A manufacturer brings a dozen plants into the security operations center

Sector

Discrete manufacturing

Footprint

Twelve plants across three countries

Constraint

No software on operational equipment

Component

CyberAIX Pipeline universal collectors, CyberAIX Relay

Starting point

The security operations center had strong visibility into corporate IT and almost none into plant networks. Controllers, human-machine interfaces, and engineering workstations communicated over industrial protocols the analytics platform did not understand. Installing agents on production equipment was prohibited by both the operations team and equipment vendors' support terms. Streaming raw plant traffic to the cloud was rejected on cost and bandwidth grounds.

What was done

Passive collection. A CyberAIX Pipeline universal collector was deployed at each plant on a span port from the plant's core switch. Nothing was installed on any operational device.

Decode at the universal collector. Collectors parsed Modbus, OPC UA, and vendor-specific protocols into structured events describing which device issued which command to which target.

Baseline, then reduce. Each collector spent an initial period learning normal behavior per device: command sets, peer relationships, and polling cadence. Steady-state telemetry was summarized into periodic rollups. Deviations such as a new peer, an unexpected write command, or a change in cadence were forwarded as discrete events.

Attach IT context. Events were enriched at the universal collector with asset inventory data and the identity of the engineering workstation involved, so the security operations center could join operational anomalies with VPN sessions and endpoint alerts.

One policy, twelve sites. All collectors received configuration from the central CyberAIX control plane. A new detection or reduction rule reached every plant in a single change.

Result

• All twelve plants became visible to the security operations center with no software on operational equipment.
• Forwarded telemetry was a small fraction of raw protocol traffic, making cloud ingestion affordable.
• Anomalies arrived with asset and identity context already attached, shortening investigations.
• Local buffering meant no events were lost during uplink outages at remote sites.

What changed for the operations team

Nothing. Security gained visibility by observation rather than intrusion, and operations kept full control of its equipment.