OT Cybersecurity Audit & Remediation
The Problem
Industrial control networks were designed for availability and determinism. Security was assumed, because the network was air gapped and nobody outside the plant could reach it.
That assumption stopped being true years ago. Remote support tunnels, vendor laptops, historian links to the corporate network, wireless instrumentation, and IP cameras have all quietly widened the attack surface. Meanwhile the devices themselves are running firmware that shipped five, ten, or fifteen years ago, and a growing share of it has published vulnerabilities attached.
The hardest part is not the fixing. It is knowing what you have.
Asset discovery and inventory
We build a complete, verified inventory of every device on the control network: PLCs, RTUs, VFDs, protection relays, power meters, overload relays, network switches, cameras, and gateways. Passive network monitoring gets us part of the way. The rest comes from walking the plant with your electricians, recording MAC addresses, firmware revisions, and serial numbers device by device, and reconciling that against what the network says is there.
The gaps between those two lists are usually the most interesting findings of the whole engagement.
Vulnerability assessment
Every device and firmware revision is mapped against published CVEs, vendor security advisories, and end-of-support notices. We work directly with the OEMs to confirm which advisories actually apply to your configuration and what remediation paths they support.
The output is a risk-ranked register: what is exposed, how badly, how reachable it is from outside the cell, and what it would take to fix.
Remediation planning
There are three practical levers, and the right answer is usually a mix of all three:
-
Firmware and patching where the vendor has a fix and the outage window exists
-
Network segmentation where the device cannot be patched, isolating it behind properly enforced Purdue level boundaries and firewall policy
-
Protocol encryption and secure remote access where data has to cross a boundary, replacing plaintext industrial protocols and ad hoc remote sessions with authenticated, encrypted paths
Each recommendation is costed, scheduled against your shutdown calendar, and put in front of your team for approval. Nothing gets touched without a sign-off.
Execution
We do the work. Firmware upgrades staged, tested, and executed on site during approved windows. Segmentation designed, configured, and commissioned. Secure remote access stood up and handed over.
Every device type gets a written, photographed upgrade procedure so your team can repeat the work on the next unit without us.
Sustainment
Cybersecurity in OT is not a project with an end date. We help you stand up the recurring process: registry maintenance, advisory monitoring, a patch cadence tied to your turnaround calendar, and awareness training so the people on site understand why the USB stick matters.
What you get
-
Verified OT asset register, reconciled between physical walkdown and network discovery
-
Redlined and updated network architecture drawings
-
Risk-ranked vulnerability register with vendor-confirmed remediation paths
-
Remediation plan scheduled against your shutdown and turnaround windows
-
Documented, photographed upgrade procedures per device type
-
Executed remediations, commissioned and handed over
-
Ongoing advisory monitoring and patch cadence
Who this is for
Large industrial operators running critical infrastructure and control networks. Processing facilities, mining operations, utilities, pipelines, and manufacturing sites where an unplanned outage is measured in hundreds of thousands of dollars and where regulators are starting to ask harder questions.
If your OT asset list lives in a spreadsheet that was last accurate three years ago, this is the engagement.
Why JPI
We are automation and technical first. We have been programming these PLCs, commissioning these networks, and supporting these plants across western Canada since 2017. That matters, because OT security work done by people who only know IT security tends to produce recommendations nobody can implement without taking the plant down.
We know what a firmware upgrade on a running process actually takes, and we plan around it.