Solo Analytics
Discovery and vulnerability review for an OT installation, running end to end on one technician’s laptop — no server, no site infrastructure, no second workstation required.
One visit, one flow
Every site visit follows the same path, from the first network sweep to the report that leaves the laptop.
Finding what’s actually there
Active discovery, limited to the address range the technician gives it — one cell, one subnet — never the customer’s whole network by accident.
Coverage already reaches well beyond Siemens: Rockwell/Allen-Bradley (EtherNet/IP), Schneider Electric and any other Modbus- or OPC UA-speaking PLC are picked up by the same scan.
No admin rights needed
Runs as a normal user account — the technician is rarely a local admin on a customer-owned laptop.
No extra drivers
No special network drivers to install on the scanning machine.
Controlled pace
A quick liveness check runs before any port or protocol probing, one attempt per device, no aggressive retries — and every protocol probe stays strictly read-only. A per-scan device exclusion list lets a technician rule out specific equipment before a scan even starts.
Curated before it counts
Every device found is reviewed and confirmed by hand before it joins the inventory — nothing is added automatically.
A catalog that accumulates, not resets
Recognized across visits
A device already inventoried is matched on a later visit, even if its IP address changed, and compared against what was already known.
“Identical” vs. “changed since last scan”
When something changes — open ports, identification data — the exact fields that changed are listed, instead of the device looking simply “new” again.
Editable & managed
Every asset can be classified — location, criticality, responsible party, device type — and kept current directly in the inventory.
From asset to actual exposure
Every inventoried device is correlated against public vulnerability sources — NVD and CISA KEV (Known Exploited Vulnerabilities) — to surface the CVEs tied to that exact equipment and their CVSS severity.
Active-exploitation priority
Anything on CISA’s KEV list — already exploited in the wild — is flagged as top priority, ahead of every other criterion.
A live overview
Inventory coverage, criticality and severity distribution, and review progress — always computed from the latest data, not a stale snapshot.
Every finding gets a decision
Finding a vulnerability isn’t the end of the process — each one has to be explicitly assessed by someone accountable, with the reasoning on record. Nothing is just “found and forgotten.”
No decision recorded yet.
Assessed and consciously accepted, with justification.
Fix scheduled; reopens automatically after 90 days with no closure.
The correlation doesn’t apply to this device.
Vulnerability fixed.
Justification required
Every decision except “remediated” requires a written justification — no closing a case silently.
Automatic reopening
An “accepted risk” reopens itself as New if that vulnerability lands on CISA’s KEV list afterwards.
Audit trail
Every decision is tied to who made it — an authenticated user — and when, never to a free-text field.
KEV first, always
Review lists always sort actively-exploited vulnerabilities first, then device criticality, then CVSS severity.
Exposure as its own risk factor
Beyond criticality and severity, every device is classified by its network exposure — in plain language, answered by the technician on site, no formal network-architecture knowledge required.
No connection to other networks.
Separated from the IT network by defined controls.
Communicates directly with the corporate network.
Reachable from the public internet.
Every declaration is stamped with author and date, and can never be edited retroactively without leaving a trace — it’s an audit fact, not just a label.
One workstation, several people
Local PIN gate
Name and PIN required before any data or feature becomes accessible — protects a laptop that goes home in a bag every night.
Correct attribution
Every review decision and every network-exposure declaration is tied to whoever was actually signed in — never a freely-typed name.
No persistent session
Always asks for credentials on launch — protects a lost or unattended laptop.
Team management
Add a colleague, reset a forgotten PIN, or remove access, all inside the app itself.
What leaves the laptop
| Detailed export (CSV) | One row per assessed vulnerability, with device, location, criticality, network exposure and decision — the working record for a direct conversation with the site’s own responsible person. |
| Executive report (Excel) | Aggregate summary, no per-case detail — inventory coverage, criticality/exposure/severity distribution, review progress, and change vs. the previous visit. Includes a “needs attention” table of still-undecided KEV findings. |
| Site identification | Every report is stamped with the site/customer name, so files stay distinguishable once they leave the workstation — email attachment, archive folder. |
Grows with the account, not against it
Activation is local, tied to the machine the app runs on — no central accounts, no permanent connection to a licensing server required.
Evaluation license
Fully functional, with a cap on inventory size — built to prove the value before committing.
Full license
Removes the device cap, for continued use on a single workstation.
When a second workstation needs to feed the same inventory, or several installations need one central view, the next tier — Site Analytics — handles aggregation across workstations, with nothing already collected lost in the move.
What actually needs the internet
Questions about deploying this on your floor? Get in touch.