Cube Cyber secures operational technology and building management systems for Australian organisations, industrial control systems on mine sites, clinical systems and medical devices in hospitals, and the BMS behind HVAC, access control, lifts and plant. With more than 10 years' experience in OT and as the first Australian partner for the Industrial Defender platform, we deliver asset visibility, segmentation, risk-based vulnerability management and the compliance evidence SOCI and CIRMP obligations demand.
OT environments share problems that corporate security practices were never designed for:
Core capabilities & deliverables
Asset discovery and visibility
Establish what is actually on the network, down to device level, using passive, OT-safe methods that do not disrupt operations. The asset inventory becomes the foundation for everything else, segmentation, vulnerability management and compliance evidence.
Segmentation and secure architecture
Design and implementation of segmentation between corporate and operational networks, aligned to IEC 62443 zones and conduits, so an IT compromise cannot reach the plant, the ward or the building systems.
Vulnerability management for OT
Risk-prioritised and led by compensating controls, for environments where patching is rarely an option. We assess exploitability in context, this device, this network position, this consequence, rather than forwarding CVE lists.
OT monitoring
Continuous visibility of OT networks integrated with our 24/7 hybrid SOC, detecting anomalous behaviour in environments where an unexpected change matters long before it becomes an incident.
Compliance evidence
Reporting aligned to SOCI, CIRMP and IEC 62443 obligations, generated from live asset and risk data rather than manual collection, so evidence for the regulator stops being an annual archaeology project.
OT engagements follow a four-stage path built around one constraint: the operation cannot stop.
Discover
Passive asset discovery and network mapping, establishing the real inventory and the real data flows without touching availability.
Assess and design
Risk assessment in operational context and segmentation architecture aligned to IEC 62443, sequenced with engineering and operations teams around maintenance windows.
Implement
Compensating controls, segmentation and monitoring deployed with the people who run the environment, at the pace the environment permits.
Monitor and evidence
Ongoing OT monitoring through our SOC, and compliance reporting that keeps SOCI and CIRMP evidence current rather than reconstructed.
Work is aligned to IEC 62443, the SOCI Act and CIRMP rules, and ACSC guidance for critical infrastructure, and delivered on the Industrial Defender platform, where Cube Cyber is the first Australian partner. Our practitioners bring more than 10 years' experience across industrial, clinical and building environments.
IEC 62443
SOCI ActCIRMP RulesFrequently asked questions
No, and this is the discipline that separates OT security from IT security done badly. Discovery uses passive methods that observe traffic rather than probing devices, and any active work is planned with engineering teams around maintenance windows. In environments where availability is a patient safety issue or a production imperative, we treat availability as a security property, not a constraint on one.
IEC 62443 is the international standard family for securing industrial automation and control systems, most usefully, its zones-and-conduits model for segmenting OT environments. It applies formally to some sectors through regulation and contract, and practically to anyone running control systems, because it describes what defensible OT architecture looks like.
Yes. We help critical infrastructure operators build and evidence the cyber elements of their risk management program, asset visibility, risk assessment, controls and reporting, with evidence generated from live data rather than annual manual collection.
Because they are computers controlling physical things, HVAC, access control, lifts, power and plant, usually network-connected, rarely patched and almost never monitored. A compromised BMS is a business continuity and safety problem, and in most organisations it is a live attack surface almost nobody is covering.
Yes, it is a defining feature of OT work. Many devices cannot be modified without voiding vendor support, so security is delivered through network architecture, compensating controls and monitoring around the device rather than changes to it, coordinated with your OEMs and integrators where needed.
We're here to help.
Talk to a practitioner, not a call centre. Tell us what you're trying to solve and we'll come back to you within one business day. If you're dealing with an active incident, call us directly.
Send us a message
Tell us what you're trying to solve and we'll get back to you within one business day.
We use the details you provide to respond to your enquiry. Your information is stored in our Microsoft 365 environment and handled in line with our Privacy Policy, which explains how to access or correct it and how to make a complaint.