Orlando – October 20, 2026 -- Industrial Defender has released a platform update that adds internal network security monitoring (INSM) and a remediation tool called Risk SignalTM, targeting utilities that must comply with the FERC-approved NERC CIP-015-1 standard.
The standard requires entities with high and medium impact BES Cyber Systems to monitor internal network traffic, detect and evaluate anomalies, and retain and protect the resulting data.
INSM learns device baselines and flags deviations
Built into the existing platform, the INSM solution learns each device's baseline communications. It flags new connections, unexpected protocols, anomalous traffic volume and unknown devices communicating.
Each anomaly is correlated with the asset data Industrial Defender maintains, including configuration changes, vulnerabilities and risk score. Operators can see immediately what a network change means to operations, the company said.
Every review decision is captured with reviewer, timestamp and rationale. The result is audit-ready evidence mapped to CIP-015 requirements.
"Network monitoring tells you something changed. Our customers need to know what that change means and what to do next," said CEO George Kalavantis.
Risk Signal ranks patches by risk reduction per unit of effort
Risk Signal builds on each customer's existing risk model. It identifies the patches and upgrades that deliver the greatest risk reduction for the least operational effort.
The tool packages those items into prioritized playbooks that publish directly into existing work-management systems. After remediation, it verifies each patch was applied and updates the asset's risk score.
INSM extends beyond utilities to oil & gas, petrochemicals and manufacturing
Beyond CIP-015, the INSM capability serves industrial control system environments in oil & gas, petrochemical processing and manufacturing. It connects asset data with network visibility in those settings.
The release builds on Industrial Defender's work with NERC-CIP regulated utilities, pairing endpoint visibility with network traffic monitoring in a single path from detection to prioritized remediation.
Industrial Defender will demonstrate the capabilities at GridSecCon 2026 in Orlando.