Problem

“Isolate B, but never C.” The plant engineer knows that rule. No product does.

In OT the decisive knowledge sits in people's heads, not in systems.

In IT you can shut a compromised system down if you have to. In production you cannot. Which asset may be isolated, which must never be, and in what order things have to come back up so that nothing breaks: the plant engineer knows.

That knowledge is rarely documented and never machine-readable. Which is exactly why restoration stays manual work, under time pressure, with unclear backup quality.

“The attack was detected hours ago. But how do I get our production systems back online? That’s the part nobody helps me with.”

Illustrative system-administrator persona from our user research. Not a customer quote.