Delhi NCR · Operating since 2002
Your ERP, MES, historians, SCADA servers, PLCs and HMIs now sit on connected networks that were never designed to be watched. Our SOC as a Service for manufacturing monitors both halves of that estate — office IT and plant floor — from one 24×7 operations centre, without installing anything on the controllers that run your lines.
This page covers how a plant is watched safely, why ransomware crews target manufacturers, and what the service costs against hiring an OT-literate team. For the generic model and tiering, start with SOC as a Service; for delivery scope, our managed SOC services; for the roster itself, 24×7 SOC monitoring in India.
Why this is hard
The IT/OT convergence problem
For twenty years the plant network and the office network were separate problems. Then ERP wanted production data, MES wanted scheduling feeds, and machine vendors wanted remote access — and the air gap quietly disappeared, one justified connection at a time.
Each link was added for a sound operational reason: ERP pulls output figures from MES, MES talks to the historian, the historian reads SCADA, SCADA drives the PLCs and HMIs that run the line. None was designed with an attacker in mind: protocols such as Modbus carry no authentication because they were written for an isolated world, and the flat networks and forgotten vendor accounts that accumulate over a decade of production are now reachable from the most phished network in the building.
ERP & business IT
Email, identity, dealer and vendor portals, finance systems. The exposed side: internet-facing, heavily phished, and the entry point in most manufacturing incidents.
MES, historians & SCADA
The bridge. Windows servers straddling both networks, patch-averse because uptime matters more than updates, and exactly where an attacker pivots through.
PLCs, HMIs & drives
The physical layer. Firmware measured in decades, no possibility of agents, and the part of the estate where a mistake stops production — or worse.
The result: the most exposed side and the least defensible side are wired together. Watching only one half is how manufacturers get breached.
The threat
Why manufacturing sits near the top of every ransomware league table
Attackers are rational. Manufacturing combines three things they look for: downtime priced by the hour of lost production, systems that cannot be patched, and management under contractual delivery pressure — a combination that makes plants among the organisations most likely to pay quickly.
The legacy problem deserves plain language: HMIs and engineering workstations on out-of-support Windows are not neglect but often a vendor requirement, because the machine builder certified the line on that exact build. Patching cannot simply be enforced, so protection has to come from elsewhere — segmentation, and detection that notices the moment anything unexpected touches those systems.
“We are too small to be targeted”
Ransomware is largely opportunistic. The scanner that found your exposed remote access does not check your turnover, and smaller plants are hit precisely because they are less likely to be watching.
“Our plant network is air-gapped”
In walk-downs we routinely find at least one bridge nobody owns: a vendor’s 4G dongle, a dual-homed historian, a maintenance laptop that straddles both networks. Assume connectivity and verify it.
Incidents enter through IT
Most manufacturing compromises begin with phishing or exposed remote access on the office side, then move sideways toward production. OT detection matters, but so does watching the route in.
Collection, safely
What a plant feeds a SIEM — and how, without touching the controllers
The rule in OT is simple: nothing is installed on, and nothing actively probes, the devices that run the process. Everything below is collected passively or read-only.
Scroll the table sideways →
| Source | How it is collected | What it tells us |
|---|---|---|
| Firewalls & IT/OT DMZ | Syslog and flow records from the boundary devices | Every crossing between business and plant networks, and between the plant and the internet. |
| Passive network sensor | SPAN port or TAP on the plant switch, with deep packet inspection of OT protocols | A living asset inventory: who talks to whom, and which commands are issued — with zero traffic directed at the devices. |
| Historians | Read-only connectors over the vendor’s own interfaces | Tag and setpoint changes, and a process record that makes tampering visible. |
| SCADA & HMI servers | Windows event logs, EDR where the vendor permits it | Logons, new services, engineering software launched outside maintenance windows. |
| Jump hosts & engineering workstations | Session logs and endpoint telemetry | The only legitimate paths for change to the control layer — everything else is suspicious by definition. |
| Remote access gateway | Brokered vendor access with session logging | When an OEM connects, from where, with which account, and what they touched. |
No agents on PLCs. No active scans of the control network. No polling storms against devices that have run untouched for fifteen years.
Safety first
The safety dimension: OT detection is not IT detection with different logos
In IT, the instinct on detecting a compromise is to isolate the host. On a plant floor, isolating the wrong device can stop a line or trip a process. The security triad inverts here: availability and safety outrank confidentiality, and the detection logic has to respect that.
So OT detections are built around change rather than signatures alone. We baseline what normal looks like for your plant — which devices talk, which commands are used, when engineering software legitimately runs — and alarm on deviation: a new device on the control segment, a firmware upload outside a maintenance window, a function code this PLC has never received. Response runbooks route through your plant operations, because some containment actions need an engineer who knows what the line is doing, not an analyst who knows what the packet is doing.
Availability and safety come first
Every OT runbook we write starts with the question “what does this action do to the process?”. Containment authority is agreed in writing before go-live, including which actions always require your engineer’s approval.
“A false positive is harmless”
In IT a false positive wastes an analyst’s hour. In OT a wrong response can have physical consequences, so plant detections are tuned to a far lower false-positive posture, even at the cost of longer investigation.
Third parties
Supply-chain exposure: OEM remote access and the vendor laptop
Most plants we assess have more third-party connectivity than anyone has written down: machine builders holding permanent remote access under maintenance contracts, sometimes with one credential shared across every customer they serve; vendor laptops that were on another plant’s network last week; USB media moving between machines and engineering PCs.
The answer is not to ban access the plant needs; it is to broker and watch it. Vendor connections terminate on a gateway you control, with time-boxed credentials and every session logged and alerted on. Engineering workstations are watched for tools that have no business there; we routinely find remote-desktop utilities installed by a contractor years ago and forgotten. Because the same OEMs serve your competitors, a credential stolen anywhere in the supply chain gets tried everywhere; our threat hunting looks for that pattern.
Obligations
DPDP, CERT-In and what your customers now ask of you
Two instruments apply to every Indian manufacturer. CERT-In requires specified incidents reported within six hours of being noticed and security logs retained for 180 rolling days within Indian jurisdiction; since the clock starts at noticing, reporting is a detection problem before a paperwork one. The DPDP Act 2023 covers the personal data in your ERP, HR, dealer and warranty systems — a breach that begins on the plant side can still end as a DPDP obligation.
Commercial pressure is growing faster than regulation. Automotive and pharmaceutical supply chains increasingly audit their suppliers’ security monitoring, and large OEM customers send questionnaires that effectively demand evidence of continuous monitoring. “We have a firewall” no longer passes. Our compliance services page maps the requirements to their instruments, and a monitored estate generates the audit evidence as a by-product.
At scale
One SOC, many plants
Most Indian manufacturers we work with run more than one site, and the economics improve with every plant added. A lightweight collector at each site forwards telemetry over your WAN or SD-WAN to the central platform; events are tagged by plant, so one shift sees the entire estate while local teams keep a per-site view.
Detection content is written once and applied consistently, ending the quiet drift where one plant is well watched and another is not. Correlation works across the estate: the same vendor credential tried at three plants in a week is one incident to us, not three curiosities. This is the same SOC as a Service model scaled from one plant to fifteen — tiering, escalation paths and reporting identical, only the collectors multiply.
Money
What an OT-literate in-house team would actually cost
The staffing arithmetic is unforgiving before OT enters the picture. One continuously covered seat is 8,760 console-hours a year; one analyst delivers roughly 1,900 productive hours after leave and training — about 4.6 full-time equivalents per chair around the clock. A credible three-tier roster runs to roughly ₹1.4 crore a year in base salary, for IT-literate analysts.
Now add the OT requirement. People who understand both security operations and PLC environments are among the rarest skills in the Indian market, competed for by machine vendors and integrators who can offer plant-floor work rather than a console. Hiring one is hard, keeping one is harder, and a single OT-literate engineer is a single point of failure. This is precisely the gap the shared model fills; the full arithmetic — pricing units, log volume, retention, year-two costs — is in our guide to SOC as a Service pricing in India.
P J Networks
Why buy this from us
We have run network and security operations from Delhi NCR since 2002, across estates that include plant floors, and we staff the watch ourselves.
Our own analysts
Fifty-plus in-house NOC and SOC engineers in Delhi NCR, on our payroll, watching around the clock. No subcontracted tier to discover during an incident.
Certified, SOC in scope
ISO/IEC 27001:2022 certified with the security operations centre inside the certified scope — the scope statement is available on request.
Platform flexibility
We run our own PrahiX Ora SIEM/SOAR, operate FortiSIEM, and can take over a SIEM you already own. Multi-vendor estates are the default, not an exception.
Straight answers
SOC as a Service for manufacturing, answered
Can you monitor PLCs and SCADA systems without installing anything on them?
Yes, and it is the standard approach rather than a compromise. A passive sensor on a SPAN port or network TAP watches traffic to and from the control layer without sending a single packet to it, while SCADA servers, historians, jump hosts and firewalls contribute their own logs. PLCs cannot run agents and should never be actively scanned, so nothing is installed on them, ever.
How do you handle legacy systems that cannot be patched?
We treat them as permanently vulnerable and build compensating controls around them: strict segmentation so they speak only to what they must, passive detection that alarms on any unexpected communication, and close monitoring of every remote access path that reaches them. Monitoring replaces the patch you cannot apply — it does not remove the vulnerability, it removes the attacker’s privacy.
Can one SOC watch multiple plants at once?
Yes, and that is the normal shape of a manufacturing engagement. A collector at each site forwards telemetry over your existing WAN or SD-WAN, events are tagged by plant, and one shift sees the whole estate with per-site views for local teams. Detection content is consistent across sites, so a pattern appearing at two plants is handled as one incident, not two coincidences.
Do you actually understand OT protocols?
Specifically: our detection content covers the protocols we most commonly see in Indian plants — Modbus/TCP, EtherNet/IP, PROFINET, Siemens S7, OPC-UA and DNP3 where present — at the level of which devices are talking, which function codes are used, and what changed from baseline. We are honest about the limit: whether a setpoint change is wise is a process-engineering judgement that stays with your plant engineers, and our runbooks respect that boundary.
What does OT-aware monitoring cost?
More than IT-only monitoring, considerably less than an OT-literate in-house team. Price follows the number of sites, monitored asset count, log and flow volume, and whether passive OT sensors are needed. A single plant typically adds modestly to the base SOC service, and multi-plant estates get cheaper per site. We scope your estate and quote a specific monthly figure; the cost drivers are in our SOC as a Service pricing guide for India.
Are our logs stored in India?
Yes. CERT-In requires security logs retained for a rolling 180 days within Indian jurisdiction, and we retain them in-country by default. Plant telemetry is mostly machine data, but where personal data appears — operator accounts, access records — the DPDP Act applies as on the IT side, and the same retention and residency discipline covers it.
What does onboarding look like for a plant network?
It starts with a walk-down, not a scan: we inventory zones and connections with your plant and IT teams, agree the passive tap points and collector placement, and document the legitimate paths for change and vendor access. First telemetry usually flows within days; meaningful detection takes four to eight weeks, because the value comes from baselining what normal looks like for your plant. Active scanning of OT segments is off by default.
If the plant floor is attacked at night, who responds?
The same roster as the day shift. An L2 analyst validates the alert and opens the case, and for a priority incident your escalation list — plant head, maintenance lead, IT contact — gets a phone call, not an email into a shared mailbox. What we are authorised to do next is agreed in writing before go-live: some containment actions we take immediately, others always need your engineer’s approval, because stopping a line is a production and safety decision.
Next step
Put your plants under one watch
Tell us how many sites, what runs them, and what remote access exists today. We will scope the estate, quote a specific monthly figure, and put the in-house comparison next to it.
P J Networks Pvt Ltd · C-160, Mayapuri Phase II, New Delhi 110064
+91 98183 61787 · sanjay@pjnetworks.com
Related
Related to SOC as a Service for manufacturing: the generic SOC as a Service model, our managed SOC services, 24×7 SOC monitoring in India, SOC as a Service pricing in India, threat hunting, compliance services.