Detect what changes in the plant, without touching the plant.
LogLM understands how OT networks behave and flags the sequences that diverge, across industrial protocols and the IT telemetry around them. Vigil shows analysts the protocol operations behind each finding. Both run inside your boundary, on premises or fully air-gapped, with no cloud connection required.
Observes traffic and protocol operations. Issues no commands, joins no control loop.
Behavioral detection surfaces concerning sequences without a signature written for each device.
Inference, findings, and investigation stay on infrastructure the operator controls.
Water-plant range, finalized PCAP, on-premises inference.
The Technology Advancement Center ran LogLM and Vigil against its WS3 water-plant range on an NVIDIA Jetson AGX Orin. The results were eye opening. Despite not being trained on the environment, or using any signature based detections, DeepTempo saw the attack and Vigil provided a local AI model powered immediate investigation and response.
Full validation data, deployment boundary, and TAC's perspective.
You cannot patch your way out, and you cannot phone home.
The defenses that work in IT assume conditions OT rarely offers. Controllers run for decades on firmware that cannot be updated without a maintenance window nobody wants to schedule. Networks are segmented, often air-gapped, and telemetry that leaves the plant is a liability, not a convenience.
Vulnerabilities persist for years. Detection has to work against the environment as it is, not as a hardening guide wishes it were.
Vendor-hosted analytics that require telemetry egress do not fit regulated plants, defense ranges, or utilities under sovereignty mandates.
A malicious or misconfigured endpoint speaking well-formed protocol traffic looks legitimate to a rule. Its behavior over time does not.
Operators need to see the register reads and writes behind a concerning sequence before they act on it.
From telemetry to operator-ready evidence.
A fail-closed pipeline. Only accepted result bundles reach analysts, and the evidence behind each finding stays inspectable. The TAC validation ran it on finalized PCAP; the same pipeline accepts whatever telemetry your plant already produces.
Collect
Telemetry as you already gather it: packet captures, flow logs, protocol logs, SIEM or data lake exports. No agents on controllers.
Normalize
Telemetry is automatically normalized and ingested through the scale-out architecture of the Intelligent Defense Platform, with protocol operations preserved as semantic events.
Detect
LogLM scores sequences for divergence from expected network behavior, locally.
Accept
Result bundles verified before release. Nothing unverified reaches the queue.
Investigate
Vigil presents findings alongside the flows and protocol operations that produced them.
One model that detects. One workflow that explains.
LogLM
An encoder-only transformer foundation model trained across diverse security telemetry. It embeds sequences of network and protocol activity and classifies compound behavior, so a rogue endpoint is caught by what it does rather than by a rule someone wrote for it.
Vigil
The leading open source AI SOC, Apache 2.0. Vigil is telemetry- and vendor-agnostic. It turns a LogLM finding into a case an operator can reason about: the flows, the protocol operations, the endpoints, and the timeline, with agentic workflows for investigation and response.
A rogue HMI, found by behavior alone.
TAC's vStrike range introduced a second HMI issuing competing commands, causing a simulated flow valve to fluctuate against the benign HMI. LogLM identified the sequences involving that endpoint as concerning with no preexisting rule, signature, fine-tuning, or adaptation, outperforming the alternatives TAC assessed.
Vigil then exposed the corresponding flows and Modbus operations, 120 register reads and 30 writes, for protocol-level review. vStrike supplied the ground truth independently: the endpoint LogLM flagged was the rogue.
Confidence describes the anomaly verdict, not an attack probability. Standard deployment and pipeline configuration were still required.
Accepted results from the WS3 water-plant range.
Results are specific to the named accepted artifacts from TAC's WS3 validation and are not general production guarantees. The onsite deployment processed finalized PCAPs in batches; continuous streaming inference and direct SCADA integration were not part of the validated scope.
DeepTempo is delivering a powerful analyst-assistant capability that adds true plant-operating-state semantic analysis, pairing its established IT analysis with meaningful, plant-aware OT analysis. Initial coverage centers on Modbus TCP monitoring and control traffic; near-term expansion to DNP3, EtherNet/IP, and other ICS protocols will give SOC teams significant coverage of critical infrastructure plant operations.
The model travels to the data. The data stays where it is.
There is no hosted tier and no telemetry egress. Fleet-wide model improvements arrive as versioned artifacts you install on your own schedule.
On premises or fully air-gapped
Edge GPU or rack server inside the plant network. Proven on an NVIDIA Jetson AGX Orin in the TAC validation.
Inside your existing data lake
Run LogLM where flow and protocol telemetry already lands, upstream of the SIEM, with up to 45% lower SIEM cost.
Bring your own cloud or Kubernetes
For operators with an approved private cloud, deploy into your tenancy under your controls.
Before you let anything near the plant.
Does it require a cloud connection?
No. LogLM inference, Vigil, and the findings store run inside your environment, including fully air-gapped sites. Nothing is sent to DeepTempo.
Does it interact with PLCs or the control loop?
No. Collection is passive. The platform observes traffic and protocol operations and issues no commands.
Which protocols and telemetry does it work with?
LogLM evaluates industrial protocol traffic together with the IT telemetry around it, and Vigil is agnostic to source and vendor. The TAC validation exercised Modbus TCP, with reads and writes preserved as semantic events; the platform is not limited to it.
Do we need to write a rule per device?
No. LogLM detects divergence in behavioral sequences. In the TAC validation it surfaced the rogue HMI with no device-specific rule, signature, or fine-tuning.
Can we start without changing anything in the plant?
Yes. An assessment runs against telemetry you already have. LogLM reports what it finds; you decide what comes next.
Start with the telemetry you already have.
Send packet captures or flow telemetry from one segment. We run LogLM against it and return the findings with the protocol evidence behind each one.