1. Title
Early detection of cyberattacks in industrial networks using simulated industrial devices (Honeypot Technology)
2. Short Summary
ICS Detect is a cybersecurity service designed for critical infrastructure and industrial environments, using honeypot technology to detect unauthorised access attempts in industrial networks at an early stage.
The solution simulates real industrial equipment to attract and monitor attackers without affecting production processes. The service includes the detection and analysis of malicious activities, controlled cyberattack simulations, as well as training and consultancy for IT/OT security teams.
The solution has been developed by Safetech Innovation, a company specialised in cybersecurity and critical infrastructure protection.
3. Full Description
ICS Detect is a cybersecurity service based on honeypot technology, designed for OT (Operational Technology) networks and ICS/SCADA (Industrial Control Systems / Supervisory Control and Data Acquisition) environments.
The service is delivered as a service (as-a-service) and aims to proactively detect cyber threats, while also supporting vulnerability assessment and attack surface reduction in industrial infrastructures.
The solution uses high-interaction simulated devices (decoys), which can be deployed within the OT network or in the DMZ. These devices emulate industrial equipment, such as Programmable Logic Controllers (PLCs), and are designed to attract attackers away from real operational assets without disrupting industrial processes.
The main functionalities include:
- Industrial protocol emulation: support for protocols such as FTP, HTTP, Modbus, S7Comm, BACnet and SNMP, with the ability to emulate up to 19 PLCs per virtual machine.
- Customised simulated devices: configuration of devices to emulate equipment existing in the customer’s network, providing realistic responses to attackers’ queries.
- Real-time monitoring and alerts: generation of alerts concerning suspicious activities, integration with SIEM systems, and the possibility of automatically blocking malicious traffic.
- Analysis of malicious activities: collection and analysis of captured data to identify attack patterns, methods used and vulnerabilities specific to ICS/SCADA environments.
- Simulations and training: delivery of controlled cyberattack simulations, together with training and consultancy for IT/OT teams.
The service is continuously updated and tested, with periodic performance assessments.
4. Advantages and Innovative Aspects
ICS Detect provides a proactive approach to industrial cybersecurity by enabling early identification of attack attempts and monitoring attackers’ behaviour in controlled environments.
The main advantages and distinctive features include:
- Early threat detection: identification of unauthorised access attempts before they affect real operational systems.
- Protection of operational continuity: simulated devices attract and delay attackers without disrupting industrial processes.
- Emulation adapted to the industrial environment: configuration of simulated devices according to the specific equipment and characteristics of the customer’s network.
- Relevant threat intelligence: analysis of collected data provides a better understanding of attackers’ methods and behaviour.
- Integration with existing security infrastructure: alerts can be integrated with SIEM platforms, with the possibility of automatically blocking malicious traffic.
- Strengthened incident response capabilities: simulations and training enable IT/OT teams to test security controls and develop their skills using realistic scenarios.
Safetech Innovation has 14 years of experience in cybersecurity research and development, incident response through a private CERT, penetration testing and security audits.
The company holds ISO 9001, ISO 14001, ISO 20000-1, ISO 27001 and ISO 45001 certifications, is a CREST member, holds Trusted Introducer accreditation and is part of the NATO Industry Cyber Partnership.
Safetech Innovation has also developed a centre of excellence in cybersecurity and critical infrastructure resilience through an EU co-funded research project implemented between 2020 and 2023, in collaboration with a national defence university and a national research and development institute.
5. Dissemination / Keywords
Cybersecurity; Industrial Control Systems; ICS/SCADA; OT Security; cyberattack detection; honeypot; critical infrastructure; industrial network protection; threat detection; industrial cybersecurity.
6. Partner Sought
Safetech Innovation is looking for partners interested in promoting, integrating, distributing or using the ICS Detect service in industrial environments and critical infrastructure.
The targeted partner profiles include:
- Industrial automation system integrators and Managed Security Service Providers (MSSPs): partners serving industrial companies and critical infrastructure operators, who can recommend, resell or include the ICS Detect service in their portfolios.
- Critical infrastructure operators and industrial companies: organisations operating in sectors such as energy, water and industrial manufacturing, using OT networks and ICS/SCADA systems and interested in implementing the solution.
- Cybersecurity solution distributors and resellers: companies in Romania or international markets interested in including the service in their commercial portfolios.
Cooperation may take place through commercial agreements, depending on the partner’s role and the agreed cooperation model. This may include service referrals, resale or direct service provision to customers.
The specific terms and conditions of cooperation will be negotiated between the parties.
7. Development Stage
Already on the market
8. IPR Status
Confidential Know-how
9. Type of Partnership Requested
Commercial Agreement
#businessoffer