Mail Server
Email gateway
The first entry point for phishing and malicious attachments; AI-IPS intercepts the traffic and C2 callbacks they carry.
Defense in Depth for OT
AI-IPS & ICS-Cracker Smart Factory Defense Architecture
Active defense combined with red-team validation, building an industrial security line you can actually prove. AI-IPS deploys inline at every network boundary to detect and block industrial threats in real time; ICS-Cracker launches controlled attacks from both the IT and OT sides to verify those defenses truly hold.
Internet / external threats
1 DMZ External buffer zone
Mail Server Email gateway Firewall Perimeter filtering External Network Untrusted internet
AI-IPS
inline protection at every layer
2 IT Enterprise Segment Office and management network
PC Employee endpoint Network Switch Office backbone SIEM Security Monitoring NTP Server Time sync Active Directory Domain Controller File Server Shared storage
ICS-Cracker
Controlled attack simulations launched from this side, verifying the layer's defenses really hold.
AI-IPS
inline protection at every layer
3 Intermediate Layer Industrial segmentation layer
Network Switch Zone backbone Message Broker IT/OT data exchange Zone Switch Zone uplink
AI-IPS
inline protection at every layer
4 OT Layer Control floor
Firewall OT boundary control Gateway Protocol translation Network Switch Control backbone SCADA Supervisory control Engineer PC Workstation HMI Operator panel PLC Logic controller
ICS-Cracker
Controlled attack simulations launched from this side, verifying the layer's defenses really hold.
AI-IPS
inline protection at every layer
5 Shop-floor Equipment Production machinery and endpoints
CNC Production Machine Metalworking Robotic Arm Industrial robot CNC Controller Turning & milling Non-production Endpoints Edge devices
AI-IPS sits at every boundary between the DMZ, IT, intermediate, OT, and equipment layers; ICS-Cracker launches red-team validation paths from both the IT enterprise network and the OT control layer.
Legend
Industrial network node
Physical links between devices and servers
Industrial control network (OT)
Communication paths across the control floor and equipment layer
AI-IPS inline coverage
Active defense / blocking at every layer boundary
Red-team validation path
Entry directions ICS-Cracker simulates attacks from
Five Protection Zones
Segmented following the IEC 62443 zones-and-conduits model — each layer has a defined asset scope, protection responsibility, and validation method.
The buffer between external services and the corporate network — the first entry point for outside threats reaching the plant.
AI-IPS active defense / blocking
Inline inspection at the external boundary intercepts malicious traffic carried by phishing mail, C2 callbacks, and known exploit packets, stopping threats from spreading inward from the DMZ.
Key assets in this layer 3
Firewall
Perimeter filtering
Handles basic connection filtering but cannot read industrial protocol semantics — AI-IPS adds the deep packet inspection.
External Network
Untrusted internet
The origin of every outside threat; only necessary traffic relayed through the DMZ is allowed inward.
Swipe to see more assets
The corporate segment carrying daily office work, authentication, and security monitoring — and the most common landing spot for ransomware.
AI-IPS active defense / blocking
Deep inspection of AD authentication, file sharing, and internal lateral movement, alerting and blocking abnormal account activity and suspicious connections in real time, with logs exported to SIEM for follow-up.
ICS-Cracker red-team validation
Simulates the real post-phishing attack chain from the IT side — credential theft, lateral movement, and domain privilege escalation — to verify the IT/OT boundary genuinely cannot be crossed.
Key assets in this layer 6
PC
Employee endpoint
Employee endpoints are where ransomware most often lands, so their connections into the internal network need watching.
Network Switch
Office backbone
Carries office segment traffic; VLANs plus AI-IPS block unauthorized cross-segment access.
SIEM
Security Monitoring
Aggregates security events; AI-IPS alerts and logs feed in over Syslog for correlation and audit.
NTP Server
Time sync
Provides a plant-wide time baseline — inconsistent timestamps destroy the credibility of incident review and evidence chains.
Active Directory
Domain Controller
Holds enterprise-wide authentication; a single privilege escalation compromises everything, so abnormal auth behavior must be watched closely.
File Server
Shared storage
The relay point for IT/OT file exchange, and a common route for malware to spread laterally.
Swipe to see more assets
The data exchange hub between IT and OT, pushing field data up and control instructions down — the make-or-break point for segmentation.
AI-IPS active defense / blocking
Inspects broker publish/subscribe traffic and cross-zone connections to confirm data flows only in permitted directions, blocking unauthorized reverse control channels and protocol abuse.
Key assets in this layer 3
Network Switch
Zone backbone
The backbone of the industrial segmentation layer, keeping zone traffic on its planned path.
Message Broker
IT/OT data exchange
The IT/OT data hub; AI-IPS inspects publish/subscribe traffic to stop reverse control channels forming.
Zone Switch
Zone uplink
Connects production zones, using segmentation to limit how far an intrusion can spread.
Swipe to see more assets
The field segment that issues actual control commands, where any abnormal write can directly affect process and personnel safety.
AI-IPS active defense / blocking
Natively parses the command semantics of Modbus TCP, OPC UA, S7comm, and EtherNet/IP, identifying unauthorized register writes, abnormal control commands, and firmware downloads — and blocking them within milliseconds.
ICS-Cracker red-team validation
Runs controlled attack simulations against PLC, HMI, and SCADA per MITRE ATT&CK for ICS — unauthorized writes, control command injection, and protocol-level DoS — quantifying the real block rate of AI-IPS.
Key assets in this layer 7
Firewall
OT boundary control
Basic control at the OT boundary; only with AI-IPS can malicious commands at the protocol layer be identified.
Gateway
Protocol translation
Translates between industrial protocols — the translation point is the most commonly overlooked attack surface.
Network Switch
Control backbone
The control segment backbone, where AI-IPS can sit inline or observe via port mirroring.
SCADA
Supervisory control
Owns plant-wide monitoring views and historical data; tampering leads operators to misread the field state.
Engineer PC
Workstation
Holds PLC program download rights — the pivot an attacker most wants to obtain.
HMI
Operator panel
Where operators issue commands; falsified displays and unauthorized operations must be intercepted immediately.
PLC
Logic controller
Directly controls the physical process; an unauthorized register write can damage equipment or endanger personnel.
Swipe to see more assets
The equipment that directly creates value — typically long-lifecycle legacy systems that are hard to patch and cannot be taken offline.
AI-IPS active defense / blocking
Provides virtual patching for legacy equipment that cannot run security agents, replacing device-side updates with network-layer blocking to reduce exploitation risk without any downtime.
Key assets in this layer 4
CNC Production Machine
Metalworking
Long-lifecycle equipment is hard to patch, so virtual patching blocks known exploits at the network layer instead.
Robotic Arm
Industrial robot
Tampered motion commands can cause collisions and injury, so control traffic must be checked for plausibility.
CNC Controller
Turning & milling
Maliciously altered machining parameters cause yield loss and quality defects that are very hard to trace.
Non-production Endpoints
Edge devices
Metrology instruments and industrial PCs are routinely overlooked; OPS scans and checks them in offline environments.
Swipe to see more assets
A Provable Industrial Security Line
Protection is not a one-off project — it is a continuous deploy → validate → refine cycle.
Continuous active defense
AI-IPS runs inline around the clock, delivering uninterrupted real-time protection and traffic visibility across all five boundaries.
Periodic red-team validation
ICS-Cracker re-runs the same scenarios on a schedule, confirming protection rules have not silently degraded as the environment changes.
Compliant and provable
The validation process and results convert directly into structured evidence usable for IEC 62443, CRA, and SEMI E187 audits.
Want to see how this maps to your plant?
We tailor deployment recommendations and validation plans to your network segmentation, existing equipment, and regulatory requirements.