“NIS2 gives you 24 hours; your telemetry lives in five silos”

OT analytics that stay in the plant.

Telemetry analysed in the plant, inside the security zone

Start a pilot How it runs

The problem

I must report a significant incident within 24 hours, with data scattered across OT silos.
OT data cannot leave the plant, but analytics tools want a cloud connection.
Auditors ask me to show how a figure was computed. I can't reproduce it.

With PROTOR

Telemetry analysed in the plant, inside the security zone
Evidence packages for NIS2 reporting and audits
Grid/energy telemetry aggregated at full rate on one box

From today to the first result.

What you do today

a historian plus spreadsheets

NIS2 Art. 23 asks for an early warning within 24 hours and a notification within 72 hours, while the data sits in separate OT silos.

With PROTOR

Telemetry is analysed inside the plant zone, and the evidence package for the report comes from a replayable run.

Your first step

Replay one past incident from stored telemetry and produce its evidence package.

one incident

How it runs

Personal data masked, with proof. Step by step.

Records are fetched page by page, sealed before masking, masked, and sealed again — two evidence packages that show exactly what changed.

PROTOR · Personal data masked, with proofrunning

Page Numbers (2-3) · Build API URL · JSONPlaceholder Posts · Pre-Mask EvidenceSequence Generator · Compute Fields · REST API Subscriber · Evidence Collector
PII Masking · Pre-Mask Evidence PackData Masking · Evidence Pack
Post-Mask Evidence · Pre-Mask EPK VerifierEvidence Collector · Evidence Verifier
Masked Posts CSV · Post-Mask EvidenceCSV Publisher · Evidence Pack
Post-Mask EPK VerifierEvidence Verifier

nodes

page-gen → Generators.Sequence
url-builder → ETL.Compute
api-reader → RestApi.Subscriber
evidence-pre → Forensic.EvidenceCollector
pii-mask → Security.Mask
evidence-post → Forensic.EvidenceCollector
csv-output → CSV.Publisher
epk-pre → Forensic.EvidencePack
verifier-pre → Forensic.EvidenceVerifier
epk-post → Forensic.EvidencePack
verifier-post → Forensic.EvidenceVerifier

sealed before and after maskingboth packages re-verified

Page Numbers (2-3)Counts the pages to fetch.
Build API URLBuilds each page address.
JSONPlaceholder PostsCalls the REST API and yields the page rows.
Pre-Mask EvidenceHashes the raw rows (SHA-256, batches signed every 50) before masking.
PII MaskingPartially masks titles and hashes bodies.
Pre-Mask Evidence PackPacks the pre-mask manifest into a sealed evidence package.
Pre-Mask EPK VerifierRe-computes and checks the pre-mask package.
Masked Posts CSVAppends the masked rows to the result file.

A real workflow from our end-to-end test suite; the designer view is illustrated.

What you get. From the first pilot.

Telemetry analysed in the plant, inside the security zone

Evidence packages for NIS2 reporting and audits

Grid/energy telemetry aggregated at full rate on one box

Why your tools fall short.

Cloud IoT/analytics platforms violate OT segmentation and sovereignty expectations.

Traditional historians and SCADA reporting are not built for large ad-hoc analytics or replayable audit records.

Generic ETL/stream stacks are heavy to operate at small sites and not deterministic.

What drives it

NIS2 (Directive (EU) 2022/2555): Art. 21 risk-management measures, Art. 23 reporting obligations
CER Directive (EU) 2022/2557: resilience of critical entities, apply from 18 Oct 2024
Germany: KRITIS/NIS2 implementation
IEC 62443