The UMX Explorer passive probe inventories the industrial network without sending anything onto it. UMX Risk Manager turns it into an IEC 62443 risk analysis and a costed action plan.
The process has four steps. Every image is a capture of the consoles, taken on Ultrametrix's demonstration data.
The probe plugs into a mirror port. Nothing is installed on the controllers.
The switch copies the traffic to the probe through a mirror port (SPAN) or a TAP. The probe listens without sending anything: over a 24-hour bench test, no frame left its capture port.
The console shows the traffic received port by port. The umx doctor command checks that the mirror session carries exchanges between other machines.
The inventory is built from the exchanges observed on the network.
Vendor, model and firmware version are read in the Modbus, S7 or EtherNet/IP answers. Every field gives its source; a value not seen is marked “not observed”.
Each asset is placed from the structure of its exchanges, never from an address range. The flows between subnets are drawn and counted.
For SSH, Telnet, VNC, RDP, SMB and VPNs: who connects to which device, when, and whether the channel is encrypted. It is read in the protocol, not inferred from the port number.
UMX Risk Manager builds the IEC 62443 risk analysis from that map.
Risk Manager proposes zones from the capture. Your engineer confirms, renames or splits them. The HAZOP study then sets the target security level (SL-T).
Inherent risk, analyzed risk, then current and planned residual risk. Every score shows its calculation and the share of the evidence that is inferred or potential.
Every countermeasure carries a cost, an effort and the risk it removes per thousand euros. The actions are ranked by that ratio.
The first five actions, their cost and the risk each one removes, with a decision and signature block for management.
From the analysis, Risk Manager produces the reports and the projection onto the ReCyF.
The analysis is projected onto the 20 objectives of ANSSI's ReCyF v2.5, a working document. Every status points to the project's dated evidence or to the declaration to provide. The projection helps prepare the NIS2 file; it is neither a certificate nor a compliance verdict.
Risk analysis of the site and of each zone, decision page, ReCyF audit, action plan, registers of remote access and of risk acceptances.
Computed by UMX Risk Manager
Figures produced by the consoles on the demonstration plant, an industrial network simulated by Ultrametrix with emulated controllers. None comes from a customer site; all can be reviewed in a demonstration.
Decision page
€30,250
Ranked by risk removed per euro, with their cost and the vulnerabilities they close.
Costs as orders of magnitude excluding tax, €9,500 to €51,000 for the five.
The demonstration plant as the probe saw it, then imported into Risk Manager. One square stands for one asset.
16
Five of them were still to be confirmed by an engineer on the day of the capture.
37
Each with its cost, its effort and the risk it removes.
26
Including four skipped Purdue levels and an OT-to-IT flow, read in the traffic, without an active scan.
20
Each status linked to dated evidence or to the declaration to provide, to prepare the NIS2 file.
Industrial
Remote access
Free, 100% passive
A factual inventory, with no risk interpretation
IEC 62443-3-2 risk analysis
Risk analysis and action priorities
Off by default. Once on, it sends only the scope the operator confirms: domains, public addresses, brands, keywords and products (vendor, model, version). The inventory, the topology and the risk analysis do not leave the site.
Seven reports, in French and in English, produced from the console for management and auditors.
The probes, the central console and Risk Manager run inside your network, including an isolated one. Two functions can reach the outside, both off by default: the CTI module, limited to the scope the operator confirms, and the check for new versions.
Ultrametrix
Ultrametrix is a non-destructive testing laboratory based in Saint-Genis-Laval, near Lyon, France. It examines parts and structures without altering them, for industry and buildings. UMX applies the same principle to the industrial network: observe without interfering.
UMX Explorer is free: plug it into a mirror port and see what it finds on your network. The results shown here come from Ultrametrix's demonstration plant; with UMX, Ultrametrix opens a new activity.
Indicative catalog prices, per year and per deployment.
Free
The passive inventory of the industrial network: free, no license to activate.
€4,500/year
The IEC 62443 risk-analysis console, fed by Explorer.
€7,900/year
Risk Manager with threat intelligence: external sources, matched to the inventory.
On quote
Several deployments, with dedicated support.
Ultrametrix carries out or co-produces the risk analysis with your teams, from mapping to the final report, then makes you autonomous. On quote.
Ultrametrix presents both products on the demonstration data. A trial of UMX Explorer on one of your mirror ports can follow.
You can also write to contact@ultrametrix.fr
