Utilities & Critical Infrastructure. SCADA-aware reachability and signed firmware evidence for the grid.
Water utilities, power-grid operators, gas distribution networks, and district heating systems now run under NERC CIP, the EU CER Directive, NIS2, AWWA cyber guidance, and IEC 62443 at the same time. Every substation controller, every HMI, and every ICS vendor turns into a regulator evidence question. Safeguard makes that evidence continuous, signed, and deployable on the OT side of the DMZ.
Four forces converging on the control room.
Regulator, ratepayer, and adversary pressures are collapsing into one continuous OT evidence requirement.
NERC CIP and EU CER Directive
Bulk-power operators in North America and essential-entity operators in the EU now face continuous evidence requirements. NERC CIP audit cycles, CER risk-management plans, and NIS2 reporting all reach the same OT and IT estate.
Water-utility cyber-physical risk
Oldsmar-class intrusions, HMI compromise, and remote-access takeover are no longer theoretical. AWWA cyber guidance and EPA water security rules turn every PLC and every HMI into an evidence question for state regulators.
Grid cascade risk
A ransomware event at a single substation vendor can cascade through interconnected control centres. Concentration risk on ICS vendors and signed firmware provenance are now part of the reliability conversation, not just security.
SCADA and IIoT convergence
Air-gapped SCADA segments now coexist with IIoT, cloud telemetry, and remote vendor maintenance. The boundary between OT and IT is no longer a wall — it is a continuously inspected interface that needs signed evidence at every crossing.
Capability mapped to auditor and dispatcher expectation.
SCADA-aware reachability scans
Reachability analysis knows about SCADA, HMI, and historian topology. A CVE is only flagged as critical when it is actually reachable from the OT-side interface that matters — not the entire CVE firehose.
Signed firmware provenance for substation controllers
Each substation controller, RTU, and relay firmware build emits signed provenance: source commit, toolchain identity, contributor scope, and prior baseline. NERC CIP-010 change documentation becomes a query against the audit store.
ICS vendor concentration mapping
Visualise shared dependencies, shared OEM firmware, and shared remote-access tooling across the entire ICS estate. Concentration risk surfaces at the vendor and at the component level before procurement signs the next master agreement.
Air-gapped sovereign for SCIF segments
For the most sensitive control-room and dispatch workloads — full sovereign deployment inside the enclave. No internet egress, customer-controlled keys, signed install attestation. Delta sync keeps offline air-gapped sites current.
Frameworks the platform is mapped to.
Pre-mapped control narratives and evidence in the formats your NERC regional entity, state PUC, EU competent authority, and ICS auditor already accept.
A typical deployment inside a regulated utility.
Utility-DMZ control plane, OT-segment-aware signed audit log, ICS-vendor concentration heatmap, and a regulator trust packet exposed read-only to state PUCs, NERC regions, and EU competent authorities.
Utility DMZ control plane
Control plane and inference cluster install in the utility DMZ between the corporate IT zone and the OT control-system zone. No traffic crosses into the SCADA segment except signed evidence pulls.
OT-segment-aware signed audit log
Every event is tagged with the originating OT segment, NERC CIP impact rating, and remote-access path. The log streams to the utility's SIEM in CycloneDX and JSON for both auditor and dispatcher consumption.
ICS-vendor concentration heatmap
Continuous mapping of shared OEM firmware, shared remote-access tooling, and shared transitive dependencies across the substation, generation, and distribution fleets. Cascade risk becomes a board-level dashboard.
Regulator trust packet for state PUCs
Read-only attestation portal exposes signed firmware SBOMs, VEX statements, and OT-segment audit evidence to the state public utility commission, NERC regional entity, and EU competent authority on demand.
Four risk surfaces every utility board now tracks.
Oldsmar-class water-utility intrusion
A remote-access path into an HMI is abused to change a chemical setpoint at a treatment plant. Reachability and signed identity on every OT-side login turn this from a near-miss into a blocked event.
Grid-cascade ransomware
A ransomware event at a shared substation vendor cascades through interconnected operators. ICS-vendor concentration mapping and reachability evidence make the blast radius visible before dispatch sees the alarm.
SCADA OEM firmware backdoor
An OEM firmware build is tampered upstream and ships to substation controllers. Signed firmware provenance and contributor-scope evidence catch the mismatch at install time, not at the next CIP audit.
Sanctioned-vendor ICS exposure
A controller, sensor, or maintenance vendor lands on OFAC, BIS Entity List, or EU sanctions between renewal cycles. Continuous component screening prevents the next firmware push from inheriting it.
What is actually hitting utilities this year.
- KEV CVEs in SCADA / HMI librariesKnown-exploited CVEs in widely shared SCADA, HMI, and historian libraries reach into substation and treatment-plant fleets. Reachability and KEV prioritisation focus engineering on the CVEs that are actually exposed.We address this through Eagle reachability + KEV prioritisation
- Water-utility cyber-physical intrusionRemote-access paths into HMIs at small water utilities are now actively probed. Signed identity, capability-scoped tool calls, and immutable OT-side audit logs turn intrusions into blocked events.We address this through Guardrails and runtime enforcement
- Grid-cascade ransomwareA ransomware event at a shared substation vendor cascades through interconnected operators. Concentration mapping makes the cascade visible at procurement time, not at dispatch time.We address this through TPRM with concentration heatmap
- ICS-vendor compromiseAn ICS OEM is breached and pushes a tampered firmware build into substation controllers. Signed provenance and contributor-scope evidence catch the mismatch at install time.We address this through SBOM Studio with signed firmware provenance
- Sanctioned-component exposureA controller, sensor, or maintenance vendor lands on OFAC, BIS Entity List, or EU sanctions between renewal cycles. Continuous screening prevents the next firmware push from inheriting it.We address this through Sovereign deployment with sanctions screening
Quantified benefits for utilities and critical infrastructure.
Numbers from production deployments inside utilities. Same regional entity, same ICS-vendor stack, dramatically less spreadsheet.
| Metric | Before Safeguard | With Safeguard |
|---|---|---|
| NERC CIP audit prep per cycle | 8 weeks | 1 day |
| OT-vendor monitoring | Quarterly | Continuous |
| ICS-firmware patch cycle | 30 days | 5 days |
| Air-gapped sync footprint | Full snapshot | Delta |
| Tool consolidation | 8 vendors | 1 |
| SCADA-policy posture audit | Reactive | Continuous |
| Sanctions component screening | Reactive | Continuous |
Evidence at the speed of the control room.
Talk to the team about NERC CIP and EU CER evidence pipelines, signed ICS firmware provenance, and a utility-DMZ deployment shape that lives entirely inside your operator's perimeter.