Critical infrastructure
Automation that stays on the right side of the OT/IT boundary.
Grid, water and transport operators automate the enrichment, triage and reporting work around their control systems, on segmented or air-gapped networks, without automation ever reaching into the control loop itself.
- no control loop access
- IT-side onlyno control loop access
- or air-gapped deployment
- Segmentedor air-gapped deployment
- of every incident response
- Full recordof every incident response
- NIS2-style reporting expectations
- Aligned withNIS2-style reporting expectations
Operational pressures
The response has to be fast, defensible, and it has to respect the boundary.
Infrastructure operators cannot trade one requirement for another. Speed, evidence and network isolation all have to hold at the same time.
Outage response has to be fast and fully accountable
A substation trip or a treatment plant alarm starts a clock. Operators need enrichment and routing to happen immediately, and a complete record of what was checked and who acted.
IT teams are asked to automate around OT systems they cannot touch directly
Control systems are engineered, tested and certified as closed units. Automation has to sit at the boundary and read published interfaces, not reach into the control loop itself.
Reporting obligations are expanding faster than reporting teams
Incident notification windows and evidence expectations under frameworks aligned with NIS2 assume an operator can reconstruct an incident timeline quickly, not after weeks of log collection.
Segmented and air-gapped networks limit which tools are even usable
Many automation and monitoring products assume outbound internet access for licensing or updates, which rules them out for networks that are deliberately isolated from the internet.
The OT/IT boundary
Where automation stops and the control system starts.
This is the single most important architectural constraint for this sector, and it is worth stating plainly.
Nexus operates on the IT side of the boundary
Workflows read from historians, SCADA data historians, alarm and event systems and asset management platforms through their published interfaces. Nexus does not issue control commands into a SCADA or ICS control loop.
The control system remains the single point of control
Where a workflow determines that a field action is needed, the output is a work order, a dispatch instruction or an alert to a control room operator, who acts through the control system itself.
Segmentation is preserved, not routed around
Deployment respects the network segmentation already in place between corporate IT, the OT DMZ and the control network, connecting only at the points the operator's architecture already permits.
Systems typically in scope
What a deployment reads from, on the IT side.
Everything here sits in the OT DMZ or above it. Nothing here is a control system itself.
- Historians and data historians
- Time-series data from process historians, read through their database or API layer for enrichment and trend checks.
- Alarm and event management
- Alarm feeds and event logs from the OT DMZ, consumed as workflow triggers without writing back into the control network.
- Asset and work management
- Enterprise asset management and computerized maintenance management systems used to raise and track work orders.
- Outage and incident management
- Outage management systems and incident logging platforms that need enrichment from field and customer data.
- Identity and physical access
- Directory services and physical access control feeds relevant to who was on site or logged in during an incident.
Worked scenario
A pressure anomaly, from alarm to dispatched work order.
Enrichment and triage happen automatically. A control room operator makes the dispatch decision.
- 01
Trigger
An alarm event crosses the OT DMZ indicating a pressure anomaly at a pumping station.
- 02
Integration
Connector steps retrieve the relevant historian trend, the asset's maintenance history and the on-call roster.
- 03
Rules + Code
Deterministic thresholds classify severity and identify whether the pattern matches a known fault signature.
- 04
Sovereign AI
A self-hosted model summarizes the trend and prior maintenance notes into a short brief for the dispatcher.
- 05
Human Approval
A control room operator reviews the brief and confirms the dispatch, adjusts priority or escalates.
- 06
System Action
A work order is raised in the asset management system and a technician is dispatched.
- 07
Audit
The alarm, retrieved data, classification, model brief, operator decision and work order are retained as one incident record.
Deployment posture
Segmented networks and air-gapped sites are the default, not the exception.
Many operators run control networks with no outbound internet path at all, and corporate networks segmented well away from them.
What the deployment model supports
- Deployment entirely within the operator's own network segments, including fully air-gapped sites.
- Offline update and artifact delivery for sites with no outbound connectivity.
- Connectors that read from historians, alarm feeds and asset systems on the IT side of the DMZ.
- Self-hosted models and knowledge bases so trend summaries never leave the operator's environment.
What it deliberately does not do
- Issuing control commands into SCADA, ICS or DCS control loops.
- Requiring outbound internet access for licensing or routine operation.
- Bypassing existing network segmentation to reach the control network directly.
Evidence and obligations
Reporting obligations aligned with NIS2 depend on a fast, complete timeline.
An incident notification window is only workable if the timeline can be assembled from a record that already exists.
Incident-level execution record
The triggering alarm, retrieved data, classification, model output, operator decision and resulting work order are retained together.
Framework alignment, not certification
Reporting fields and retention periods can be configured to align with obligations described in frameworks such as NIS2. Nexus does not itself confer compliance status.
Operator retains the compliance posture
The operator's own security and compliance function remains responsible for assessing and attesting to its regulatory posture.
Use cases
Processes critical infrastructure teams run on Nexus.
Each combines two or more systems in one governed run, with approval and audit.
Amazon Web Services + ServiceNow + Jira
Infrastructure alert to incident and remediation
Alerts become incidents and engineering issues, and infrastructure changes run only when approved.
View use caseWorkday + Okta + ServiceNow
Identity access change for operations staff
Operations staff access follows their role, with changes approved and recorded.
View use caseGitHub + ArgoCD + ServiceNow
Deployment governance
Every deployment links to an approved change, passing checks and a deployment event.
View use caseAmazon Web Services + Snowflake + Microsoft 365
Operational data to analytics
Operational files load into Snowflake reliably, and teams are told when data is ready.
View use caseAmazon Web Services + Snowflake + ServiceNow
Cloud event to analytics workflow
Cloud events are enriched, loaded for analysis and escalated when thresholds are crossed.
View use caseRelevant capabilities
Where infrastructure operators usually start.
Workflow Automation
Alarm-driven triage and dispatch workflows with escalation.
ExploreEnterprise Integration
Connectors for historians, asset systems and alarm feeds.
ExploreGovernance and Audit
Identity, RBAC and the incident-level execution record.
ExploreSovereign AI
Self-hosted summarization for operator briefs.
ExploreA note on scope
Nexus automates the operational and reporting work that surrounds a control system. It is not a control system replacement, a SCADA product or a safety instrumented system, and it is not positioned to become one.
Architecture session
Bring us the alarm feed that keeps your control room busiest.
We will walk through where enrichment and triage can run automatically, where a self-hosted model can shorten a brief, and where the boundary with your control system needs to stay exactly where it is.