Nozomi Networks’ OT security detects hidden changes in PLCs and production equipment in smart factories and visualizes threats before they escalate into process shutdowns.

Nozomi Networks Korea (President Jiyong Park) held a tour of its OT security demo center for domestic partners and journalists at the Digital Transformation Hub of Gyeonggi Technopark in Ansan, Gyeonggi Province on July 22, and revealed how security solutions operate in actual processes.

This demo center is a space that has been expanded into an OT/IoT security demo center by installing Nozomi Networks equipment in the existing Mitsubishi Electric Automation demo center.

As I entered the demo center, a scene different from a typical exhibition hall unfolded.


What caught my eye before the information boards and explanation panels was the smart factory equipment that was actually in motion.
The production line, with its connected conveyor, control panel, and PLC, was not merely a model, but a small factory where equipment used in industrial settings worked together.

According to Park Ji-yong, Branch Manager of Nozomi Networks, the center utilizes the first and second floors of the Gyeonggi Technopark Digital Transformation Hub and is configured to enable asset visualization of production facilities and detection of cyber threats on an actual operating smart factory line.

The product that attracted the most attention at the event was 'Arc-Embedded,' a PLC-equipped OT endpoint security sensor.


According to Branch Manager Park Ji-yong, this sensor utilizes existing PLCs as security sensors in facility sections where it is difficult to add separate security equipment, performing asset visualization and threat detection within the factory network.

During the actual tour, we were able to see Arc-Embedded modules installed inside various PLCs, and these devices acting as OT security sensors.

The core of the demonstration that the reporter observed was not “security watching from outside the process,” but “entering the process.”

According to a Nozomi Networks official, it was difficult to determine the detailed status of the control layer where the PLC is located, known as the Purdue Model Level 1 area, using the existing method.


On the other hand, Arc-Embedded collects data directly from within the PLC and transmits it to Nozomi Networks' Guardian, which allows for more precise verification of equipment status and behavior than the existing network mirroring method, they said.

On the actual Guardian screen, PLC and asset information connected to the demo center were displayed in a dashboard format.

On one side of the screen, the status of the Arc-Embedded PLC was displayed, along with information such as the last synchronization time, uptime, and resource utilization.

On the asset screen, devices collected via Arc-Embedded were classified as 'Captured Devices,' and selecting a specific asset allowed users to view detailed information such as the operating system, address, serial number, LED status, and operational status.

The notification screen was more direct.

When a Nozomi Networks official searched for 'stop', an event where the equipment stopped appeared, and process-related actions such as changes in program transmission, changes in device specifications, and the start and stop of equipment were also confirmed as notifications.

It was impressive that actual changes in equipment operation were translated and displayed as security events, rather than the malware or account login events commonly seen on standard IT security screens.

This means that changes in the status of the factory's valves, motors, and controllers no longer rely solely on the field worker's senses, but become data that can be tracked on the security monitoring screen.

Another key feature introduced on this day was the SaaS-based platform Vantage and the AI analytics function VantIt was age IQ.

Jang Jae-an, Director of Nozomi Networks, explained that Vantage IQ is a feature that allows for the centralized operation of data collected from various sensors, such as Guardian, Remote Collector, Guardian Air, and Arc-Embedded, and performs AI-based analysis on top of it.

Director Jang Jae-an introduced Vantage IQ, stating that it can be used with natural language questions instead of complex queries and even suggests notification priorities and recommended actions.

During the demonstration, when the question “Show me the notifications currently occurring that require immediate attention” was entered, a screen was introduced in which the AI presented alerts by severity and immediate actions based on collected data.

Next, in response to the question, “Please write a report on this week’s security status so that it can be presented to the CISO or executives,” an example was provided showing how to organize vulnerability status, alarm patterns, and improvement plans in a report format.

Director Jang Jae-an explained that this allows even personnel with limited security experience to quickly grasp the current situation and report or respond.

Park Ji-yong, Branch Manager of Nozomi Networks, explained that the reason for opening the demo center was that while there is a high demand to see OT security solutions in the actual field, it is difficult to disclose actual deployment sites to the outside due to security reasons.

In addition, marking its fifth year in Korea, the company announced that it will operate this center as a space where customers and partners can regularly visit to check OT security solutions, as its domestic business is growing.

Branch Manager Park Ji-yong stated, “OT security is no longer a concept confined to reports, but a technology operating within the PLCs, sensors, and notification screens of actual production lines,” adding, “As the digital transformation of factories accelerates, security must also be part of the process "It must become part of the process, not the outside," he stated.