NERVE OT‑ASM
Reaches
Finds every exposed HMI, remote‑access path and vulnerable controller before an adversary does.
- Outside‑in and passive inside‑out discovery
- Exposure ranked by KEV, EPSS and reachability
- Attack paths replayed on ATT&CK for ICS
OT · IIoT · IT · AI security for critical infrastructure
Defend the process, not just the network
NERVE turns every signal from your plant, from the valve to the cloud, into one live graph. Five products read it to close exposures, stop attacks safely, prove compliance, ship secure software and guard AI.
Hover a product
One graph, five jobsEvery signal lands once in the NERVE graph. Each product reads the same assets, identities and evidence, so findings line up across exposure, detection and compliance.
6detection engines, including process physics
17frameworks scored from one control graph
30+connectors to the tools you already run
0autonomous writes to a controller, by design
Try it · process‑physics detection
A valid command can still be an attack
Move the chlorine dosing setpoint at a water treatment plant. The protocol and baseline engines see a well‑formed write from an authorised workstation. Only the physics engine knows what that number would do to the water.
PLC‑04 · holding register 40112
1.4mg/L
02 · normal4 · safety limit1020 mg/L
CORTEX ENGINE VERDICTSNORMAL
PROTOCOL
Well‑formed Modbus writeFC16 to an existing register, from a known engineering station
BASELINE
Within learned rangeSame account and host as the last maintenance window
PHYSICS
Inside the safety envelopeProcess stays within 0.5 – 2.0 mg/L operating band
RESPONSE
No action neededEvent logged to the evidence ledger
The NERVE suite
Five products. One asset graph.
NERVE CORTEX
Sees & decides
A full SIEM and SOAR built OT‑first, with response in safety tiers your plant team signs off.
- Six engines, 62 OT‑native rules
- Agentic AI that runs on site
- Pre‑action simulation before approval
NERVE REFLEX
Judges
Scores IT, cloud, OT and AI against 17 frameworks in one run, using live telemetry as proof.
- 82 common controls, one evidence ledger
- Gaps ranked by attack path
- Assessor‑ready reports and tickets
NERVE MYELIN
Shields
DevSecOps for the code, the pipeline that builds it and the artifact that ships, from commit to cluster.
- Ten engines, one risk‑ranked queue
- OWASP CI/CD pipeline posture
- Only signed, attested releases run
NERVE AISHIELD
Guards
Continuous defence for every model, agent and RAG pipeline you run, in your cloud or air‑gapped.
- AI inventory and shadow‑AI discovery
- RAG permission testing
- Runtime Guard with a kill switch
Security services
Experts for everything around the platform
Ten IT security practices, from identity to security for AI, and nine OT security practices built for plants and grids. Delivered as projects or as a managed service, and measured with the same NERVE evidence.
Explore security servicesVendor‑neutral
Works with the plant you already have
NERVE reads the industrial protocols of every major control‑system ecosystem, passively, so there is nothing to install on a controller and no single vendor to commit to.
SiemensS7comm · S7comm‑plus · Profinet
Rockwell / Allen‑BradleyEtherNet/IP · CIP
Schneider ElectricModbus/TCP · Modbus RTU
ABB · Hitachi EnergyIEC 61850 · IEC 60870‑5‑104
GE · Emerson · SELDNP3 · IEC‑104
Honeywell · YokogawaOPC UA · OPC DA
Building & IIoTBACnet · MQTT · HART‑IP
IT & cloudSyslog · Azure · AWS · GCP · EDR
Vendor names identify protocol ecosystems only and are trademarks of their owners. NERVE is independent of every automation vendor.
How NERVE goes further
More than a typical OT security suite
Most OT security offers stop at asset visibility, protocol alerts and a services menu. NERVE is built to close the gaps that remain.
| What you need | Typical OT security suite | NERVE |
|---|---|---|
| Detection depth | Protocol and behaviour anomalies | Protocol, behaviour and process physics: a valid command that would breach a safety envelope is caught |
| Coverage | OT first; IT and AI handled by other tools or teams | IT, OT, IIoT and AI on one asset graph |
| Compliance | Reports and checklists, point in time | Controls proven by live telemetry across 17 frameworks, continuously |
| Response | Alerts and manual playbooks | Tiered SOAR with pre‑action process simulation; never autonomous on a controller |
| AI | Cloud analytics, often opaque | An explainable agent that runs on site; nothing leaves the plant |
| Where your data lives | Often a vendor cloud | On site, hybrid or fully air‑gapped |
| Pricing | Quote only | Per site and per asset, never per gigabyte |
| First step | A form, then a sales call | An instant online risk check, then a two‑week passive assessment |
“Typical” reflects our reading of common OT security offerings in 2026, not any single vendor.
Free · 4 minutes · no sign‑up
How mature is your OT security?
Twelve questions across NIST CSF 2.0. Get your tier, your profile and your three most urgent gaps, instantly.
Why now
Capable adversaries. Mandates with teeth.
ACTIVE OT THREATS● 3
GRID
VOLTZITE · SandwormLiving off the land in power networks; Industroyer2 and FrostyGoop impact tooling.
WATER
CyberAv3ngersIOCONTROL malware aimed at internet‑exposed PLCs and HMIs.
SAFETY
TRITON / TRISIS classTampering with safety instrumented systems, the worst case for any plant.
REGULATION & LIABILITY● 3
US GRID
NERC CIP‑015Internal network security monitoring required inside the electronic security perimeter.
EU · US
NIS2 · TSA Security DirectivesMandatory monitoring, incident reporting and named accountability.
GLOBAL
IEC 62443The baseline customers, insurers and auditors now expect evidenced.
See NERVE on your own network
A two‑week passive deployment on a SPAN port. No agents on controllers, nothing written to the process, a scored report at the end.
Platform
One data model from the internet edge to the valve
Most plants run five consoles that never agree on an asset list. NERVE puts exposure, detection, response, assessment, software supply chain and AI on one graph, and each product makes the others stronger.
Pick a flow
Coverage map
Where each product works in the Purdue model
Nothing is actively scanned at Levels 0 to 2 unless you opt in. Inside the plant, NERVE learns from passive traffic on a SPAN port.
Select a product to isolate its coverage.
OT‑ASMCortexReflexPassive only
Enterprise foundations
The OT edge without giving up the basics
Data
One pipeline
IT, OT, IIoT and cloud telemetry through 14 parsers, with hot‑to‑WORM retention for audit.
Integrations
Plugin marketplace
Over 30 connectors in one click, plus an SDK for anything you build yourself.
Leadership
CISO dashboard
A board‑ready risk index, value at risk, and detection and response trends.
Scale
Multi‑site and MSSP
Multi‑tenant with role‑based access and SSO for a fleet of sites.
Deployment
Air‑gap capable
On‑premises, hybrid or fully isolated. Threat intel and AI load offline.
Governance
Signed audit trail
Every action and approval recorded and exportable for 62443 and CIP reviews.
Integrations
Keep your stack. Connect it as a plugin.
Log & telemetry
Splunk · Microsoft Sentinel · QRadar · Kafka
OT sensors
Nozomi · Claroty · Dragos
EDR & identity
CrowdStrike · Defender · Entra ID · Okta
Incident management
ServiceNow · Jira · PagerDuty
GRC & audit
Archer · ServiceNow GRC · OneTrust
Threat intel
Dragos · MISP · Mandiant
Firewall & NDR
Palo Alto · Fortinet · Zeek
Cloud & code
Azure · AWS · GCP · GitHub
Product names are trademarks of their owners and are listed for interoperability only.
NERVE CORTEX · OT SIEM + SOAR
See, decide and stop attacks on the plant
Follow an event through Cortex: ingested once, judged by six engines, correlated into a kill chain, triaged by the AI agent and passed through a safety gate before anything acts.
Select any stage in the pipeline to see what it does.
The AI agent loop
Agentic AI that explains itself
The Cortex agent runs on site and never leaves the plant. It forecasts the next move, triages and explains each alert, recommends a response, and learns from every analyst decision.
STAGEON‑SITE MODEL
Select a stageEach step in the loop is logged, so an auditor can follow why the agent did what it did.
Try it · OT‑safe response
Automation your plant team will trust
Choose a response. Cortex routes it through the safety gate: routine IT actions run on their own, anything at the IT/OT conduit needs two owners, and anything touching a controller is recommend‑only.
T0–T1 · AUTONOMOUSRuns immediately
T2 · TWO APPROVERSSOC + OT owner
T3 · RECOMMEND ONLYPlant decides
Tier
Pick an action
PRE‑ACTION SIMULATION
Process impact is simulated before anyone can approve a Tier 2 or Tier 3 step.
Cortex never writes to a controller on its own. That rule lives in configuration that no update, and no AI, can switch off.
Editions
Annual subscription, per site and per asset
Never priced per gigabyte, so more telemetry never means a bigger bill.
Essentials
1 site · up to 500 assets
- 6 detection engines, 62 rules
- Asset inventory and ATT&CK for ICS mapping
- Kill chain and attack path
- SOC 2 and IEC 62443 compliance pack
- Business‑hours support
Professional
Up to 3 sites · 2,500 assets
- Everything in Essentials
- Tiered SOAR with simulation
- AI forecasting, MLOps and Copilot
- Secure access, zones and vulnerability management
- Full plugin marketplace
Enterprise
Unlimited sites · 10,000+ assets
- Everything in Professional
- Multi‑tenant / MSSP and air‑gapped
- Premium threat intel and custom playbooks
- 24×7 support, dedicated TAM, SSO
- Quarterly threat reviews
NERVE OT‑ASM · Attack surface management
Find the way in before an adversary does
Replay a real‑world attack path from the internet to a filling line, then apply the fixes OT‑ASM recommends and watch the path break.
Ready
Four hops from the internet to the processPress replay to step through the path an attacker would take, hop by hop.
Path detail
Ranked by what it reaches
| Hop | Asset | Exposure | ATT&CK for ICS | NERVE fix |
|---|---|---|---|---|
| 1 | Vendor VPN appliance | Known‑exploited CVE, internet facing | T0866 Exploitation of Remote Services | Patch within KEV deadline |
| 2 | Engineering workstation | Reachable from VPN pool, skipping the IDMZ | T0822 External Remote Services | Broker via IDMZ jump host + MFA |
| 3 | Line 2 PLC | Default credentials, S7 open to Level 3 | T0812 Default Credentials | Rotate credentials, restrict S7 |
| 4 | Filling process | Setpoint change possible | T0836 Modify Parameter | Physics guard in Cortex |
Illustrative example.
What it finds
The exposures behind real OT incidents
Internet
Exposed OT services
HMIs, VNC, Modbus and S7 endpoints reachable from the internet, found outside‑in.
Remote access
Unbrokered vendor paths
Third‑party sessions that bypass the IDMZ, a common way OT incidents begin.
Segmentation
Flat networks
Direct routes from enterprise levels to control levels that break the Purdue model.
Vulnerability
Known‑exploited flaws
Firmware and software matched to CISA KEV, EPSS and vendor advisories.
Identity
Default credentials
Shared and factory credentials on controllers, HMIs and network gear.
Protocol
Cleartext administration
Telnet, HTTP and unauthenticated engineering protocols on OT networks.
NERVE REFLEX · Posture assessment
One piece of evidence. Every framework it satisfies.
Reflex marks a control Proven only when live telemetry shows it working, then credits that evidence to every framework it maps to. Pick a control to follow its evidence.
Try it · one‑click assessment
Eight stages, run unattended
Choose a framework pack and run a sample assessment. The client answers only the questions no telemetry or document can settle.
82 common controls · evidence grade
—% proven
Framework readiness
Run the assessment to see results. Sample tenant, illustrative figures.
Framework packs
Pick the pack for the deal you are chasing
| Pack | Built for | Frameworks |
|---|---|---|
| PlantGuard | Energy, rail, oil and gas, water, manufacturing | IEC 62443‑3‑3 · NIST SP 800‑82 · NERC CIP · NIS2 |
| Converged | Groups running plants and digital products | SOC 2 · HIPAA · ISO 27001 · ISO 42001 · PCI DSS · CMMC L2 · IEC 62443 · SP 800‑82 · NIS2 |
| Universal | Any organisation | NIST CSF 2.0 · ISO 27001 · SOC 2 |
| HealthTrust | Telehealth, EHR integration, clinical SaaS | HIPAA · HITRUST · SOC 2 · ISO 27001 |
| BankReady | BaaS fintechs, lenders, payment apps | Partner‑bank diligence · SOC 2 · PCI DSS · ISO 27001 |
| DefenseReady | Defence contractors | CMMC L1 · CMMC L2 · NIST SP 800‑53 |
| AI Assure | AI product companies | ISO 42001 · NIST AI RMF · EU AI Act |
| EuroTrust | SaaS entering European deals | ISO 27001 · NIS2 · SOC 2 |
| PCI Shrink | Merchants and payment SaaS | PCI DSS 4.0.1 |
Plain about limits
Assessor‑ready, not self‑certified
HITRUST, CMMC Level 2, PCI ROC, SOC 2 and ISO certification each need an accredited third party. Reflex produces the readiness, scoring and evidence they ask for, so the external assessment starts with the work already done.
NERVE MYELIN · DevSecOps · Shields
Secure every commit, every pipeline and every release
Ten security engines, one risk score and one policy, enforced from the developer’s IDE to the production cluster. Pick a stage to see what Myelin checks there.
10security engines writing to one finding queue
6enforcement points, from IDE to runtime
8OWASP Top 10 CI/CD risks checked in every plan
4deployment models, including fully air‑gapped
Ten engines, one finding queue
The same issue, found twice, appears once
Every engine writes to one finding schema. Duplicates collapse, every finding gets one owner and one SLA, and the Myelin Risk Score puts the exploitable few at the top.
Treated as first‑class by few AppSec platformsCore engines
Already run Trivy, Semgrep, Gitleaks or Checkov? Myelin ingests them alongside its own engines and removes the duplicates.
Try it · Myelin Risk Score
Prioritise what attackers will actually use
Severity alone floods the queue. Myelin weighs exploit likelihood, known exploitation, reachability, exposure and business criticality, and shows every component so developers and auditors can see why.
On CISA KEV list
Reachability
Exposure
Business criticality
Myelin Risk Score
100/ 100
P0 Fix within 2 days · gate blocks the merge
P3 · 0–34 · 90 daysP2 · 35–59 · 30 daysP1 · 60–79 · 7 daysP0 · 80–100 · 2 days
Illustrative weights for this demo. In the console every real score is shown with its components, and exceptions are time‑boxed with a named approver.
Pipeline posture management
Most AppSec tools never inspect the pipeline itself
Attackers now go after CI/CD directly. Myelin checks GitHub Actions, GitLab CI, Azure Pipelines, Jenkins and Bitbucket Pipelines against the OWASP Top 10 CI/CD risks, and ships the fixes as pull requests.
| Risk | What Myelin detects |
|---|---|
| CICD‑SEC‑1 | Security jobs allowed to fail |
| CICD‑SEC‑2 | Long‑lived cloud keys instead of OIDC federation |
| CICD‑SEC‑3 | Unpinned actions, curl | bash, mutable :latest images |
| CICD‑SEC‑4 | pull_request_target with untrusted checkout; script injection |
| CICD‑SEC‑5 | Workflow tokens with write‑all permissions |
| CICD‑SEC‑6 | Hard‑coded credentials in pipeline definitions |
| CICD‑SEC‑7 | Shared self‑hosted runners, agent any on Jenkins |
| CICD‑SEC‑9 | Images pushed without signing or provenance |
.github/workflows/release.yml · before
name: release on: pull_request_target: # CICD-SEC-4 permissions: write-all # CICD-SEC-5 jobs: build: runs-on: self-hosted # CICD-SEC-7 steps: - uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha }} - uses: acme/deploy-action@main # CICD-SEC-3 - run: curl -sL https://get.tool.sh | bash - run: npm test continue-on-error: true # CICD-SEC-1 - run: aws s3 sync dist s3://prod env: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_KEY }}
name: release on: pull_request: permissions: contents: read id-token: write # OIDC, no stored keys jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@b4ffde6… # v4, pinned to SHA - uses: acme/deploy-action@3f9a1c2… # pinned to SHA - run: npm test - run: myelin scan --gate # blocks on policy - uses: aws-actions/configure-aws-credentials@e3dd6a4… with: { role-to-assume: arn:aws:iam::…:role/deploy } - run: aws s3 sync dist s3://prod
BLOCKED
Merge blocked · 7 posture findings, 2 criticalPoisoned pipeline execution (CICD‑SEC‑4) and a long‑lived cloud key (CICD‑SEC‑2) fail the gate.
Build‑to‑deploy integrity
Only trusted artifacts reach production
Keyless signing, SLSA provenance and an SBOM are attached at build, then verified again at Kubernetes admission. An image that skipped the gate cannot run.
1 · Sign
Keyless Sigstore signature
Bound to the pipeline’s OIDC identity, so there are no signing keys to steal or rotate.
2 · Attest
SLSA v1.0 provenance + SBOM
CycloneDX SBOM and the Myelin gate decision attached to the image digest.
3 · Verify
Admission on every cluster
Kyverno or Gatekeeper on AKS, EKS, GKE and OpenShift rejects unsigned, mutable‑tag or blocked images.
$ myelin attest --image acr.example.io/payments@sha256:… --sbom sbom.cdx.json ✓ allowed payments-gateway signed by github.com/acme/payments · SLSA L3 · 0 P0 ✗ denied payments-web:latest no valid signature · mutable tag · 4 P0 at build
Coverage
Code, open source and cloud configuration
SCA
Open source
npm, PyPI, Maven and Go manifests and lockfiles, with reachability from your own imports, EPSS, CISA KEV and fixed‑version guidance.
SAST
Static analysis
SQL, command and code injection, insecure deserialisation, disabled TLS, JWT verification, weak crypto and DOM XSS.
Secrets
Secrets detection
Cloud keys, tokens, private keys and payment keys in code, full git history and pipeline files, with a revoke‑and‑rotate workflow.
IaC
Infrastructure as code
Terraform, Bicep and ARM, Kubernetes and Helm: public exposure, plain HTTP, old TLS, privileged pods and root containers.
Containers
Images and registries
OS and language packages per image, registry re‑scans when new CVEs land, and digest‑pinned base‑image guidance.
SBOM
Licences and SBOM
CycloneDX 1.5 and SPDX export and import, copyleft and deny‑list policy, and VEX to record not‑affected decisions.
AI and agent security
An AI‑BOM for every model, prompt, agent and MCP tool
Myelin inventories the AI in your code and checks it against the OWASP LLM Top 10, before an injected prompt or an over‑powered agent reaches production.
Guard them in production with NERVE AIShieldAI‑BOM FINDINGS · SAMPLE REPO6 OPEN
LLM03
Unpinned model revisionModels pulled without a fixed revision can change silently.
LLM03
trust_remote_code=TrueLoading the model runs code from the model repository.
LLM03
Unsafe model deserialisationPickle loading without weights_only can execute payloads.
LLM01
Prompt built from user inputUser text concatenated straight into a system prompt.
LLM06
Agent with unrestricted shellExec or shell tools given to an agent without an allow‑list.
LLM06
MCP server without authTools exposed to AI assistants with no authentication or scoping.
Policy as code
One policy, enforced at six points
The same rules run in the IDE, the pull request, the pipeline, the registry and at admission, in YAML or OPA/Rego. A finding blocked in the pipeline is also blocked at deploy.
MonitorTurn Myelin on per business unit and baseline the findings, with nothing blocked.
Warn · 2 weeksDevelopers see what would fail, with AutoFix suggestions inline.
BlockThe gate stops only what the policy says: known‑exploited, secrets, score 80 and above.
# myelin-policy.yaml gates: - id: block-known-exploited when: { kev: true } action: block - id: block-secrets when: { engine: [secrets] } action: block - id: block-mrs-80 when: { mrs_gte: 80 } action: block exceptions: - id: EXC-1042 expires: 2026-12-31 approved_by: CISO # hash-chained audit log
From finding to fix
Fixes developers merge, with an audit trail
AutoFix
Ready‑to‑merge PRs
Dependency upgrades, secure code patterns and pipeline hardening, each with a merge‑confidence score.
Copilot
AI remediation
Explains why a finding matters and how to fix it, using your chosen model. Your code is never used for training.
SLAs
Owners and deadlines
Findings routed to owners in Jira or ServiceNow, with breach alerts in Teams or Slack.
Exceptions
Time‑boxed risk acceptance
A named approver and an expiry date, recorded in a hash‑chained audit log.
What the console shows on day one
79%fewer alerts to triage: 224 critical and high reduced to 47 that are reachable, exposed or known‑exploited
21 → 7days mean time to remediate across 90 days, with AutoFix PRs and owner SLAs
45issues found in one live scan across six engines; the gate blocks the merge on 8
30day proof of value on three to five of your own repositories
Illustrative results from the NERVE Myelin demo environment (sample tenant, 24 repositories, 640 developers). We reproduce them on your repositories during the proof of value.
Continuous compliance evidence
Secure‑SDLC proof for every framework you answer to
Evidence packs export as signed PDF and JSON per framework, and control status feeds NERVE Reflex posture scores continuously.
| Framework | Controls | Evidence Myelin produces |
|---|---|---|
| PCI DSS 4.0 | 6.2.4 · 6.3.2 · 6.3.3 · 8.6.2 | Secure coding, software inventory, patching, no hard‑coded passwords |
| ISO 27001:2022 | A.8.9 · A.8.25 · A.8.28 | Configuration management, secure SDLC, secure coding |
| SOC 2 | CC7.1 · CC8.1 | Vulnerability monitoring, change management |
| NIST SSDF | PS.2 · PS.3 · PW.4 | Software integrity and provenance, third‑party components |
| EU Cyber Resilience Act | Annex I §2 | No known exploitable vulnerabilities; SBOM |
| DORA | Art. 9 | ICT security tooling and change controls |
| RBI / SEBI CSCRF | AppSec | Secure SDLC, source code review, VAPT evidence |
| OWASP LLM Top 10 | LLM01–LLM10 | AI application risks |
Deployment
Deploy the way your regulator expects
| SaaS | Single‑tenant | Self‑hosted | Air‑gapped | |
|---|---|---|---|---|
| What it is | Multi‑tenant, in‑region hosting such as Azure Central India | Dedicated instance and database, in our cloud or yours | Helm chart on your Kubernetes; scans never leave your network | Fully offline with bundled advisory packs |
| Data residency | Chosen region | Chosen region or your cloud | Your network | Your network |
| Encryption keys | Platform‑managed | BYOK | BYOK / HYOK | HYOK |
| Time to first scan | Same day | 1 week | 1–2 weeks | 2–4 weeks |
Integrations
Fits the toolchain you already run
Source and CIGitHub · GitLab · Azure DevOps · Bitbucket · Jenkins
RegistriesAzure Container Registry · Amazon ECR · Harbor
ClustersAKS · EKS · GKE · OpenShift
Work managementJira · ServiceNow · Teams · Slack
SIEM and SOARNERVE Cortex · Sentinel · Splunk · Wazuh
IdentityEntra ID · Okta · SAML / OIDC · SCIM
Developer toolsVS Code · JetBrains · MCP for AI assistants
Bring your own scannersTrivy · Semgrep · Gitleaks · Checkov · Grype · SARIF
Product names are trademarks of their owners and are listed for interoperability only.
Plans
Five plans, pipeline security in every one
Per active developer, billed annually with two months free. No minimum on Team and Business.
Community
Free
Up to 5 developers · self‑serve
- SCA and reachability
- Secrets detection
- SBOM (CycloneDX / SPDX)
- Pipeline posture
Team
$29/dev/mo
Email support, 1 business day
- Everything in Community
- IaC and container scanning
- Licence compliance
- AutoFix pull requests
Business
$59/dev/mo
Most popular · 24×5, 4‑hour P1
- Everything in Team
- SAST and AI remediation
- SLSA provenance and signing
- Admission control, policy as code
- Compliance packs and SSO
Enterprise
$89/dev/mo
24×7, 1‑hour P1, named CSM
- Everything in Business
- DAST / API and AI‑BOM
- Custom RBAC and BU tenancy
- SIEM export to NERVE Cortex
Sovereign
Custom
Priced per environment · on‑site TAM
- Everything in Enterprise
- Self‑hosted or air‑gapped
- BYOK / HYOK keys
- OT/IoT firmware via NERVE OT‑ASM
List prices in USD. Add‑ons: DAST and API security, AI‑BOM, OT/IoT firmware analysis, managed DevSecOps and a two‑week onboarding and policy design. Volume discounts from 250 developers.
Part of the NERVE platform
One graph, five senses
Myelin plugs into the same graph as the rest of NERVE. Pipeline, deploy‑block and secret‑revocation events reach Cortex, and secure‑SDLC controls feed Reflex scores continuously.
NERVE CORTEX
Sees & decides
Receives Myelin’s pipeline and deploy‑block events in the SOC.
Cortex →NERVE OT‑ASM
Reaches
Extends Myelin’s SBOM and policy to OT and IoT firmware.
OT‑ASM →NERVE REFLEX
Judges
Turns Myelin’s gate results into Proven secure‑SDLC controls.
Reflex →NERVE MYELIN
Shields
Protects every release from commit to cluster without slowing delivery.
See the platform →NERVE AISHIELD
Guards
Takes Myelin’s AI‑BOM and guards those models and agents in production.
AIShield →30‑day proof of value
See it on your own pipelines
Week 1
Kick‑off and connect
Agree three to five repositories and success criteria, connect SCM and one pipeline, run the baseline scan.
Week 2
Prioritise and fix
Review the P0 and P1 queue with your teams, merge the first AutoFix PRs, read the pipeline posture report.
Week 3
Enforce
Policy in warn mode, then block on one pipeline; signing and admission on a non‑production cluster.
Week 4
Decide
A readout against the agreed criteria (P0 count, MTTR, posture score) and a commercial proposal.
Shield your pipeline in 30 days
A proof of value on three to five of your repositories, self‑hosted if your code cannot leave your network.
NERVE AISHIELD · Continuous frontier AI defence · Guards
Discover, validate and enforce security across every model, agent and RAG pipeline
AIShield turns AI risk into evidence‑backed findings, blocks unsafe agent actions at runtime and gives your SOC an emergency stop for compromised agents. It runs in your cloud, on‑premises or air‑gapped. Pick a layer to see what it does.
48AI‑specific detection rules across cloud, agents, models, RAG, data and supply chain
9frameworks mapped, including OWASP LLM Top 10 2025, MITRE ATLAS, ISO 42001 and the EU AI Act
3deployment models: SaaS, your own cloud, or on‑premises and air‑gapped
100%of findings linked to integrity‑hashed evidence, never AI‑guessed
The challenge
AI moved faster than security did
Security teams are asked to secure systems they cannot see, using controls that were never designed for autonomous agents.
Visibility
No AI inventory
Models, agents, vector stores and AI APIs are spread across clouds, clusters and teams. Shadow AI is invisible.
Agency
Agents with real power
Agents hold wildcard permissions, run code, send email and move money, often with no approval step and no kill switch.
Data
RAG that ignores permissions
Authorisation is enforced in the UI, not at retrieval, so any user can ask the assistant for documents they should never see.
Supply chain
Untrusted models
Third‑party models and pickle files can execute code on load. Provenance and digests are rarely verified.
Detection
SIEM blind to AI
Prompts, tool calls, identities and infrastructure events are never correlated, so AI attacks go unnoticed.
Regulation
Evidence the board can trust
The EU AI Act, ISO 42001 and board oversight demand evidence of AI controls that today lives in spreadsheets.
Guided demo · demo tenant “Acme Demo”
A full AI security lifecycle in five steps
Every value below comes from a synthetic demonstration dataset processed by the real NERVE engines.
Screens represent the NERVE AIShield console with synthetic demo data. A live demo is available on request.
Try it · Runtime Guard
Stop unsafe actions while they happen
Agents call the Guard before each step. It runs outside the model, so a manipulated model cannot argue its way past it, and agents cannot change their own policy. Choose an action to see the decision.
ALLOW
Try it · retrieval authorisation testing
Prove permissions hold at retrieval time
Define test identities and the documents each must never see. AIShield queries your retrieval API with each identity’s own token, under a recorded test authorisation, and records exactly what came back.
Test identity
Retriever
A finding moves to verified only after the same test plan re‑runs and passes. Tests are non‑destructive.
RAG‑001 · RAG‑002 · intern‑ravi
3 LEAKSArchitecture
API‑first, with enforcement independent of every agent
The policy enforcement layer is separate from every AI agent, including NERVE’s own. Everything sits on a tenant‑isolated data plane with a hash‑chained audit trail.
Platform vs. service
Continuous control, not a once‑a‑year test
Expert‑led AI testing engagements are valuable for periodic depth. AIShield is for teams that need continuous, in‑house control of their AI estate, including where data cannot leave their environment. Many organisations use both, and our Security for AI services can deliver the engagements.
| Capability | NERVE AIShield | Typical AI testing engagement |
|---|---|---|
| Delivery | Software platform your team operates, with API, console and automation | Engagement delivered by the provider’s experts |
| Where it runs | SaaS, your own Azure, AWS or GCP tenancy, or on‑premises and air‑gapped | Provider‑operated |
| Runtime enforcement | Runtime Guard blocks, redacts or holds agent actions in real time, with a kill switch | Usually out of scope |
| Evidence ownership | Every finding stored in your tenant with integrity‑hashed evidence | Delivered as engagement reports |
| Risk scoring | Explainable, configurable weights per tenant, never presented as a probability | Provider methodology |
| Response | Playbook agents propose, an independent human approves, with rollback and full audit | Remediation recommendations |
| Governance | Continuous technical control validation across 9 frameworks and a risk register | Maturity report at engagement close |
Compared by delivery model, not a claim about any specific vendor’s product.
Deployment
Deploy where your AI lives
SaaS
Multi‑tenant
Strict tenant isolation, with tenant‑level RBAC, policies and retention settings.
Your cloud
Customer‑managed
Helm and Terraform for AKS, Key Vault secrets, private networking and customer‑managed keys. Data never leaves your subscription.
On‑prem
Air‑gapped
Docker or Kubernetes, private PostgreSQL and no outbound dependency. Built for critical infrastructure and regulated sectors.
Frameworks mapped
OWASP Top 10 for LLM Apps 2025MITRE ATLASNIST AI RMF 1.0NIST CSF 2.0ISO/IEC 42001ISO/IEC 27001:2022OWASP API Top 10 2023GDPREU AI Act
Integrations
Connects to the stack you run
SIEMNERVE Cortex · Microsoft Sentinel · Splunk · Wazuh · Elastic
IdentityMicrosoft Entra ID · Okta · Keycloak
AI platformsAzure OpenAI · Azure ML · AI Search · vLLM · Ollama · TGI
Agent frameworksLangGraph · CrewAI · MCP
Prompt‑attack classifierAzure AI Content Safety Prompt Shields
Supply chainTrivy · Grype · Gitleaks · OSV‑Scanner · CycloneDX / SPDX
Work managementJira · ServiceNow
Source and CIGitHub · Azure DevOps · NERVE Myelin
Connector availability varies by release. Product names are trademarks of their owners and are listed for interoperability only.
Part of the NERVE platform
One graph, five senses
AIShield shares the NERVE graph. Guard decisions and AI incidents reach Cortex, AI controls feed Reflex scores, and Myelin’s AI‑BOM gives it the models and agents in your code.
NERVE OT‑ASM
Reaches
Exposure and attack paths across OT and IT.
OT‑ASM →NERVE CORTEX
Sees & decides
Correlates AIShield guard decisions into the SOC kill chain.
Cortex →NERVE REFLEX
Judges
Scores AIShield’s AI controls in the AI Assure pack.
Reflex →NERVE MYELIN
Shields
Finds the models, prompts and agents in your code.
Myelin →NERVE AISHIELD
Guards
Discovers, tests and guards the AI you run in production.
See the platform →See AIShield on your own AI estate
A 60‑minute working session: we run read‑only discovery on an export you provide and walk through the findings together.
Security services · IT · OT · AI
Security capabilities across every layer
Ten IT security practices, nine OT security practices and the NERVE product suite that measures them all. Switch between IT and OT, then pick a capability to see what we deliver.
Select a capability in the diagram.
01 · IT security services
Enterprise, cloud and AI
Ten practices that protect identities, networks, cloud workloads, applications, pipelines and AI systems, and the SOC that watches them.
02 · OT security services
Plants, grids and pipelines
Nine practices built for industrial control systems, where availability and safety come first and nothing is tested on a live controller without the plant's agreement.
03 · NERVE products
The platform behind every engagement
Our services run on the same products we sell. Each engagement leaves you with the platform in place, so results stay measured after we leave.
NERVE OT‑ASM
Reaches
Attack surface management for OT. Finds exposed HMIs, unbrokered vendor paths and vulnerable controllers, ranked by what they reach.
Powers: vulnerability management · OT asset visibility · penetration testing · segmentation
Explore OT‑ASM →NERVE CORTEX
Sees & decides
OT‑first SIEM and SOAR with six detection engines, an on‑site AI agent and response in safety tiers.
Powers: SOC engineering · OT SOC · incident response · secure remote access
Explore Cortex →NERVE REFLEX
Judges
Posture assessment across IT, cloud, OT and AI against 17 frameworks, with controls proven by live telemetry.
Powers: governance & compliance · OT risk assessment · security for AI · cloud posture
Explore Reflex →NERVE MYELIN
Shields
DevSecOps from commit to cluster: ten engines, pipeline posture, signed releases and one policy everywhere.
Powers: DevSecOps · application security · security for AI · vulnerability management
Explore Myelin →NERVE AISHIELD
Guards
Discovers, validates and guards models, agents and RAG pipelines, with an independent Runtime Guard.
Powers: Security for AI · SOC engineering · governance
Explore AIShield →How we deliver
From first assessment to run‑state
Engage for one stage or the full cycle. Each stage hands the next a measured baseline.
Project
Fixed‑scope engagements
Assessments, penetration tests, architecture and build projects with a defined deliverable and end date.
Managed
Run it for you
SOC operations, vulnerability management and identity operations delivered as a monthly service with SLAs.
Retainer
Experts on call
A pool of hours for architecture reviews, incident support, audits and advisory as needs come up.
Scope a security engagement
Tell us the problem, the environment and the deadline. We will propose the right capability mix and a first deliverable within a week.
Free OT risk check · 12 questions · about 4 minutes · no sign‑up
Where does your plant stand today?
Answer twelve questions across the six NIST CSF 2.0 functions. You get an instant maturity tier, a profile across Govern to Recover, and your three most urgent gaps mapped to IEC 62443. Nothing you enter leaves this page.
NERVE Managed Services · 24/7 OT security operations
Your OT SOC, without building one
Our analysts watch your plants around the clock on the NERVE platform. Raw plant traffic stays on your site; only alerts and evidence reach our SOC. Anything that could touch the process goes to your plant team for the decision.
Try it · incident timeline
What happens in the first hours
Replay a process‑impacting alert at a water treatment plant and watch each step against its target service level.
T+00:00elapsed
READYTARGET SLA
Press replay to start the clockEach step shows who acts, what they do and the target time.
Illustrative scenario. Target times shown; final service levels are agreed in each contract.
Managed services
Six services, one operations team
MDR
Managed OT detection & response
24/7 monitoring with all six Cortex engines, OT‑trained analysts and tiered response approved by your plant.
MSRA
Managed secure remote access
Every vendor and engineer session brokered through the IDMZ: just‑in‑time approval, MFA, recording and review.
MVM
Managed vulnerability & exposure
OT‑ASM runs continuously; we rank exposures by reachability, track vendor advisories and chase fixes to closure.
MCE
Managed compliance evidence
Reflex keeps controls Proven for IEC 62443, NERC CIP, NIS2 and ISO 27001, with an auditor‑ready pack each quarter.
IR
Incident response retainer
A 24/7 hotline, OT forensics, recovery support and onsite responders, with drills run with your operators.
NET
Managed OT network & firewalls
Industrial firewall rules, conduit changes and segmentation upkeep, scheduled around maintenance windows.
Service tiers
Pick the level of cover you need
Annual, priced per site and per asset like our products. Upgrade any time.
| Monitor | Respond | Command | |
|---|---|---|---|
| Coverage | 24/7 monitoring and alerting | 24/7 monitoring and remote response | 24/7 with a dedicated analyst team |
| P1 acknowledge · target | 30 min | 15 min | 15 min |
| P1 call to your OT on‑call · target | 60 min | 30 min | 30 min |
| Remote containment (T1–T2) | Guidance only | Included | Included |
| Onsite responders | Add‑on | Add‑on | Included |
| Threat hunting | Quarterly | Monthly | Continuous |
| Exposure management | Quarterly report | Monthly, tracked to closure | Continuous, with a technical account manager |
| Reporting | Monthly | Monthly + quarterly review | Weekly + quarterly board pack |
Target service levels for illustration. Final SLAs are agreed in each contract.
Put your plants under 24/7 watch
Start with a two‑week passive assessment. If you go ahead, the same sensors become your managed service, with no rip‑and‑replace.
Industries
Built for sectors where downtime is physical
Pick a sector to see the attack NERVE is built to stop there, and how each product answers it.
Protocols decoded
Regulation in scope
Company
Security engineered by people who run it
NERVE Security builds protection for the systems that keep power on, water clean and lines running. The product grew out of years of hands‑on security architecture, operations transitions and compliance audits across cloud and industrial estates.
What we hold to
Principles
Safety outranks speed
No autonomous action on a controller. The plant team decides anything that touches the process.
Evidence over assertion
A control counts when telemetry shows it working, not when a form says it exists.
Your data stays on site
Air‑gapped deployment and on‑site AI are standard options.
Plain about limits
We say what the product does not do, including where an accredited assessor is still required.
Working with customers
How we work with you, start to finish
Every customer starts small, with a fixed scope and a measured result, before committing to a subscription. Select a stage to see what happens, who is involved and what you get.
Commitment
A named security architect
One accountable architect from first briefing through go‑live and every quarterly review.
Commitment
Nothing touches the process without you
Passive by default. Any active test or response on OT is agreed with the plant owner first.
Commitment
Your data stays yours
On‑site or air‑gapped deployment, on‑site AI, and every finding and evidence record exportable.
Commitment
Pricing you can predict
Per site and per asset, billed annually. Never per gigabyte of telemetry.
Commitment
Results you can audit
Signed evidence ledger and a scored baseline, so progress is measured, not reported.
Commitment
Quarterly threat reviews
Sector threat briefings and a posture review against your own baseline, every quarter.
Commercial model
Ways to buy
Start with a fixed‑fee assessment that converts into a subscription when it proves its value.
| Offer | What it is | Best for |
|---|---|---|
| Reflex Snapshot | Fixed fee, one framework pack, one scored report | A low‑risk first step that replaces a consultant‑led gap assessment |
| Site assessment | Two‑week passive OT capture with OT‑ASM and Cortex, plus a scored report | Plants that want to see their real exposure before buying |
| Product subscription | Annual, per site and per asset for Cortex, OT‑ASM or Reflex; per developer for Myelin; platform subscription for AIShield | Continuous detection, exposure or posture for one need |
| NERVE Suite | All three products on one graph | Groups that want every control moved to Proven |
| Managed services | Monthly SOC, vulnerability and identity operations with SLAs | Teams that want outcomes without adding headcount |
| Partner edition | Multi‑tenant console for MSSPs and assessment firms | Partners serving many client sites |
Where we are in the market
The market is split in two. We work across both.
IT security and compliance tools stop at the cloud boundary. OT visibility and OT compliance tools ignore patient data, card data and AI. Few products score both worlds from one control graph, backed by their own detection and exposure telemetry.
That gap is where NERVE sits: the first converged platform that sees, reaches and judges across IT, OT and AI.
SEGMENTMARKET MAP
Select a segment on the mapEach bubble is a category of tool buyers use today. NERVE replaces or connects to them.
Categories placed by our own reading of the market; positions are indicative.
Where we are today
Built, protected and closing enterprise deals
All five products are built on one shared platform. Our patent application is filed, with grant expected shortly, and we are in final contracting with three large enterprise customers in critical infrastructure.
Products
5 products built
Cortex, OT‑ASM, Reflex, Myelin and AIShield, on one asset graph and evidence ledger.
Intellectual property
Patent filed
Core methods, including telemetry‑proven control scoring, are protected. Grant expected shortly.
Customers
3 enterprise logos
Large critical‑infrastructure organisations in final contracting with NERVE.
Expertise
IT · OT · AI
Security services across all three, delivered by practising security architects.
First markets
Energy, water, manufacturing
Where OT regulation is newest and the gap between IT and OT tooling is widest.
Lead offer
PlantGuard + Converged
OT compliance first, then groups running plants and digital products together.
Next
HealthTrust, BankReady
Sectors where IT compliance incumbents are strong but have no OT or telemetry story.
Limited slots
Founding customer programme
A few more founding customers get direct architect access, roadmap input and preferred terms. Talk to us.
Partners
How we go to market
System integrators
Bundle NERVE into managed security and OT transformation programmes.
MSSPs
A multi‑tenant partner edition for running many client sites from one console.
Assessment firms
An auditor portal so clients arrive with evidence already collected.
OT integrators & OEMs
Embed PlantGuard in site commissioning and IEC 62443‑2‑4 obligations.
Contact
Request a briefing
Tell us about your sites. We will come back with a 45‑minute briefing for your sector, and a plan for a passive two‑week assessment if it fits.
WHAT A SITE ASSESSMENT INCLUDES
WEEK 0
Scoping callSites, zones, frameworks and the outcome you need.
WK 1–2
Passive captureOne sensor on a SPAN port. Nothing written to the process.
WEEK 3
Scored reportExposures, attack paths, detections and framework gaps, ranked.
CONTACT USNERVESECU.CO.IN
OFFICE
NERVE SecurityIRA Aspiration, Kollur
Hyderabad, Telangana 502300
India
Hyderabad, Telangana 502300
India
PHONE
WEB
nervesecu.co.in
FOLLOW