/
Civil resilience/
Specialized fields/
Critical site securityUnstaffed critical sites, guarded in the physical and the digital.
Substations, pumping stations, telecom hubs and observing sites run unstaffed. Their fences, doors and control networks are where physical and cyber attacks begin. Perimeter sensing, intrusion alarms and passive watch over the control network report to one record, so operators respond before service is lost.
Plan a deploymentHow it worksStation Builder- Industry
- Civil resilience
- Measurements
- 5
- Sources cited
- 5
Civil resilience · Critical site security
Where attacks begin
Unstaffed substations, pumping stations and telecom hubs keep a country running, and their fences, doors and control networks are where physical and cyber attacks begin. Operators of essential services must manage both risks and report incidents. Knowing the moment a fence is crossed or a strange device appears changes the outcome.
What is measured
Perimeter, doors and the network
Radar and thermal cameras watch fence lines and approaches day and night, fixed cameras cover each detection zone, contacts watch doors, gates and cabinets, and a passive tap listens to the site control network for new devices and unusual traffic without ever sending into it.
- Instruments
- Radar · Thermal cameras · Fixed cameras · Door contacts · Passive network tap
The base node
Verified before it is raised
The site node fuses radar, thermal and video so animals and weather do not raise alarms, and attaches a clip to every alarm it does raise. It learns the normal devices and traffic of the control network and flags anything new, signing every event for the incident record.
Radio and links
Two paths, one guarded
Alarms and clips ride the operator’s fibre to the control room through a security gateway that keeps the monitoring separate from the control network. A cellular path on another network keeps alarms flowing when the fibre is cut, often an intruder’s first move.
- Links
- Fibre · Public cellular
How it works
From a cut fence to a response
At night radar picks up a person approaching a substation fence. The thermal camera confirms it, the node raises a verified alarm with a clip, and security operations sends responders and alerts the police. Control engineers check the network view: no new device has appeared.
From order to operation · Order
Scope the sites and the threats
The scope reads the operator’s site list, its risk assessment under the critical entity rules, past incidents, the control system architecture and its response arrangements. Nexus Observatory Inc. returns a kit by site type, the alarm and verification design, the network monitoring design and a price per site and per year.
Plan a deploymentFrom order to operation · Survey
Survey perimeters and networks
Crews walk each site type with the operator’s security and control engineers: fence lines and approaches, detection zones and camera positions, entry points, the control network layout, tap points and the two backhaul paths. Findings are recorded with photographs and drawings.
From order to operation · Permits
Access, privacy and change control
Work in substations follows the operator’s switching and access rules, cameras are aimed and masked to follow privacy rules for public land, and connecting a tap to the control network goes through the operator’s change control. Every approval is kept with the site record.
From order to operation · Build
Build and harden
Kits are built per site type; nodes are hardened, enrolled with their identities and configured with the zones and alarm rules. The whole kit is tested together, including a simulated intrusion and an unknown device on a test control network, before it ships.
Open the Station BuilderFrom order to operation · Install
Install without an outage
Crews install radar and cameras on poles, contacts on doors and cabinets and the passive tap on the control network without interrupting it. Power and backhaul are connected, and every point is photographed and recorded. Crews follow the site safety plan throughout the work.
From order to operation · Commission
Commission with a walk test
Each node proves its identity. A walk test crosses every detection zone at different speeds, doors and cabinets are opened, alarms are verified in the control room and the network baseline is learned over weeks before anomaly alerts are enabled.
From order to operation · Operate
Respond with evidence
The security operations view shows every site, its alarms, verified clips and network anomalies. Responders are sent only to verified events, control engineers see unknown devices at once, and every incident is recorded for reporting to the authorities. Every alert and action is kept on the record.
From order to operation · Maintain
Test, patch and review
Detection zones are walk-tested on the agreed plan, cameras are cleaned and re-aimed, node software is patched in rings, and network baselines are reviewed after every planned change. Incident reviews feed back into zones and rules, and every change is kept with the site record.
Book field servicesData products
For security, control and compliance
Security operations and responders receive verified alarms with clips; control system engineers receive new device and traffic alerts; resilience and compliance teams receive incident records; executives and regulators receive site risk and response reports, each tied to the site and time.
See the data productsEvidence
Records the rules ask for
Measures support the critical entity resilience directive and the cybersecurity directive. Intrusion detection follows the alarm system standard, video follows the surveillance standard, and control network monitoring follows the industrial automation security series. Every alarm, clip and response is signed and kept.
- Drawn against
- Directive (EU) 2022/2557 · Directive (EU) 2022/2555 · EN 50131 · IEC 62676 · IEC 62443
What you get
Operational-technology assurance for observing sites
Identity, attestation, segmentation and monitoring for instruments and edge nodes, with evidence for audits. Stated as services, never as a security guarantee. Delivered as managed service and professional services, for operators of critical sites, agencies. Scale: Fleets of sites. Service levels are written as numbers you can measure on your own dashboard.
Talk to salesNext step
Plan critical site security with us
Tell us the site, the measurements and the rules it answers to. We reply with a survey proposal, a design and a scope for critical site security. An engineer replies with a survey proposal and a scope, and the plan grows from one site to the network you need, at your pace.
Plan a deploymentOpen the Station BuilderOpen the Studio
01The place and its hazards
Where it runs, and what can go wrong.
Operating contextOperators of essential services must manage physical and cyber risks to the sites that deliver them. Critical entities are required to take resilience measures and report incidents, network and information systems must meet cybersecurity duties, industrial control systems are secured to the international series for automation security, and alarm and video systems follow their own standards.
Hazards
- Fence cutting and break-ins at unstaffed sites
- Theft of copper, batteries and fuel
- Unauthorised devices on the control network
- Remote access that bypasses the operator’s controls
- Alarms that flood a control room with false triggers
02What must be measured
What, where, how often, and under which rules.
Each measurement names where it is taken, how often, and the public standard or regulation behind it. Numbers in the sources column open the cited source below.
| Measurement | Where | Cadence | Sources |
|---|---|---|---|
| Perimeter intrusion | Fences and approaches, by radar and thermal cameras | Continuous, events on detection | 12 |
| Door, cabinet and gate state | Every entry point and control cabinet | On event | 1 |
| Video verification of alarms | Cameras covering each detection zone | On event, with recorded clips | 3 |
| Control network traffic and new devices | A passive tap on the site control network | Continuous | 45 |
| Incidents and response times | Every alarm from detection to closure | Every event | 25 |
03The observation stack
From one base unit to a network.
The same blocks at every scale: instruments and a base node, a site with its radio, a fleet run as one, and a network federated on the open protocol.
- 01
Base unit
A site point: radar, thermal and fixed cameras, door and cabinet contacts and a passive network tap on an edge node.
Build a station → - 02
Site
A site: the node behind a security gateway, two backhaul paths and its own protected power.
Plan a site → - 03
Fleet
Every unstaffed site of an operator watched from one security operations view, with one incident record.
Managed offers → - 04
Network
Operators share incident records with authorities and sector bodies under the critical entity and cybersecurity rules.
The open protocol →
- 01Thermal camera
- 02Fixed camera
- 03Surveillance radar (FMCW)
- 04Edge node (Wedge)
- 05Zero-trust gateway
- 06Fibre terminal
- 07Cellular modem/router
- 08Pole
Radio and links
Fibre
Most substations and pumping stations have operator fibre; alarms and clips ride it to the control room.
Radio and links
Public cellular
A cellular path on another network keeps alarms flowing when the fibre is cut, often the first thing an intruder does.
Edge computeThe node fuses radar, thermal and video so animals and weather do not raise alarms, verifies every alarm with a clip, learns the normal devices and traffic on the control network and flags anything new, and signs every event.
PowerThe security node runs from the site’s protected DC supply with its own battery, so it keeps reporting when an intruder cuts the mains.
04How it works
From the instrument to the product.
One observation’s path, tier by tier, with the interface on every link and a bill of materials below; then how the one node grows to a site, a fleet and federated networks.
Critical site security: data path
– of 07
01 Instruments Measurement with sensor identity andcalibration 02 Node – Wrap in an observation envelope with timequality– Measure quality and uncertainty, attachquality flags– Buffer locally (store-and-forward when thelink drops) 03 Local network 04 Backhaul Commit with transactional outbox andpublish, delivered at least once 05 Site Consumer inbox deduplicates and applieseach record once into governed data 06 Data store Governed product through API, map orexport, correction-aware 07 Products ONVIFMQTTSyslog 08 Power and structure 01 Thermal camera Ethernet 02 Fixed camera Ethernet 03 Surveillance radar(FMCW) Ethernet Passive tap on the sitecontrol network Not in the reference kit Door, gate and cabinetcontacts Not in the reference kit 04 Edge node (Wedge) Ethernet · Fibre · USB · RS-485 ·BMC 05 Zero-trust gateway Ethernet · Fibre 06 Fibre terminal Fibre · Ethernet 07 Cellular modem/router Ethernet · USB · RS-232 Site MQTT 5 with Sparkplug B Governed data store Versioned, correction-aware Verified intrusion alarms with clips New device and traffic alerts Incident records Site risk and response reports 08 Pole Ethernet · RTSP/ONVIF Ethernet · RTSP/ONVIF Ethernet · MQTT 5 Ethernet RS-485 Ethernet Fibre Ethernet Fibre LTE/NR| Item | Equipment | Data ports | Protocols | Power in |
|---|---|---|---|---|
| 01 | Thermal cameraLong-wave infrared camera for fire detection, equipment hot spots and night monitoring. | Ethernet | RTSP with ONVIF profiles, MQTT 5 | PoE |
| 02 | Fixed cameraFixed visible-light camera for site security, scene monitoring and machine vision. | Ethernet | RTSP with ONVIF profiles, MQTT 5 | PoE |
| 03 | Surveillance radar (FMCW)Short-range FMCW radar for perimeter, traffic, drone and water-surface detection. | Ethernet | MQTT 5, OGC SensorThings API | 12 V DC |
| 04 | Edge node (Wedge)Rugged edge node that boots from signed media, attests itself and establishes a site cell from little or no infrastructure. | EthernetFibreUSBRS-485BMC | MQTT 5, DMTF Redfish, IEEE 1588 PTP, NTP with NTS, OPC UA | 12 V DC, 24 V DC, 48 V DC, AC mains |
| 05 | Zero-trust gatewayGateway that terminates encrypted tunnels, enforces segmentation and gates every flow by identity and policy. | EthernetFibre | — | 12 V DC, AC mains |
| 06 | Fibre terminalOptical network terminal or media converter that lands fibre backhaul at a site. | FibreEthernet | IEEE 1588 PTP | 12 V DC, 48 V DC, AC mains |
| 07 | Cellular modem/routerLTE or NR modem or router that uses a public carrier or private network as backhaul. | EthernetUSBRS-232 | 3GPP E-UTRA air interface, 3GPP NR air interface, OMA LwM2M | 12 V DC, PoE |
| 08 | PoleUtility, street or dedicated pole with clamp positions. | — | — | — |
How it scales
01 Instruments Arbitrary qualified sensors and instruments whosemeasurements are ingested with calibration, units,geometry, time, custody and uncertainty. ×n 02 Node The minimum useful deployable unit: server, ruggedappliance, radio node, sensor gateway, satelliteterminal, AI, scientific, vehicle or virtual node. Node Node agent 03 Site The minimum independently operable localgovernance and failure domain: one or more nodesplus local network, identity, policy, evidence,storage, products and operator surfaces.SITE
Node Node Node ×n 04 Cluster An optional scale or specialisation domain forscheduling, shared storage, accelerators or datalocality.CLUSTER
×n 05 Fleet Coordinates plans, acknowledgements,convergence evidence, update campaigns andcorrection propagation across nodes and sites.FLEET
Fleet controller ×n 06 Federation An exchange of products, capabilities, events orwork across approved, independently administeredtrust domains, using explicit trust, policy,data-locality, version and correction contracts.TRUST DOMAIN
TRUST DOMAIN
TRUST DOMAIN
×n Verifier Applications Data in the field Telemetry Control Data upstream Control Data upstream Control Exchange Evidence Events Exchange- Data in the field
- MQTT 5 with Sparkplug B; connectors for LoRaWAN, OPC UA and instrument buses.
- Telemetry
- OpenTelemetry OTLP.
- Control
- TLS 1.3 with mutual authentication; protobuf messages over gRPC or HTTP/2.
- Data upstream
- At-least-once publication with repeat-safe keys over the control channel or NATS JetStream; QUIC MAY be used on lossy links.
- Evidence
- DSSE-signed in-toto statements; SLSA provenance; SCITT transparency receipts.
- Events
- Event envelopes mapped to CloudEvents 1.0; channels described in AsyncAPI 3.
- Exchange
- OpenAPI 3.1; the OGC API family; SensorThings; STAC; WIS 2.0.
05From order to operation
Every step, from the first call to a running site.
The same crew and the same record carry the work from scope to maintenance.
- 01 Order
Scope the sites and the threats
The scope reads the operator’s site list, its risk assessment under the critical entity rules, past incidents, the control system architecture and its response arrangements. Nexus Observatory Inc. returns a kit by site type, the alarm and verification design, the network monitoring design and a price per site and per year. 2
- 02 Survey
Survey perimeters and networks
Crews walk each site type with the operator’s security and control engineers: fence lines and approaches, detection zones and camera positions, entry points, the control network layout, tap points and the two backhaul paths. Findings are recorded with photographs and drawings. 4
- 03 Permits
Access, privacy and change control
Work in substations follows the operator’s switching and access rules, cameras are aimed and masked to follow privacy rules for public land, and connecting a tap to the control network goes through the operator’s change control. Every approval is kept with the site record.
- 04 Build
Build and harden
Kits are built per site type; nodes are hardened, enrolled with their identities and configured with the zones and alarm rules. The whole kit is tested together, including a simulated intrusion and an unknown device on a test control network, before it ships. 4
- 05 Install
Install without an outage
Crews install radar and cameras on poles, contacts on doors and cabinets and the passive tap on the control network without interrupting it. Power and backhaul are connected, and every point is photographed and recorded. Crews follow the site safety plan throughout the work.
- 06 Commission
Commission with a walk test
Each node proves its identity. A walk test crosses every detection zone at different speeds, doors and cabinets are opened, alarms are verified in the control room and the network baseline is learned over weeks before anomaly alerts are enabled. 1
- 07 Operate
Respond with evidence
The security operations view shows every site, its alarms, verified clips and network anomalies. Responders are sent only to verified events, control engineers see unknown devices at once, and every incident is recorded for reporting to the authorities. Every alert and action is kept on the record. 5
- 08 Maintain
Test, patch and review
Detection zones are walk-tested on the agreed plan, cameras are cleaned and re-aimed, node software is patched in rings, and network baselines are reviewed after every planned change. Incident reviews feed back into zones and rules, and every change is kept with the site record.
06Data products and integration
What it delivers, to whom, and into which systems.
Data products
- Verified intrusion alarms with clipsSecurity operations and responders
- New device and traffic alertsControl system engineers
- Incident recordsResilience and compliance teams
- Site risk and response reportsExecutives and regulators
Integration
- Security operationsVerified alarms reach the operator’s alarm receiving platform through its own interfaces.
- Control systemNetwork anomalies are sent to the operator’s security monitoring, never into the control system itself.
- Incident reportingRecords are exported for notification to the competent authorities.
Exchanged through ONVIF, MQTT, Syslog.
07Questions buyers ask
Before you scope it.
Does the tap touch our control system?
It is passive: it listens and never sends into the control network.
Will animals set off alarms?
Radar, thermal and video are fused so most animals and weather are filtered.
Does it help with reporting duties?
Yes. Incident records hold what authorities ask for.
Can it run if the fibre is cut?
Yes. Alarms switch to a cellular path on another network.
08Resources
The sources behind this page.
Public standards, regulations and guidance, cited where they apply. Each applies only where its jurisdiction or scope does.
- 1EN 50131: Alarm systems, intrusion and hold-up systemsEuropean Committee for Electrotechnical Standardization
- 2Directive (EU) 2022/2557 on the resilience of critical entitiesEuropean Union · 2022
- 3IEC 62676: Video surveillance systems for use in security applicationsInternational Electrotechnical Commission
- 4IEC 62443: Security for industrial automation and control systemsInternational Electrotechnical Commission
- 5Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the UnionEuropean Union · 2022
09Related
Use cases and solutions.
SolutionOperational-technology assurance for observing sites
Identity, attestation, segmentation and monitoring for instruments and edge nodes, with evidence for audits.Solutions for civil resilience →SolutionStructural and ground-movement monitoring
GNSS, InSAR, tilt, strain and fibre sensing on bridges, dams, slopes, tailings and pipelines, with alert thresholds set by the owner.Solutions for civil resilience →SolutionPower-grid edge and right-of-way monitoring
Line temperature and sag, vegetation encroachment from EO and LiDAR, substation sensors and fire-weather at the right-of-way.Solutions for civil resilience →10Civil resilience: specialized fields
Other fields of this industry.
Specialized fieldTiming integrity
Time references with holdover and monitoring for grids, telecom and finance, so a country’s critical systems keep accurate time when satellite signals are jammed, spoofed or lost.The full field →Specialized fieldBackup power at critical sites
Generators, fuel, batteries and transfer switches at hospitals, water plants and telecom hubs, monitored and tested so backup power starts when the grid fails.The full field →Specialized fieldNorthern and Arctic observing
Weather, permafrost, ground movement and river and lake ice stations for northern civil authorities, built for polar night, deep cold and satellite-only backhaul.The full field →Bring us the site.
Plan a deployment, configure a station, model it in the Studio or talk to sales. The form names who receives your details.
Plan a deploymentStation BuilderOpen the StudioTalk to salesRequest a quote