 of 1,400+ controls

✓SR 1.1 · Human user identification
✓SR 2.8 · Auditable events
✓SR 3.4 · Software and information integrity
✓SR 5.1 · Network segmentation
✓SR 7.3 · Control system backup
–SR 4.3 · Use of cryptography N/A · reason recorded

The platform

Twelve modules. One governed plant.

Know the plant

Govern and assure

Keep it running

Assets · Asset register01 / 11

Know the plant

Asset Register

One OT-native register from SCADA servers to safety systems, with an accountable owner and a custodian for each.

Also in the platformChangePatchVulnerabilityAccess governance

Coverage · the Purdue model

From the enterprise down to the valve.

OTMATIX runs at Level 4 and governs what matters at every level below, in the language your engineers already use.

Enterprise ITIndustrial DMZOperational technologyNo agents below the DMZ

Enterprise

ERP, email, corporate IT

Exposure

Risk decisions made without any view of plant-floor reality.

OTMATIX governs

✓Risk appetite per site
✓Board-level command view
✓Policy ownership and review cycles

Level 1 of 7

Who it’s for

One orchestrator for everyone who answers for the plant.

For Plant managers

See which sites, areas and assets carry the risk.

Risk by site, cluster and asset class on one command view
Every figure traced to a real asset and a real piece of proof
Deviations that expire, so nothing stays excepted by default

Plant view · Risk by area01 / 05

Deployment and safety

Close to the plant. Never on the control network.

OTMATIX runs at Purdue Level 4, on the site office network your plant teams already use. It never reaches into the DMZ or the control network, so it cannot disturb a live process.

Where it sits

Level 4, beside the people who answer for the plant.

L5EnterpriseERP, email, corporate IT

L4Office network · site businessOTMATIX runs here

OTMATIX server⟵ browser ⟶EngineersOperatorsManagers

3.5Industrial DMZNo connection crossesNo crossing

Control network · untouched0 agents · 0 scans · 0 connections

L3Site operationsHistorians, EWS, OT domain

L2SupervisorySCADA, HMI, alarm servers

L1Basic controlPLC, RTU, relays, SIS

L0ProcessSensors, actuators, valves

Connections into OT

No agents, no scans and no data pulled from Level 3 and below. Teams assess equipment where it is and record the result at Level 4.

On the office network

Engineers, operators and managers on site use any browser on the Level 4 network. No new firewall rules toward the control network.

4096-bit

Isolated and offline-ready

A separate database for every tenant. RSA-4096 licence validated offline, so no internet connection is needed.

Opt-in

Optional AI layer

Agents draft findings and answer posture questions. Humans still decide.

Three Zone 2 assets have evidence lapsing. Accept drafts?

Why not spreadsheets

Built for OT. Not adapted to it.

Seven things an OT programme needs, and how each approach covers them.

Capability

SheetsSpreadsheets

IT GRCTypical IT GRC tool

Built for OTOTMATIX

Controls bound to each individual asset

Partly

OT standards built in, clause by clause

Partly

Evidence that expires and stops counting

Independent three-pass assessment

Deviations with compensating controls and an end date

Partly

Patching on OEM approvals and turnarounds

Runs at Level 4, never on the control network

Fully covered

1 / 7

0 / 7

7 / 7

CoveredPartly coveredNot covered

Watch

The case for OTMATIX, in under two minutes.

Then take the narrated briefing: fifteen stations, about eight minutes. Open any station on its own.

The reality

The method

Running it

1:56 · narrated · captions below

0:00 / 1:56

Built to run. Industrial control systems are built to run for thirty years. Their security was never designed to last that long.

FAQ · Technical specifications

Questions, answered.

Topics

Deployment4 questions

Technical specifications

The details, on one sheet.

Deployment: Purdue Level 4, on the site office network. No internet needed.
Footprint on the process: None. No agents, no scanning, no connection into OT.
Data isolation: A separate database for every tenant.
Licensing: RSA-4096, hardware-bound, validated offline.
Control library: 1,400+ controls in one universal library.
Frameworks: 250+ mapped clause by clause, plus your own.
AI: Optional agents draft and answer. People decide.
Industries: Oil & gas, power, water, manufacturing, transport, nuclear.

Delivered by the OT security team at OT Associates.

Q04Deployment

Does it connect to our control network?

Never.

OTMATIX does not reach into the DMZ or the control network: no agents, no scans, no data pulls and no new firewall rules toward OT. People assess equipment where it is and record the result at Level 4.

0 connections into OTNo firewall changes

Ask an OT engineer

Q11Standards

What is an OT security orchestrator?

One engine.

A single platform that runs the whole OT security programme: it knows every asset, binds the controls that apply to it, assesses and proves them, turns gaps into findings, actions and deviations, and rolls the result into risk. OTMATIX is the first built for OT and ICS.

Asset-level precisionGovernance to risk

Ask an OT engineer

Q01Deployment

Does OTMATIX install anything on our controllers?

No.

Nothing is installed on controllers and nothing scans the network. Your teams assess where the equipment is, and OTMATIX records the result, the evidence and its expiry.

0 agentsNo scanningNo process traffic

Ask an OT engineer

See your plant’s cybersecurity, orchestrated.

A walkthrough built around your sites, your asset classes and the standards you answer to.

Your asset classes, from SCADA servers to safety systems
IEC 62443, NERC CIP, NIS2 or your own framework, mapped live
Deviations, patches and vendor access on a real Purdue layout
A Level 4 deployment, kept clear of your control network

What happens next

1We reply within one business day
2We learn your sites, asset classes and standards
3You see OTMATIX on your own plant

Delivered by the OT security team at OT Associates, pure play OT security.