Industrial control systems manage power grids, water treatment plants, chemical facilities, and oil pipelines. Attackers have shut down pipelines serving 45% of the US East Coast fuel supply, attempted to poison a city's water with a 111x lye overdose, destroyed uranium centrifuges by manipulating PLC logic while replaying false sensor data, and disabled safety systems at petrochemical plants. The ICS/SCADA cybersecurity market is $13.3B and growing at 16.5% CAGR. The governance gap between what controllers decide and what compliance covers is an infrastructure safety risk.
A ransomware attack shut down 5,500 miles of pipeline for 6 days, causing fuel shortages across the US East Coast. A remote attacker accessed a water treatment plant's SCADA system and increased sodium hydroxide levels by 111x. A nation-state weapon destroyed 1,000 uranium centrifuges by modifying PLC logic while replaying normal sensor data to operators. Another nation-state malware targeted safety instrumented systems at a petrochemical plant, designed to cause physical destruction. 26 active threat groups are targeting operational technology. Only 30% of OT networks have adequate visibility.
Every ICS security vendor monitors the network: packet inspection, anomaly detection, asset inventory. No vendor governs the controller's behavior: process variable deviations, unauthorized setpoint changes, firmware integrity violations, safety system bypasses, air-gap breaches. Agentomy closes that gap.
Every pattern references a documented incident, a specific regulatory requirement, and a concrete detection method. The 31-method behavioral monitor runs continuously across the control system lifecycle. No theoretical threats. No generic compliance language.
Each layer enforces one aspect of ICS governance -- from individual controller process boundary enforcement to plant-wide emergency shutdown orchestration across interconnected facilities.
Every control mapping references the actual regulatory document. No generic compliance language. All mappings are self-assessed, pending external validation. Penalty exposure ranges from NERC CIP fines to EUR 10M under NIS2.
| Framework | Status | Scope |
|---|---|---|
| NERC CIP (v7/8) | Active (mandatory) | Mandatory cybersecurity for North American bulk electric system. Electronic Security Perimeters, security event monitoring, configuration change management, incident response. Fines up to $1M/violation/day. |
| NIS2 Directive | Enforced Oct 2024 | EU-wide cybersecurity for essential entities: energy, transport, water, manufacturing. Incident notification within 24 hours. Penalties up to EUR 10M or 2% global turnover. |
| IEC 62443 | Active | International IACS cybersecurity standard series. System-level (3-3), component-level (4-2), organizational (2-1) requirements. Authorization enforcement, network segmentation, input validation, firmware integrity. |
| NIST SP 800-82 Rev 3 | Active (2023) | Comprehensive OT security guide. Authentication, network architecture, security monitoring, firmware integrity, configuration management. Covers SCADA, DCS, PLCs, and other control components. |
| TSA Pipeline Directives | Active (2021-02C/D) | Mandatory cybersecurity for pipeline operators. Network segmentation, access control, continuous monitoring, patch management. Issued after Colonial Pipeline. Enforceable by TSA inspection. |
| EU Cyber Resilience Act | Effective 2027 | Mandatory cybersecurity for products with digital elements sold in EU. Vulnerability handling, incident notification within 24 hours to ENISA, security by design requirements. |
| ISO 27001 + ISO 27019 | Active | Information security management with OT annex for energy utilities. Configuration management, OT-specific access controls, operational procedures, change management for control systems. |
| IEC 61508 | Active | Functional safety of E/E/PE safety-related systems. Safety function bypass management, software safety integrity verification, SIL requirements. Foundation for sector-specific safety standards. |
| IEC 61511 | Active | Safety Instrumented Systems for process industry. SIS lifecycle from design through decommissioning. Bypass management, proof testing, management of change. Mandatory for chemical, petrochemical, oil and gas. |
| CFATS | Active | Chemical Facility Anti-Terrorism Standards. Risk-Based Performance Standards for physical and cybersecurity. Deter cyber sabotage including unauthorized access to critical process controls. 300+ chemicals of interest. |
Detected by: Network Segmentation Breach, Cascading Shutdown Propagation
Detected by: Process Variable Deviation, Unauthorized Setpoint Change, Network Segmentation Breach
Detected by: Controller Firmware Tampering, Sensor Data Manipulation, Air-Gap Violation
Detected by: Safety System Override, Controller Firmware Tampering, Network Segmentation Breach
Detected by: PLC Command Injection, Unauthorized Setpoint Change, Cascading Shutdown Propagation
Detected by: Cascading Shutdown Propagation, Network Segmentation Breach, Unscheduled Maintenance Window
ICS security vendors provide network monitoring, asset discovery, and threat detection. They watch the wire. Agentomy governs the controller. Process variable boundaries, setpoint authorization, firmware integrity, safety system bypass management, and emergency shutdown orchestration are behavioral governance problems that network monitoring does not solve. A packet inspector cannot tell you whether a setpoint change was authorized by the right operator during the right maintenance window. The $13.3B market is building better firewalls. No one is building the behavioral governance layer.
Connect any SCADA platform through the protocol that fits your infrastructure. Gate mode for pre-operation authorization. Observer mode for post-operation monitoring. Both modes produce the same audit trail. Go edge binary for air-gapped deployments.
Suite 10: Industrial IoT / SCADA Governance. 20 self-contained, idempotent scenarios across 4 coverage areas: process boundary enforcement (5), controller integrity monitoring (5), safety system governance (5), and network perimeter control (5). Every scenario runs against the live governance layer. No mocks. No stubs.
NIS2 enforcement is active. TSA pipeline directives are mandatory. NERC CIP violations carry $1M/day penalties. The EU Cyber Resilience Act takes effect in 2027. 26 threat groups are actively targeting OT networks. The compliance gap is closing.
Request Access