Table of Contents
The new frontier of MSP security
The OT Security gap: Why traditional IT tools fail
What OT environments look like: Understanding the landscape
Threats to OT systems: Real dangers, real consequences
What MSPs need to monitor: The OT Security checklist
Detection without disruption: The passive monitoring imperative
Navigating the OT Security regulatory landscape
The enhanced.io approach: Open XDR extended to OT
Getting started: How MSPs can add OT Security to their portfolio
Securing the operational future
Which OT and IoT protocols does enhanced.io monitor?
Operational technology (OT) security represents a massive market opportunity for MSPs.
While traditional IT security tools protect endpoints, 70% of the attack surface is invisible if you only monitor endpoints, including building management systems, industrial controls and smart building infrastructure.
Buildings do not run antivirus, so MSPs need specialized approaches offering protection without disruption.
This guide explains how MSPs can deliver OT security without becoming industrial security specialists.
1. The new frontier of MSP security
What is OT security and why does it matter for MSPs?
OT security (operational technology security) protects the connected systems that control physical processes and infrastructure - building management systems, HVAC controllers, industrial control systems, access control platforms and SCADA networks. It matters for MSPs because these systems represent a massive, under-protected attack surface that traditional IT security tools cannot address.
The managed services landscape is shifting beneath our feet. While MSPs have spent decades perfecting endpoint protection, network security and cloud management, a massive attack surface has been growing in plain sight: operational technology.
Smart buildings, manufacturing facilities, hospitals and office complexes are now packed with connected systems that keep the lights on, regulate temperature, control access and monitor critical infrastructure. These building management systems and industrial control systems represent a cybersecurity gap that most MSPs have never been equipped to address, until now.
Why is IT/OT convergence security becoming critical now?
The convergence of IT and OT is no longer a future trend; it's today's reality. The same networks that carry email and business applications now connect to HVAC controllers, elevator systems and security cameras. And cybercriminals have noticed. Ransomware groups are increasingly targeting operational systems because they know organizations will pay to avoid operational shutdowns. According to recent industry analysis, attacks on OT environments have surged by over 2,000% in recent years, with building management systems becoming prime targets.
Why are MSPs uniquely positioned for the OT security market?
MSPs are uniquely positioned to serve this emerging market for several key reasons:
You already have relationships with building owners, facility managers and organizations that depend on operational continuity
You understand business technology and risk management
You can bridge the gap between IT security expertise and operational technology requirements
Your competitors cannot follow you here - mainstream MSP security vendors focus exclusively on traditional IT
Key takeaways:
OT security protects building management systems, industrial controls and smart building infrastructure
Attacks on OT environments have surged over 2,000% in recent years
MSPs have existing client relationships and trust needed to address this gap
Traditional IT security vendors lack the capabilities to protect operational technology
2. The OT Security gap: Why traditional IT tools fail
Why can't traditional IT security tools protect OT environments?
Traditional IT security tools fail in OT environments because they require agent installation on endpoints, active scanning capabilities and assume systems can tolerate restarts and updates. Operational technology systems cannot meet these requirements.
The security tools that work brilliantly in IT environments fall apart in operational technology contexts. The reason is fundamental: OT systems were never designed with cybersecurity in mind.
Traditional endpoint detection and response agents require installation on Windows, Mac, or Linux systems with sufficient processing power and memory. But try installing an EDR agent on a programmable logic controller managing a chemical process, a building automation controller regulating airflow, or a legacy SCADA terminal running embedded firmware. It cannot be done. These devices lack the resources, operating systems, or architectural capability to run security software.
What happens if you try to scan OT systems like IT systems?
Even when technically possible, deploying agents to operational devices creates unacceptable risk. A software update that causes a 30-second restart might be invisible on a laptop, but the same disruption to a building management system controller could shut down HVAC across an entire hospital wing or disable access control systems during business hours.
Multiple documented incidents describe vulnerability scans causing operational outages:
Scans of building management system controllers triggering full HVAC shutdowns across hospitals
Manufacturing facilities experiencing production line stoppages when security tools probed PLCs
Water treatment facilities suffering control system failures during compliance-driven security assessments
What is the "visibility problem" in OT security?
This creates the visibility problem that defines OT security challenges. Security information and event management systems, vulnerability scanners and network detection tools built for IT environments assume they can actively query devices, perform credential-based scans and receive telemetry from installed agents. None of these assumptions hold true for building management system security or ICS/SCADA monitoring for MSPs.
The result is a massive blind spot. Organizations believe they have comprehensive security coverage because their IT infrastructure is monitored and protected. Meanwhile, their operational systems (the controllers managing physical access, regulating building temperature, monitoring water systems and operating manufacturing equipment) remain completely invisible to security teams.
Key takeaways:
Endpoint agents cannot run on PLCs, BMS controllers, HVAC systems, or most OT devices
Active scanning can crash legacy OT devices and cause operational disruptions
70% of the attack surface is invisible if you only monitor endpoints
Traditional IT security tools assume capabilities that OT systems do not have
Organizations have a false sense of security when only IT infrastructure is monitored
3. What OT environments look like: Understanding the landscape
Key takeaways:
Smart building cybersecurity must address hundreds to thousands of connected devices per facility
BMS, access control, CCTV and HVAC systems all represent OT security challenges
Healthcare, manufacturing and commercial real estate all have extensive OT environments
Industrial protocols (BACnet, Modbus, OPC-UA) lack built-in security features
Understanding unmanaged device visibility starts with mapping the OT landscape
4. Threats to OT systems: Real dangers, real consequences
What types of attacks target OT systems?
The primary threats to OT systems include ransomware targeting building management systems and industrial controls, nation-state attacks on critical infrastructure, supply chain compromises through vendors and manufacturers and insider threats from disgruntled employees or contractors with operational access.
The threats facing operational technology are not theoretical. They are happening now, with increasing frequency and sophistication and the consequences extend far beyond data breaches.
How does ransomware target OT differently than IT?
Ransomware has evolved to specifically target building management systems and industrial control systems because operators know that operational downtime creates immediate business impact. Real-world examples include:
Hotel chains (2023): Ransomware attacks locked guests out of rooms by encrypting access control systems
Casino operations: Attacks disabled slot machines and building systems simultaneously
Manufacturing facilities: Complete production shutdowns when ransomware encrypted controllers managing assembly lines
The calculus for attackers is simple: organizations will pay ransoms to avoid extended operational outages that IT system encryption alone would not generate. When your email server goes down, business slows. When your building management system is encrypted, your facility becomes uninhabitable.
Are nation-state actors targeting OT systems?
Yes. Nation-state actors have demonstrated sophisticated capabilities to compromise industrial control systems and SCADA networks. Critical infrastructure operators in energy, water and transportation sectors have discovered advanced persistent threats lurking in their operational networks for months or years. These attacks aim not for immediate disruption but for pre-positioning capabilities that could be activated during geopolitical conflicts.
What are supply chain attacks on OT systems?
Supply chain compromises represent an emerging vector as attackers realize they can compromise thousands of facilities by targeting the vendors who manufacture and maintain OT equipment. Several high-profile incidents have involved:
Compromised firmware updates distributed by equipment manufacturers
Malicious contractor access through maintenance portals
Vulnerabilities in cloud management platforms used by multiple vendors
What are the real consequences of OT attacks?
The consequences of OT compromises differ fundamentally from IT breaches:
Healthcare: Ransomware encrypting hospital BMS controllers can impact patient care, disable operating rooms, or compromise environmental controls for critical care units
Manufacturing: Attacks on production lines halt operations, destroy materials, or damage expensive equipment
Water treatment: Compromised systems could threaten public health
Commercial buildings: Facility shutdowns, inability to control access, loss of HVAC and life safety systems
Key takeaways:
Ransomware groups specifically target BMS and ICS for maximum operational impact
Nation-state actors pre-position in OT networks for potential future activation
Supply chain attacks can compromise thousands of facilities through single vendors
OT attack consequences include operational shutdown, safety risks and physical damage
Most OT compromises involve default credentials and systems exposed to the internet
5. What MSPs need to monitor: The OT Security checklist
What specific OT devices and systems require monitoring?
MSPs delivering OT security for MSPs need to monitor building management systems (BMS controllers, HVAC, lighting), physical security systems (access control, CCTV, intrusion detection), industrial control systems (PLCs, HMIs, SCADA), healthcare-specific systems (medical devices, pharmaceutical storage) and environmental monitoring sensors.
Effective OT security for MSPs begins with comprehensive visibility across all operational technology assets and the specialized protocols they use to communicate.
What building systems need security monitoring?
Building management systems contain numerous controller types that require monitoring:
HVAC controllers: Regulate air handling units, chillers, boilers and ventilation systems
Lighting controllers: Manage automated dimming, daylight harvesting and emergency lighting
Energy management systems: Track consumption and optimize efficiency
Building automation controllers: Coordinate multiple subsystems
These controllers typically communicate using BACnet protocol across IP networks, creating connectivity that enables both operational efficiency and potential attack vectors.
What physical security systems are vulnerable?
Access control systems have evolved from standalone key card readers to networked platforms managing thousands of doors across multiple buildings:
Controllers at each access point
Credential databases and badge management
Integration with video surveillance
Visitor management platforms
Video surveillance infrastructure now consists almost entirely of IP-based cameras, network video recorders and video management systems. Large facilities might operate hundreds or thousands of cameras generating massive bandwidth and requiring network infrastructure.
What industrial protocols do MSPs need to understand?
These devices communicate using specialized protocols that MSP industrial security partners must monitor:
BACnet: Building automation and control networks
Modbus TCP/IP: Connecting sensors and actuators in industrial environments
OPC-UA: Data exchange between industrial systems and enterprise applications
Ethernet/IP: Real-time control in manufacturing environments
PROFINET: Industrial automation and process control
enhanced.io reads 92 industrial and IoT protocols off the wire. See the full list below.
Why is unmanaged device visibility so challenging?
Understanding unmanaged device visibility starts with recognizing that all these operational systems exist on networks but rarely appear in:
Asset inventories
Configuration management databases (CMDBs)
Security monitoring platforms
Vulnerability management systems
They communicate constantly using specialized protocols, but security tools designed for IT traffic often ignore or misinterpret this communication.
Key takeaways:
BMS controllers, HVAC, access control, CCTV and sensors all require monitoring
Industrial protocols (BACnet, Modbus, OPC-UA) need protocol-aware detection
IP cameras and access control systems are common attack vectors
Most OT devices never appear in traditional IT asset inventories
Healthcare environments include additional medical device monitoring requirements
6. Detection without disruption: The passive monitoring imperative
Why can't you scan OT systems like IT systems?
You cannot scan OT systems like IT systems because active vulnerability scanning can crash legacy OT devices, cause controllers to fail safe and shut down processes, or trigger failover events that disrupt operations. Buildings do not run antivirus and traditional security tools can cause the very disruptions they aim to prevent.
The cardinal rule of OT security is simple: protection without disruption. Any security approach that risks operational availability is unacceptable, which is why traditional active scanning and agent-based monitoring fail in operational environments.
What is passive network monitoring?
Passive network monitoring observes communication between OT devices without sending any traffic to them. This approach:
Captures network traffic non-intrusively using network taps or span ports
Analyzes the protocols in use without querying devices
Identifies devices based on their communication patterns
Builds comprehensive inventory of OT assets without directly touching them
This provides the visibility that 70% of the attack surface is invisible if you only monitor endpoints without creating any risk to operational systems.
What is protocol-aware detection?
Protocol-aware detection is essential because operational traffic looks nothing like IT traffic. Security tools trained to recognize HTTP, DNS and email protocols often ignore or misinterpret BACnet, Modbus and OPC-UA communication. Advanced monitoring platforms include:
Protocol parsers specifically designed to understand operational traffic
Ability to extract meaningful information from industrial protocols
Recognition of when communication patterns deviate from normal operational behavior
The platform decodes 92 industrial and IoT protocols natively
How does behavioral analytics work for OT security?
Behavioral analytics becomes particularly valuable in OT environments where traditional indicators of compromise may not apply. Since many operational systems lack logging capabilities, cannot run endpoint detection tools and communicate using unencrypted protocols, detecting attacks requires:
Establishing baselines for device communication patterns
Monitoring which devices communicate with each other
Tracking what protocols they use and the volume/timing of traffic
Identifying anomalies that indicate reconnaissance, lateral movement, or operational interference
What are the benefits of passive monitoring for MSPs?
This approach enables MSPs to provide ICS/SCADA monitoring for MSPs and comprehensive OT security without:
Requiring operational downtime
Needing testing windows
Creating acceptance of risk by facility managers
Any potential for disruption to operational systems
The monitoring infrastructure operates completely independently of the operational systems, providing security visibility without any interaction that could cause problems.
Key takeaways:
Active scanning can crash OT devices and cause operational outages
Passive monitoring observes traffic without sending any packets to OT devices
Protocol-aware detection understands BACnet, Modbus, OPC-UA and other industrial protocols
Behavioral analytics detects threats by identifying deviations from normal patterns
Protection without disruption is the fundamental principle of OT security
7. Compliance and standards: Navigating the OT Security regulatory landscape
What is IEC 62443 and why does it matter?
IEC 62443 represents the primary international standard for industrial automation and control systems security. Originally developed for manufacturing and critical infrastructure, these standards increasingly apply to building automation and other OT contexts. IEC 62443 aligned monitoring provides clients with confidence that security approaches meet internationally recognized standards.
Organizations operating OT environments face increasing regulatory requirements and industry standards specifically addressing operational technology security. MSPs need to understand these frameworks both to help clients achieve compliance and to position security services effectively.
What does IEC 62443 require?
The framework defines security levels for industrial systems and requires:
Network segmentation between IT and OT environments
Asset inventory and configuration management for operational systems
Vulnerability management processes that account for OT constraints
Access control and identity management
Monitoring and logging of operational network activity
Incident response procedures designed for OT contexts
How does NIST CSF apply to OT security?
The NIST Cybersecurity Framework has been extended with specific guidance for OT and industrial control systems. This framework provides a risk-based approach addressing:
Identify: Inventorying operational assets that cannot run traditional security tools
Protect: Implementing controls that work in OT environments
Detect: Using passive monitoring and behavioral analysis
Respond: Incident response without causing operational disruption
Recover: Time-sensitive recovery in operational environments
What is NIS2 and who does it affect?
The European Union's NIS2 Directive significantly expands cybersecurity requirements for critical infrastructure and essential services, with strong implications for building operators, healthcare facilities and industrial operators. The directive mandates:
Risk management measures proportionate to threats
Security incident reporting within strict timeframes (24-72 hours)
Supply chain security requirements
Accountability at the board level for cybersecurity posture
Organizations falling under NIS2 scope (which includes many facilities managed by MSPs) face substantial penalties for non-compliance, creating urgency around operational security programs.
What do cyber insurance companies require for OT coverage?
Cyber insurance carriers have begun including specific requirements for OT security in policies covering operational technology risks. Insurers increasingly require evidence of:
Asset inventory for operational systems
Network segmentation between IT and OT
Monitoring capabilities for operational networks
Vulnerability management programs addressing OT constraints
Incident response plans tested against OT scenarios
MSPs can position IT/OT convergence security services as essential for maintaining insurability and avoiding exclusions for operational technology incidents.
What industry-specific regulations apply?
Additional requirements vary by sector:
Healthcare: HIPAA considerations for medical devices and systems with patient data
Building operators: Physical security system protection requirements in certain jurisdictions
Defense manufacturing: DFARS cybersecurity requirements increasingly address OT security
Critical infrastructure: Sector-specific regulations from TSA, CISA and other agencies
Key takeaways:
IEC 62443 is the primary international standard for OT security
NIST CSF provides flexible, risk-based approach to OT security management
NIS2 creates mandatory requirements for EU organizations with board-level accountability
Cyber insurance increasingly requires demonstrated OT security capabilities
Industry-specific regulations add additional compliance layers
8. The enhanced.io approach: Open XDR extended to OT
How does enhanced.io enable MSPs to deliver OT security?
Enhanced.io has built the first security platform designed specifically to extend comprehensive protection from IT environments into operational technology without requiring MSPs to become industrial security specialists. The Open XDR architecture integrates data from diverse sources, combining IT security tools with passive OT monitoring.
What is Open XDR and why does it matter for OT?
The Open XDR architecture naturally accommodates operational technology by integrating data from diverse sources rather than depending on uniform agent deployment. This means the platform can combine:
Telemetry from traditional IT security tools
Passive network monitoring of OT environments
Data from specialized industrial security sensors
Intelligence from integration partners who focus on operational technology
Which integration partners support enhanced.io's OT security?
Integration partnerships with industry leaders ensure comprehensive coverage:
Barracuda Networks: Email and web security protecting against initial compromise vectors targeting facility managers and operational staff
Fortinet: Network security enabling proper segmentation between IT and OT while maintaining visibility across both
Tenable: Vulnerability intelligence specifically designed for operational technology, identifying risks without disruptive scanning
These partnerships mean MSPs do not need to become experts in every aspect of OT security tooling. Enhanced.io aggregates data from best-of-breed solutions, correlates events across IT and OT environments and presents unified visibility through a single pane of glass.
What makes the enhanced.io SOC different for OT security?
The 24/7 Security Operations Center includes analysts with specific expertise in:
Operational technology threats
Building management system security
Industrial control system monitoring
When anomalies are detected in OT environments, response teams understand the context, they know that rebooting a device is not an option, that operational continuity takes precedence and that coordinating with facility managers is essential. This operational awareness prevents security responses from creating the very disruptions they aim to prevent.
What is the fractional security director program?
The fractional security director program provides particular value for organizations with operational technology responsibilities. Many building operators, facility managers and industrial operators lack dedicated cybersecurity leadership. Enhanced.io provides strategic guidance on:
Assessing operational technology risks
Developing security roadmaps that account for OT constraints
Coordinating between IT teams and operations teams
Managing compliance with IEC 62443 and other standards
Making informed decisions about security investments
How does enhanced.io solve the MSP OT security challenge?
This approach solves the fundamental problem MSPs face when addressing operational technology: how to extend security services into unfamiliar territory without unsustainable investments in specialized expertise. Enhanced.io provides:
Platform architecture designed for IT/OT convergence security
Partnerships with best-of-breed OT security vendors
Operational capabilities through OT-aware SOC analysts
Strategic guidance through fractional security director services
Key takeaways:
Open XDR integrates IT and OT security data without requiring agents
Integration partners (Barracuda, Fortinet, Tenable) provide specialized OT capabilities
24/7 SOC includes analysts with operational technology expertise
Fractional security director program provides strategic guidance for OT clients
MSPs can deliver OT security without becoming industrial security specialists
9. Getting started: How MSPs can add OT Security to their portfolio
How can MSPs identify which clients need OT security?
Nearly every client with physical facilities operates OT systems. The best opportunities include manufacturing clients, healthcare facilities, hospitality operators, corporate campuses with multiple buildings, data centers and any organization with building management systems, access control, or video surveillance.
Adding OT security services to your MSP offering requires a structured approach but does not demand fundamental changes to your business model or investments in specialized technical resources.
What does an OT security assessment include?
A formal OT security assessment provides immediate value while identifying opportunities for ongoing services:
Passive network monitoring to discover operational technology assets
Protocol analysis to understand communication patterns
Risk evaluation based on system architecture and connectivity
Compliance gap analysis against relevant standards (IEC 62443, NIST, NIS2)
Recommendations prioritized by risk and feasibility
The assessment itself demonstrates capabilities your competitors cannot match and establishes your position as a knowledgeable OT security partner.
How should MSPs price OT security services?
Pricing considerations for OT security services typically follow monthly recurring revenue models similar to existing MSP offerings. Pricing variables include:
Number of operational technology devices under management
Complexity of environments and protocols
Compliance reporting requirements
Whether clients need fractional security director services
Many MSPs bundle OT security with existing managed security services, positioning comprehensive coverage as a natural extension rather than a separate offering.
What does enhanced.io provide for partner enablement?
The enhanced.io partner enablement program provides everything MSPs need to successfully deliver OT security services:
Technical training on operational technology fundamentals
Sales enablement materials and messaging guidance
Assessment frameworks and templates
Client communication resources explaining OT security in accessible terms
Ongoing technical support from OT-focused specialists
What is the timeline for MSP partner onboarding?
Partner onboarding typically follows this timeline:
Days 1-2: Initial orientation covering OT security concepts and enhanced.io capabilities
Weeks 1-2: Technical integration connecting the platform to partner infrastructure
Month 1: First client assessments conducted with enhanced.io support
Day 90: Full operational independence for common OT scenarios
What is the business case for adding OT security?
The business case for adding OT security is compelling:
Client retention: You provide capabilities competitors do not offer and address risks clients increasingly recognize
Revenue expansion: Add OT security services to existing clients who already trust your organization
Market differentiation: Position your MSP as a more sophisticated partner, opening opportunities with larger or more complex prospects
Compliance value: Regulatory requirements create urgency and budget for OT security
What concerns do MSPs typically have about OT security?
Common concerns are addressable:
Technical complexity: Mitigated through enhanced.io's platform and partner enablement program - you do not need to become industrial control engineers
Operational risk: Eliminated through passive monitoring and protection without disruption methodologies
Sales challenges: Solved with messaging focused on relatable concepts like "buildings do not run antivirus" and "70% of the attack surface is invisible if you only monitor endpoints"
Key takeaways:
Start by assessing existing clients for OT systems (most have them)
Use structured assessment to demonstrate capabilities and identify opportunities
Price OT security as MRR similar to existing managed security services
Enhanced.io provides complete partner enablement and ongoing support
Achieve operational independence within 90 days
Business case includes retention, expansion, differentiation and compliance value
10. Securing the operational future
Why should MSPs act now on OT security?
MSPs should act now because threats targeting operational systems are increasing in frequency and sophistication, regulatory requirements are expanding, cyber insurance carriers are demanding OT security controls and clients need these capabilities whether they have articulated that need yet or not. The opportunity window for market leadership is open now.
The convergence of information technology and operational technology has created both enormous risks and significant opportunities. Buildings, industrial facilities, healthcare environments and commercial operations depend on interconnected systems that were never designed with cybersecurity in mind, creating attack surfaces that traditional IT security approaches cannot address.
What competitive advantage does OT security provide MSPs?
MSPs who recognize this gap and move decisively to address it gain sustainable competitive advantage. Your competitors cannot follow you here because the expertise, partnerships and specialized capabilities required to effectively deliver OT security for MSPs do not exist in traditional IT security platforms.
Organizations operating smart buildings, manufacturing facilities and critical infrastructure need partners who understand that operational technology requires different approaches:
Protection without disruption through passive monitoring
Protocol-aware detection for industrial communication
Operational awareness in security response
IEC 62443 aligned monitoring and compliance capabilities
Coordination between IT teams and facility operations
How does enhanced.io enable MSP success in OT security?
Enhanced.io provides the platform, partnerships and support that enable MSPs - such as Onsite Technologies - to confidently extend services into operational technology, delivering comprehensive security that addresses the entire attack surface including the 70% that remains invisible without OT-specific monitoring.
The platform specifically addresses:
Passive monitoring ensuring protection without disruption
Protocol-aware detection providing visibility despite lack of agents
Integration across IT and OT eliminating artificial separation
Compliance reporting addressing IEC 62443, NIST and other frameworks
24/7 SOC with operational technology expertise
Fractional security director services for strategic guidance
What should MSPs do next?
The time to act is now. Threats targeting operational systems are increasing in frequency and sophistication. Regulatory requirements are expanding. Cyber insurance carriers are demanding OT security controls. Your clients need these capabilities whether they have articulated that need yet or not.
The future of MSP security is operational. Make sure your organization is positioned to lead.
Key takeaways:
IT/OT convergence creates both risks and opportunities for MSPs
OT security provides sustainable competitive differentiation
Enhanced.io enables comprehensive IT and OT security without MSPs becoming specialists
Threats, regulations and insurance requirements create urgency
Market leadership opportunity exists now for MSPs who act decisively
Which OT and IoT protocols does enhanced.io monitor?
enhanced.io reads 92 industrial and IoT protocols directly off the wire. The list covers 70 SCADA and industrial control protocols, including Modbus, DNP3, BACnet, OPC UA, PROFINET, S7comm and IEC 61850, and 22 IoT protocols, including MQTT, CoAP, Zigbee and 6LoWPAN.
Detection is passive. No agent goes on a PLC. No packet is sent to a controller. The sensor watches traffic and identifies devices by how they talk.
How does enhanced.io see industrial traffic without touching the device?
A network sensor sits on a SPAN port or a network tap on the OT segment. Deep packet inspection decodes the industrial protocol in the traffic. Devices are identified by their communication patterns, not by an installed agent.
Nothing is sent to the controller. A PLC does not restart, fail safe or drop offline because it was monitored. This is the difference between passive monitoring and an active vulnerability scan.
SCADA and industrial control protocols
70 protocols. Deep packet inspection decodes each one natively.
| Protocol | What it does |
|---|---|
| Manufacturing Message Specification (ISO 9506) | ISO 9506 Manufacturing Message Specification (MMS). |
| Inter-Control Center Communications Protocol | IEC 60870-6/TASE.2. Inter-Control Center Communications Protocol (ICCP) provides data exchange over Wide Area Networks (WANs) between utility contr... |
| Modbus | MODBUS is a standard communication protocol in industry for connecting industrial electronic devices (SCADA). |
| Distributed Network Protocol | DNP3 (Distributed Network Protocol) is a set of protocols used between components in process automation systems (SCADA). |
| Ethernet/IP | ENIP (EtherNet/IP) is an industrial network protocol that adapts the Common Industrial Protocol to standard Ethernet. |
| Common Industrial Protocol | The Common Industrial Protocol (CIP) is an industrial protocol for industrial automation applications. |
| Generic Object Oriented Substation Events | GOOSE (Generic Object Oriented Substation Events) is a controlled model mechanism in which any format of data (status, value) is grouped into a dat... |
| OPC Unified Architecture | OPC is the interoperability standard for the secure and reliable exchange of data in the industrial automation space and in other industries. |
| Process Field Net | PROFINET (an acronym for Process Field Net) is an industry technical standard for data communication over Industrial Ethernet, designed for control... |
| Vnet/IP | Yokogawa's control communication network approved by international standards (IEC 61784-2 Ed. |
| Honeywell Process History Database | Traffic related to Honeywell Process History Database (PHD). |
| PI AF | OSI PI Analysis Framework SCADA protocol (AF Server, MDB Sync, etc. |
| PI Data Archive | OSI PI DataArchive and Server SCADA protocol (ProcessBook, Datalink, etc. |
| s7 Communication | S7comm (S7 Communication) is a Siemens proprietary protocol that runs between programmable logic controllers (PLCs) of the Siemens S7-300/400 family. |
| CSP AB/Ethernet | Proprietary protocol developed by Allen-Bradley, used on programmable logical controllers (PLC). |
| BACnet Virtual Link Control | BACnet is a communication protocol for Building Automation and Control (BAC) networks defined by the standard ISO 16484-5. |
| BACnet Network Layer | BACnet is a communication protocol for Building Automation and Control (BAC) networks defined by the standard ISO 16484-5. |
| BACnet Application layer | BACnet is a communication protocol for Building Automation and Control (BAC) networks defined by the standard ISO 16484-5. |
| DeltaV | Traffic related to DeltaV, a distributed control system used in industrial process control (Emerson Process Management). |
| Modbus Remote Terminal Unit | Traffic related to Modbus Remote Terminal Unit (RTU), a distributed control system used in industrial process control. |
| PC-cubed | PCCC stands for "Programmable Controller Communication Commands", it is used to control software running in Programmable Logic Controler (PLC). |
| IEC 60870-5-104 | IEC 60870-5-104 protocol (aka IEC 104) is a part of IEC Telecontrol Equipment and Systems Standard IEC 60870-5 that provides a communication profil... |
| IEC 61850 Sampled values | IEC 61850 Sampled Measured Values (SMV or SV) is protocol used in Electrical substations to share data between Intelligent Electronic Device (IED)... |
| Rockwell RNA protocol | Rockwell Network Applications (RNA) is Rockwell implementation of Windows DNA-M and is used for communication between Rockwell FactoryTalk products. |
| General Electric Procify | Proficy is a General Electric product for industrial environment allowing monitoring and data management from SCADA network. |
| Moxa Async Server Proprietary Protocol (ASPP) | This plugin classifies ASPP (Async Server Proprietary Protocol) from Moxa (NPort devices) without activation of encryption. |
| S7 Communication Plus | S7communication Plus is a Siemens proprietary protocol for Siemens' Programmable Logic Controllers (PLC). |
| Toyo PLC protocol | This layer classifies only a limited number of protocols known to be used by Toyo hardware (PLC). |
| Schneider Integrated Object Network | Integrated Object Network (ION) is a proprietary SCADA protocol for Schneider Electrics smart meters. |
| EquipCommand | This layer classifies EquipCommand protocol from TotalTrax equipment (SX/VX series), it solely handles the non-ciphered part of this protocol. |
| Yokogowa protocol | This layer classifies only a limited number of protocols known to be used by Yokogowa hardware. |
| fanuc gen | This layer gathers signatures of protocols used by Fanuc equipment. |
| KEYENCE Barcode Reader | This plugin classifies the control protocol of KEYENCE Barcode Reader products, also used by their setup software (AutoID Network Navigator). |
| Mettler Toledo Standard Interface Command Set | Standard Interface Command Set (SICS) is a protocol to control Mettler Toledo industrial scales. |
| Siemens Apogee | This plugin classifies the main data protocol used by Siemens Apogee HVAC product line. |
| Intermec SmartSystem Foundation | Intermec (Honeywell subsidiary) SmartSystem is a barcode scanner fleet management software. |
| Lenel OnGuard client | OnGuard is a product from Lenel for managing physical security of buildings. |
| Mercury Security | This plugin classifies Mercury Security controllers communication protocol with TLS disabled. |
| Omron FINS protocol | Omron FINS Protocol is SCADA protocol to communicate with PLC. |
| SeamLess Message Protocol | SeamLess Message Protocol (SLMP) is for the control of Mitsubishi PLC devices. |
| High-availability Seamless Redundancy | High-Availability Seamless Redundancy provides redundancy for industrial Ethernet networks. |
| HSR/PRP supervision frame | High-Availability Seamless Redundancy (HSR) and Parallel Redundancy Protocol (PRP) provide redundancy for industrial Ethernet networks. |
| ESK M3 | This plugin classifies the control protocol between ESK M3 Access Control module for forklifts and the P106 software that manage them. |
| Experion product | This plugin classifies of Experion Control Builder for Server LX. |
| IEEE C37.118 Synchrophasor | IEEE C37.118 Synchrophasor Protocol conveys electrical current measurements in power grid substations. |
| Parallel Redundancy Protocol | Parallel Redundancy Protocol provides redundancy for industrial Ethernet networks. |
| Socomec | Socomec is a manufacturer for industrial power networks. This plugin classifies the monitoring socket of the Silverlight user interface for the Pas... |
| iWarehouse | iWarehouse is the fleet and warehouse management system of Raymond Corporation (a subsidiary of Toyota Industries that manufactures and distributes... |
| DLMS/COSEM over IP | DLMS/COSEM is a standardized protocol for energy and water smart meters. |
| DLMS/COSEM over IP wrapper | TCP/UDP wrapper protocol (WPDU) for transporting over IP the DLMS/COSEM (IEC-62056) protocol for energy and water smart meters. |
| B&R Automation | B&R Industrial Automation is a manufacturer for the industry. |
| High-Level Data Link Control | High-Level Data Link Control (HDLC) is a data link layer protocol standardized by ISO/IEC 13239:2002. |
| AAON PRISM 2 | AAON Prism 2 is a software for control of AAON HVAC, Wattmaster Commlink 5 module over IP. |
| Dr Schenk Inspection System | Dr Schenk Inspection System is a product that inspects and analyzes raw material from a factory production chain. |
| Bosch Security Conettix | Bosch Conettix is a security alarm product line. This plugin classifies the D6600 when no encryption is configured. |
| Codesys Protocol (IDE-PLC) | Codesys is an embedded system and its IDE for industrial Programmable Logic Controller (PLC). |
| Invar Systems AS/RS Control | Invar Systems AS/RS (Automated Storage and Retrieval System) control protocol is part of Invar's integrated warehouse software system (IWS). |
| SiloTrack | SiloTrack is the management software for Monitor Technologies industrial devices to measure material level in a silo or a vessel tank. |
| Cimco DNC-Max | Cimco DNC-Max is a leading DNC (Direct/Distributed Numerical Control) software solution for DNC program transfers to multiple CNC (Computerized Num... |
| Savant Automation iQ-CAN | iQ-CAN is a control software for Automated Vehicles in factories from Savant Automation (AGV). |
| Miller Insight Centerpoint | Miller Insight Centerpoint is a welding station real time data collector. |
| Omron NB Designer | This plugin classifies project upload from NBDesigner software to a compliant Omron Programmable Terminal. |
| ZNT-Richter PAC admin tool | Administration protocol used by ZNT-Richter Process Automation Controller (PAC) applications. |
| Datalogic | Protocol used by control software and some Accu-Sort barcode scanners from Datalogic. |
| Global Facilities Management System | GFMS is Security Asset Manager (SAM) software from Key Systems Inc. |
| PureWave UPS Monitor | Control protocol for the S&C Purewave UPS system. |
| Jaten AGV Remote Control System | Jaten is a chinese provider of AGV robots. This plugin classifies network remote control protocol of their AGV. |
| MTConnect | MTConnect is a standard protocol (ANSI/MTC1.4-2018) and semantic for manufacturing equipment. |
| Simple Hierarchical Data Representation (SHDR) | Simple Hierarchical Data Representation (SHDR) is a protocol used between the Adapter and Agent in an MTConnect industrial setup. |
| Ordinal Coox | Ordinal Coox is a Manufacturing Execution System. This plugin classifies the Coox specific protocol. |
IoT and wireless protocols
22 protocols covering connected devices, smart meters, industrial cameras and lightweight machine-to-machine traffic.
| Protocol | What it does |
|---|---|
| MQ Telemetry Transport | MQTT (MQ Telemetry Transport) is a machine-to-machine (M2M)/"Internet of Things" connectivity protocol. |
| Constrained Application Protocol | CoAP (Constrained Application Protocol) is a specialized web transfer protocol for use with constrained nodes and constrained networks in the Internet of Things. |
| OPC Unified Architecture | OPC is the interoperability standard for the secure and reliable exchange of data in the industrial automation space and in other industries. |
| Modbus Remote Terminal Unit | Traffic related to Modbus Remote Terminal Unit (RTU), a distributed control system used in industrial process control. |
| PC-cubed | PCCC stands for "Programmable Controller Communication Commands", it is used to control software running in Programmable Logic Controler (PLC). |
| IEC 60870-5-104 | IEC 60870-5-104 protocol (aka IEC 104) is a part of IEC Telecontrol Equipment and Systems Standard IEC 60870-5 that provides a communication profile. |
| Gige Vision Control Protocol | GVCP stands for Give Vision Control Protocol a standard for industrial cameras supported by several companies. |
| Moxa | Moxa is a company developing hardware components (Scada, IOT, Networking). |
| General Electric Procify | Proficy is a General Electric product for industrial environment allowing monitoring and data management from SCADA network. |
| Moxa Async Server Proprietary Protocol (ASPP) | This plugin classifies ASPP (Async Server Proprietary Protocol) from Moxa (NPort devices) without activation of encryption. |
| fanuc gen | This layer gathers signatures of protocols used by Fanuc equipment. |
| Amazon Alexa Assistant | Alexa is the Amazon virtual assistant. |
| Omron FINS protocol | Omron FINS Protocol is SCADA protocol to communicate with PLC. |
| Tress Poll | Tress Poll is a time clock device and software manufactured by Grupo Tress Internacional. |
| DLMS/COSEM over IP | DLMS/COSEM is a standardized protocol for energy and water smart meters. |
| DLMS/COSEM over IP wrapper | TCP/UDP wrapper protocol (WPDU) for transporting over IP the DLMS/COSEM (IEC-62056) protocol for energy and water smart meters. |
| NUSP protocol | This plugin classifies NUSP protocol. NUSP is custom protocol from NUUO company for initializing and maintaining video streams from cameras. |
| OV Solutions | This plugin classifies OV Solutions Server traffic. OV Solutions company provides surveillance equipment and software like NVR (Network Video Recorder). |
| ZigBee Encapsulation Protocol | Zigbee Encapsulation Protocol encapsulates captured 802.15.4 frames over UDP. |
| Low-rate wireless personal area network | 802.15.4 is a radio protocol for LR-WPANs (Low-Rate Wireless Personal Area Networks), and is the basis for the Zigbee & 6LoWPAN specifications. |
| IPv6 over Low-Power Wireless Personal Area Network | IPv6 over Low-Power Wireless Personal Area Network. |
| Ring | Ring is a company owned by Amazon providing home security and smart home devices. |
What happens once the protocol is decoded?
Asset inventory. Every device on the OT segment is named, typed and tracked, including the ones missing from your CMDB.
Baseline. Normal communication patterns are learned per device pair and per protocol.
Anomaly detection inside the industrial protocol itself, not a generic packet count. An unexpected write command to a PLC looks different from a routine read.
Correlation. Movement from the IT network into the OT segment is joined to identity, endpoint and cloud telemetry in one case, not four alerts in four tools.
Reporting mapped to IEC 62443, NIST CSF and NIS2, in a format your client hands to an auditor.
How long does it take to get OT visibility?
Onboarding is scoped to what is being onboarded, typically 30 to 45 days. Asset discovery starts as soon as the sensor sees traffic. The main driver of speed is how quickly your team supplies the environment detail.
What does your team have to do?
Complete the onboarding forms.
Provide a SPAN port or a network tap on the OT segment.
Allow for possible firewall reconfiguration.
Where no virtualization exists, accept a physical sensor on site.
Name the facility contact for anything touching production.
Agents go through your own tooling. Your stack does not get replaced.
What this list does not mean
The list is not exhaustive. Deep packet inspection reads protocols beyond the published set. If yours is missing, send the vendor and model and we will confirm before anyone puts it in a proposal.
Reading a protocol is not controlling a device. enhanced.io watches OT traffic. It does not write to a PLC.
This is not a replacement for a dedicated industrial sensor in a high-consequence environment. Where a client already runs one, enhanced.io takes the feed and correlates it with IT, identity and cloud telemetry, and runs the 24x7 SOC on top.
Key takeaways:
enhanced.io decodes 92 industrial and IoT protocols natively
Monitoring is passive, so no OT device is touched, queried or restarted
Detection works inside the industrial protocol, not on generic packet volume
IT to OT movement is correlated with identity, endpoint and cloud in one case
The published list is not exhaustive, so unlisted protocols get checked before they go in writing
Ready to explore OT Security for your MSP?
Schedule a discovery call to discuss how enhanced.io can help you:
Extend comprehensive security to your clients' operational technology environments
Differentiate from competitors who remain focused only on IT security
Capture an emerging market opportunity before it becomes crowded
Deliver IEC 62443 aligned monitoring and compliance capabilities
Provide protection without disruption through passive OT monitoring
FAQ: OT Security for MSPs
Can I deliver OT security without hiring industrial security specialists?
Yes. Enhanced.io's platform, partnerships and SOC enable MSPs to deliver comprehensive OT security without requiring deep industrial security expertise on staff. The platform handles protocol-aware detection, the SOC provides OT-aware analysis and response and partner enablement provides the training needed.
Will OT security monitoring disrupt my clients' operations?
How quickly can I start offering OT security services?
What if my clients don't think they have OT systems?
How do I explain OT security to clients who don't understand the technology?
Does enhanced.io support Modbus?
Does enhanced.io support BACnet?
Will OT monitoring disrupt a PLC or a building controller?
Does enhanced.io replace a dedicated OT security platform?
What if a protocol is not on the list?
Which client types does this apply to?
