OT, ICS & SCADA encryption
Find out which of your OT connections carry traffic in clear text.
Most industrial protocols were designed for closed networks and carry commands and readings unencrypted. Protected versions exist, such as Modbus/TCP Security and DNP3 Secure Authentication, but both ends have to support them and someone has to switch them on. ClaveQ works from a mirror port and touches no device. Connection by connection, it tells you which ones can be trusted and which cannot.
No agents. No decryption. Zero packets sent onto the monitored network.
Why it matters
Unencrypted is only half the question.
Commands anyone can read, and often forge
Anyone with access to the network segment can read a clear-text control protocol, and can often replay or alter it. So the first job is to list the connections that carry no protection.
Encrypted is not the same as quantum-safe
Connections encrypted today mostly rely on public-key cryptography that a quantum computer would break. ClaveQ rates each one: what is protected now, and what will need migrating.
Evidence for your assessments
Findings map to IEC 62443, NERC CIP (North America), CNSA 2.0 and the EU Cyber Resilience Act. ClaveQ sets migration phases against the NCSC timeline and exports the findings as a CycloneDX CBOM.
The protocols
Modbus, DNP3, OPC UA and more — down to the protection in use.
For each connection ClaveQ records the protocol, whether it is protected, and how. Where a protocol's security settings are themselves encrypted, or otherwise not visible on the wire, ClaveQ says so rather than guessing.
| Protocol | Where you find it | Its own protection |
|---|---|---|
| Modbus/TCP | PLCs, RTUs and meters across water, energy and manufacturing | None in the original protocol. Modbus/TCP Security adds TLS, on port 802. |
| DNP3 | Telemetry between a SCADA master and outstations in water and electricity, including serial links bridged onto TCP | No encryption. Secure Authentication adds message authentication, but the traffic stays readable. |
| OPC UA | Data exchange between controllers, HMIs, historians and business systems | Security is built in, with three modes: None, Sign, or SignAndEncrypt. Set to None, it offers no protection. |
| S7comm / S7comm-Plus (Siemens) | Siemens S7 controllers and their engineering and HMI stations | None in S7comm. S7comm-Plus on S7-1200/1500 adds integrity protection; recent firmware on both can use TLS. |
| EtherNet/IP (CIP) | Rockwell and other factory and process controllers | None by default. CIP Security adds TLS, and DTLS for real-time I/O. |
| IEC 60870-5-104 | Electricity grid telecontrol | None in the base standard. IEC 62351 adds TLS and authentication. |
| IEC 61850 (MMS, GOOSE, Sampled Values) | Substation automation and protection | None by default. IEC 62351 adds TLS for MMS and message authentication for GOOSE and Sampled Values. |
| IEEE C37.118 (synchrophasor) | Phasor measurement units reporting grid conditions to control centres | None. The standard treats security as out of scope, so it relies on protection around it, such as a VPN or IPsec. |
| BACnet/IP | Building systems: heating and ventilation, lighting, access control | None in BACnet/IP itself. BACnet Secure Connect (BACnet/SC), a separate secure transport, adds TLS. |
| GE-SRTP | GE (now Emerson) PACSystems and Series 90 controllers | Clear text. Newer firmware protects the log-on, but the commands and data that follow are neither encrypted nor authenticated. |
| MQTT | Telemetry from sites and devices to brokers and cloud platforms | Optional TLS, usually on port 8883. |
| SNMP v1, v2c, v3 | Monitoring of switches, routers and other network devices | v1 and v2c send their shared password (“community string”) in clear text. v3 adds authentication and, where configured, encryption. |
| Telnet, LDAP | Remote login to older devices; directory look-ups and sign-in | Telnet has none, so passwords travel in clear text. LDAP is clear text unless LDAPS or StartTLS is used. |
| TLS, SSH | Remote access, cloud historians, and IT systems that reach into OT | Encrypted, but the classical key exchanges still common in OT could be broken by a large enough quantum computer. Hybrid post-quantum versions now exist, and recent OpenSSH uses one by default. |
| IPsec (IKEv2) | VPNs and site-to-site connections | Encrypted. The key exchange is classical unless post-quantum extensions are in use. |
How it connects
Start with one mirror port. Nothing installed on your control devices.
ClaveQ listens to a copy of the traffic from a mirror (SPAN) port on an existing switch, or a network TAP. It never transmits onto the network it is monitoring, never decrypts, and never touches the devices it is assessing.
Private beta
We are opening early access to a small number of critical national infrastructure operators.
If you run operational technology in water, energy, healthcare or manufacturing and want an early look, we would like to hear from you.
Required to reply to your enquiry. See our privacy notice.