Product
The advisor, and the logbook it reads.
Twelve modules collect the facts about your plant. The advisor layer turns them into findings, a score, a plan and answers — all from the same database, the same login and the same evidence record, inside your plant network.
The advisor layer
Deterministic rules, transparent scores, cited answers. Nothing here is estimated, and nothing here depends on AI.
Today
The page you open first: what requires attention ordered by Priority Score, critical / high / medium counts, overdue actions, what changed since yesterday and since your last login, and PlantGuard's recommended priorities. Filter by site, category, severity, criticality, owner.
Findings & Recommendations
Thirty-six rules across lifecycle, backup and recovery, configuration, firmware, availability, capacity, AD compliance, firewall hygiene, SNMP posture, endpoint protection, vulnerability-scan results, door access and inventory quality. Each finding carries the fact, PlantGuard's interpretation, the recommendation, a timeframe and a 0–100 Priority Score with a full breakdown. Assign, acknowledge, resolve, accept risk with approver and expiry, suppress — every action audited.
Correlated risks
One asset with open findings in several risk areas becomes one correlated finding — for example Critical infrastructure lifecycle and recovery risk: CORE-SW-01 — with evidence quoted from each child, an ordered plan, and automatic resolution when the children close.
Plant Health Score
One 0–100 number with six sub-scores: availability, recovery readiness, cyber security, lifecycle, compliance, configuration control. Each shows its facts and the findings that cost the most points; a dimension without data is not assessed. Daily snapshots give the 30- and 90-day trend. Weights are yours to set.
Executive Dashboard
Score, trend, sub-scores with a per-dimension why, correlated risks to plan around, top priorities, decisions requested, risk posture, asset base and lifecycle outlook — exported as a branded PDF in one click.
Asset 360
Everything PlantGuard knows about one asset on one page: identity, health, topology and downstream dependants, security posture, recovery state, lifecycle dates, change history, compliance findings, open findings and assigned actions.
Lifecycle & Budget Planner
Every asset needing a lifecycle decision, with the reason and a recommended target year derived from its dates. Record strategy, replacement model, estimated cost, target year and quarter, project code and budget status; see the budget by year with the critical candidates that still have no plan. PlantGuard never estimates a price.
Twelve reports
Executive Summary, Findings Register, Critical Asset Risk, Lifecycle & Budget Plan, Backup & Recovery Readiness, Security Exposure, Compliance Deviations, Availability & Capacity, Risk Governance, Inventory Data Quality, Control Coverage, Firmware Patch Readiness — previewed in the app, exported as PDF, CSV or Excel, offline, audited.
AI Advisor
Ask in plain language. The question is routed deterministically to the findings, scores, plans and reports; the answer cites finding ids you can click. The optional local model may rephrase the evidence, and its wording is discarded if it cites anything not in it. With no evidence the answer is exactly: PlantGuard does not currently have enough evidence to determine this.
What the AI does — and does not do
PlantGuard's rules, scores, plans and reports are deterministic: the same data always gives the same finding, the same score and the same recommendation, and every one of them quotes the records it came from. The optional local language model — a llama.cpp engine running as a second Windows service on the same server — is allowed to do exactly two things: write a narrative over evidence PlantGuard has already established, and phrase an answer to a question from an evidence pack PlantGuard has already assembled.
It cannot create a finding, change a score, invent a number or reach a device. Its output is checked before you see it: an answer that cites an unknown finding, runs too long or drifts into structured output is dropped and the evidence-based answer is shown instead. Switch the engine off and every page, score, report and answer keeps working — only the narrative disappears.
What the answer looks like
“Start with CORE-SW-01: it carries the correlated lifecycle and recovery risk [PG-2026-000027] (score 100) and is past vendor support [PG-2026-000001]. HIST-SRV-01 is offline with failing backups [PG-2026-000028]. Assign owners first — none of the top five findings has one.”
AI narrative · citations verified · evidence one click awayThe logbook: twelve modules
Device Inventory
Single source of truth for every asset: type, vendor/model, serial, site, building and room, owner, custodian, criticality, EOL/EOS and warranty, and every network card a device has. SNMP v2c/v3, WMI or stand-alone - stand-alone devices are verified by hand on a schedule. Import/export, QR asset labels, data-quality report.
Platform Health
NOC-style live view via SNMP with ICMP fallback: uptime, CPU, memory, storage, model detection — plus SNMP security posture, the health of PlantGuard's own services and jobs, and daily logs.
Monitoring & Alerts
Scheduled polling of every networked device with thresholds, device-down after N failures, acknowledge and auto-resolve, and per-device trend charts. Real-time syslog and SNMP-trap reception.
Topology Map
Auto-discovered from LLDP/CDP neighbour tables - including a device's second network card, redundant and management links, and connections that disappear. Tier and zone views, upstream path tracing, downstream impact for every finding, PDF export.
Firewall Matrix
Inter-zone communication rule register with expiry tracking, CSV exports for DMZ letters, and read-only rule import over SSH from PAN-OS, Cisco ASA/FTD, FortiGate and Juniper SRX.
AD Compliance
Group Policy collected from the domain and scored against a 34-check OT baseline cited to NCA ECC-2:2024 and OTCC-1:2022. Per-GPO applied / not-applied device scope, OU coverage, waivers, PDF report.
Door Access
Physical access register for controlled rooms and cabinets, with connectors for Suprema BioStar 2/X, LenelS2 OnGuard, Genetec Security Center, Software House C•CURE 9000 and Honeywell Pro-Watch.
Credential Vault
Encrypted storage of device credentials linked to inventory, click-to-reveal with automatic re-hide and an audit trail of every reveal. SNMPv3 SHA-2 / AES-256 and Windows monitoring without local admin rights.
Config Backups & Firmware
Scheduled configuration backups of network devices into a local vault, diff review, and a firmware repository with per-model baselines the findings engine checks against.
Support Lifecycle & Spare Parts
Support contracts and application licenses correlated with the asset record - each date entered once - with a worst-wins status across contract, hardware EOL and warranty, and a spare-parts matrix with coverage and low-stock flags.
Documents, Controls & Frameworks
Versioned MOC forms, test records and procedures with full-text search; security controls extracted from standards, and a coverage view per framework of what PlantGuard evidences and what it does not.
AI Automations
The local engine (optional) writes the daily digest, watches anomalies, reviews config changes and summarises privilege activity weekly — deterministic reports when the engine is off.
Framework mappings and assessment capabilities are intended to assist organizations with evidence collection and internal assessment. They do not constitute certification, accreditation, or endorsement by the organizations responsible for these frameworks. PlantGuard.ai does not hold, and does not claim, any certification against IEC 62443, NIST SP 800-82, ISO/IEC 27001, NCA ECC or NCA OTCC.
Patching network devices, without patching blind
Upgrading a switch in a running plant is the moment most likely to cause an outage. PlantGuard treats it as evidence work: it refuses far more often than it proceeds, and it says why.
Gates before, not warnings after
Every upgrade passes the same checks first: the image is registered for that exact model with a verified checksum, the upgrade path is validated, a configuration backup is taken and read back, storage is sufficient, the HA peer is healthy, the device is not already in another job, and the maintenance window is open. Any gate that cannot be answered blocks the run.
Vendor procedure, confirmed by a person
The command set for a platform is only executable once a named administrator has confirmed it against the vendor's own documentation. PlantGuard ships cited suggestions from the published guides, clearly marked as suggestions — the AI never writes a command that runs on your equipment.
Rollback, and honest limits
Where the platform supports it, the previous image is restored automatically or on request. Where it does not, PlantGuard says so before you start rather than after. Cisco FTD and PAN-OS are marked not supported by this engine, with the reason from the vendor's guide.
Fleet patch readiness
One 0–100 score answering if we patched every network device today, what would happen? — computed off-device from the same gates a real run uses. Each device is up to date, ready, blocked, has no image, or is not supported, with the blocking code. Daily trend, and a report of its own.
Unknown device, unknown firmware, unknown upgrade path, failed backup or failed precheck: PlantGuard does not patch. That rule has no override.
Integrations that already exist in your plant
Live data sync, every connector: endpoint protection from Trellix ePO, CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black, Symantec SEP and Trend Micro; backup jobs from Veeam, NetBackup, Acronis, Commvault, Rubrik, Cohesity and Dell PowerProtect; Active Directory; and Tripwire IP360 (vulnerability scanner — read-only: audit results, host scores and scan recency feed the findings engine and each asset's 360 page). Records are matched to the inventory by IP, MAC or host name, including a device's extra network cards.
SIEM: CEF or JSON over syslog (UDP/TCP) to Splunk, QRadar, ArcSight or any collector — cursor-based, nothing is skipped if the collector is down.
What it is not
PlantGuard is not a network-detection sensor and does not replace your NMS or SIEM. They watch and alert. PlantGuard keeps the asset base, its state, its configuration history and the way back to known-good — then reads all of it to tell you what to fix first, with the evidence an auditor asks for.
Questions we get asked
Does the AI decide what is a finding or how severe it is?
No. Findings, severities, Priority Scores, the Plant Health Score, the planner and every report are produced by deterministic rules from stored records. The model only phrases explanations and answers over evidence that already exists, and its wording is validated before it is shown.
What happens when PlantGuard does not have the data to answer?
It says so — literally: PlantGuard does not currently have enough evidence to determine this. A sub-score whose data source is not collected on your installation is reported as not assessed and its weight is redistributed. PlantGuard never fills a gap with a guess.
Can I see why a finding got its score?
Yes. Every finding opens with "Why N?" — the factor-by-factor breakdown (severity, asset criticality, lifecycle, recovery gap, exposure, downstream dependencies, age, multi-module evidence). The weights are configurable by an administrator and every change is audited.
Does the AI Advisor need internet access or a cloud account?
No. The engine is a llama.cpp service on the same Windows server; nothing leaves the site. The Advisor, like everything else, also works with the engine switched off — you then get the evidence-based answer without the narrative.
Where do the budget numbers come from?
From you. The Lifecycle planner derives urgency and a recommended target year from the dates PlantGuard holds; costs are only what your team records per asset. The budget view sums those figures by year and status — it never estimates a price.
Is any of this new data collection?
No. The advisor layer reads what the twelve modules already collect. Connecting a new source — backups, endpoint protection, a PACS, Active Directory — simply makes more findings, sub-scores and reports available.