Every OT device correlated against actively exploited vulnerabilities, with AI reading manufacturer advisories so your team doesn't have to. The complete asset inventory that makes it possible runs underneath — standard on every deployment, never the headline.
Unpatched, unmonitored OT equipment is one of the easiest ways into a factory network — old PLCs nobody's tracking, protocols nobody's watching, vendor security bulletins nobody has time to read. VigiaOT turns that blind spot into a continuously correlated, AI-curated view of what's actually exploitable on your floor right now — built on the asset visibility needed to make that correlation trustworthy in the first place.
The big picture
One box, watching and scanning the floor, correlating against public feeds and an AI-curated vendor-advisory corpus.
The catalog builds itself
The other thing this is: a serious tool for building an OT asset inventory without walking the floor with a spreadsheet. It finds what's on the network and fills in what it can see automatically — a technician only adds the handful of things a scan can never know.
Discover
Active scanning finds every device on the network — PLCs, HMIs, switches, gateways — including the ones nobody remembered were still plugged in.
Characterize
Vendor, model, firmware version, protocols and open ports are filled in automatically from what the scan actually sees — not a guess based on a MAC prefix.
Confirm & Catalog
A technician adds only what a scan can't know — Machine ID, location, criticality, who's responsible — and saves it to the catalog. Minutes per device, not a spreadsheet afternoon.
What your team actually opens Preview — illustrative UI
No new platform to learn and no cloud login — a lightweight dashboard served locally by VIGIA-IOTBOX, no internet required. The screens below are representative mockups of the interface, not live data.
Confirmed vulnerabilities
| CVE | Severity | CVSS | Device | Machine | KEV |
|---|---|---|---|---|---|
| CVE-2024-38475 | Critical | 9.8 | 10.0.4.22 (plc-cnc014) | CNC-014 | Yes |
| CVE-2023-29464 | High | 8.1 | 10.0.4.31 (hmi-rob071) | ROB-071 | — |
| CVE-2022-1234 | Medium | 5.4 | 10.0.4.55 (gw-pkg002) | PKG-002 | — |
AI Alert · CVE-2024-38475
Module 2A remote attacker on your network can bypass the web server login on this exact PLC and gain full engineering access — no credentials needed. This firmware version is on CISA's Known Exploited Vulnerabilities list, meaning it's already being used in attacks.
- Isolate CNC-014's engineering port (443/tcp) — allow only the SCADA link.
- Update to firmware V2.9.5 or later at the next maintenance window.
- Until patched, disable the web server in TIA Portal → Protection & Security.
How it works
A technician's own laptop visits each isolated OT cell to discover and catalog it — no dedicated VigiaOT hardware there. Correlation and AI triage happen once that inventory reaches VIGIA-IOTBOX, one appliance per site, on the customer's own IT network.
What ships standard, what's a module
Base makes the correlation possible. Module 1 and Module 2 are where the actual vulnerability intelligence and AI triage live — most customers land there.
Base
Per-protocol active scanning and local inventory, entirely offline — the laptop never needs a network beyond the cell it's in. Once pushed to VIGIA-IOTBOX, it's automatically correlated against NVD and CISA KEV at no extra cost. The foundation everything else builds on.
Passive
Runs on VIGIA-IOTBOX, watching the customer's IT network for OT devices bridging across — like a cell's Main PLC reporting to a MES server — without ever probing inside an isolated cell. A boundary-hygiene signal, not a way to complete a cell's inventory.
Vendor Advisories + AI
AI reads every new manufacturer security bulletin and turns it into a short, ranked list your team can act on — not a stack of technical PDFs. Grows with every customer: a vendor gap found on one factory floor closes for everyone else too, once a human has reviewed it. Most complete when paired with Module 1.
What's billed once, what recurs
Solo tiers activate once, per PC — Solo Analytics also carries a small annual fee to keep the vulnerability feed current. Once a second PC needs to join, Site Analytics takes over, billed annually per site; its VIGIA-IOTBOX hardware is optional, and its two modules are separate annual add-ons.
| Item | Billing | |
|---|---|---|
| Solo InventoryActive discovery and a living local catalog on one technician's laptop — no server, no vulnerability correlation. | One-time, per PC | On request |
| Solo AnalyticsSolo Inventory plus NVD/CISA KEV vulnerability correlation and review, on the same laptop. | One-time + annual feed fee | On request |
| Site AnalyticsSITEOne VIGIA-IOTBOX aggregating every technician and cell into a single site-wide catalog. Base price includes 2 iscanner seats; additional seats billed separately. | Annual, per site | On request |
| Passive ModuleADD-ON · SITE ONLYContinuous IT-network listening via Zeek, for OT devices bridging the IT boundary. | Annual | On request |
| AI ModuleADD-ON · SITE ONLYAI reads manufacturer advisories and drafts reviewed alerts — bundled rate when paired with the Passive Module. | Annual | On request |
| VIGIA-IOTBOX hardwareOPTIONALPre-configured appliance, one per site — only if the customer doesn't provide their own server. | One-time | On request |
| Setup on customer-provided hardwareIF WE INSTALLInstallation, configuration & licensing, if our team handles the setup instead of the VIGIA-IOTBOX. Self-installed by the customer's IT — no extra fee. | One-time, at install | On request |
The Passive Module and the AI Module can be bundled at a reduced combined rate. Every deployment is quoted individually — get in touch at codebox.pt/vigia.
Connectivity models
Only relevant if Module 2 is enabled — the base tier always runs standalone. VIGIA-IOTBOX itself never has, or needs, a route to the public internet; the choice is simply whether the customer's own IT network gives it any governed path onward at all.
IT Network Uplink
VIGIA-IOTBOX sits on the customer's IT network like any other server. If that network has a governed outbound path — the customer's own firewall, their own rules — the vendor-advisory corpus stays synced automatically.
USB Updates
For sites where VIGIA-IOTBOX has no outbound path at all. The same curated corpus arrives by USB, delivered on a scheduled site visit — with the natural lag between visits.
For whoever decides, and for whoever operates
The same system, two arguments — because the decision to install this on the factory floor is never one team's alone.
IT / Security
- AI-curated vulnerability intelligence, not a raw CVE keyword match — reads manufacturer bulletins so your team doesn't have to.
- No dedicated hardware in the OT cells — VIGIA-IOTBOX lives on the IT network, never reachable from outside.
- No VPN, no dependency on the customer's existing network infrastructure.
- Exportable inventory (JSON/CSV) and continuous NVD/CISA KEV correlation, standard.
Operations / Shop Floor
- No probe ever writes to equipment — read-only, across every supported protocol.
- Active scanning only runs in windows the factory schedules — never in production without sign-off.
- No agents to install on legacy equipment — all the listening happens on the network side.
- A 1998 PLC is exactly as visible as a switch installed last week.
Ready to see it on your floor?
Tell us a bit about your operation and we'll get back to you — typically within one business day.
Passive first, active under control — the same architectural principle used by established OT security vendors, standard in one box per factory, everything else by module.