Managed OT Monitoring
Industrial networks fail differently, and an IT playbook makes it worse — you cannot patch a PLC on Tuesday night or push an agent onto a controller. Managed OT Monitoring listens to the plant network passively on zcrOT, learns what normal traffic between those devices looks like, and tells your engineer when it changes.
$292.50USDper site / month
List $390 — what your customer pays. You keep the difference. · 25% off list
- Priced by
- per site / month
- Delivered as
- Your brand, your template
- Client access
- Scoped, granted by your customer
- Runs on
- zcrOT
Scoped before you quote, not after you have sold it
Monitoring is passive, from a SPAN port or a network TAP: nothing is installed on a PLC, HMI or RTU, and no active scan is ever run against the control network.
The asset inventory is built from observed traffic — make, model, firmware version and protocol — so you stop depending on a spreadsheet the plant last updated years ago.
Protocol-aware analysis for Modbus, DNP3, IEC 61850, OPC UA, S7 and BACnet, rather than treating control traffic as unclassified TCP.
Alerts are written against process consequence, not IT severity: a controller mode change or an unexpected engineering workstation matters more than a missing patch.
Escalation goes to the plant engineering contacts you name for that site, on an OT playbook, not into an IT service desk queue.
Billed per site per month, and every site gets its own traffic baseline — a customer with three plants is three units for a reason.
You quote it, we operate it, you deliver it
Your price is the published list price minus 25%, on every line in the catalogue. You decide what your customer pays and keep the difference, so your margin is settled before the quotation leaves your office.
Our engineers work it from Bangkok on UTC+7, against a methodology that is written down rather than improvised per customer. A senior engineer reads every finding before it leaves the building, because you are the one who has to defend it.
Findings, reports and escalations reach you in your template with your logo on them. Your customer talks to you, and our name is not on the ticket.
What a partner checks before putting this on their price list
Will this touch the control network?
No — monitoring is entirely passive, a mirror of the traffic with no agent, no active scanning and no writes. The OT network sees a listener, never a participant.
Our customer's OEM says monitoring voids the warranty.
A passive tap does not connect to or modify the controllers, which is what a warranty clause is normally written against. We give you the technical description in writing so you can put it in front of the OEM before you commit to anything.
Do you need to send someone to the site?
The sensor has to be placed once, and your engineer or the plant's integrator can do it with our placement instructions; we then validate the traffic we start receiving. Everything after that is remote.
How is this different from Managed SOC Operations?
The data, the analysis and the escalation path are all different. OT alerts are judged against the physical process and go to plant engineering, so partners who sell both buy them as two separate units rather than one bundled service.
What counts as a site?
One physical location with its own control network — a plant, a substation, a solar farm or a charging depot. Each is billed separately because each needs its own traffic baseline before the monitoring means anything.
Do your analysts actually know OT, or is this an IT SOC with a new dashboard?
OT cases are handled against OT playbooks, with protocol-level analysis and consequence-based severity. The zcrOT product exists because IT-shaped detection does not survive contact with a control network.
Pick one customer. We will run it for 60 days.
Choose a customer you already serve. We deliver Managed Exposure on their domain for two months, in your template, at no cost — so you can see exactly what your customer would receive before you sign anything.
Apply as a partner