The engagement
Exactly what happens, from the scoping call to the signed report.
The Critical-Conduit Assessment is a fully passive engineering review of one agreed conduit. We work from a mirror-port capture your own team configures, or from a PCAP you hand us. We transmit nothing on your network, insert no device, write to no controller, and hold no credentials to any control system. You receive one signed findings report, at a fixed price set after scope confirmation.
01 · Scope
One conduit. Named endpoints. Named owners.
For a Wardhelm assessment, one conduit means one named control path between two agreed endpoints. It is written into the scope sheet before any price is quoted, and it does not move afterwards without a written change to that sheet.
Conduits we assess
- Operator screen to controller. The HMI-to-PLC path for a single high-consequence process.
- Building management to plant controller. Chillers, air handling, medical gas monitoring, power and UPS plant.
- Engineering workstation to controller. The maintenance path that dangerous writes originate from.
Explicitly outside the scope
Stated here so procurement and clinical-risk reviewers do not have to infer it:
- Clinical devices and clinical data. Patient records, imaging archives and the configuration of clinical equipment are not the subject of the assessment. The named conduit is.
- Your enterprise IT network. Unless a named endpoint sits on it, it is out of scope.
- Anything active. No scanning, no probing, no penetration testing, no device interrogation, no test traffic.
- Anything that blocks or enforces. The assessment produces findings. It does not sit in a control loop, and nothing it produces changes the behaviour of your network.
- Credentials. We do not ask for, and do not hold, credentials to any control system, HMI, historian or engineering workstation.
02 · Phases
Six phases. Every one of them ends in a document.
Nothing in this engagement is a status update. Each phase closes when a named artifact is handed over, so a change board can see what it is approving and what it will be holding at the end.
| Phase | What happens | Artifact you receive |
|---|---|---|
| Phase 01Scoping call | We name the conduit, the two endpoints, the equipment owner and the engineer who will validate the findings. You tell us what monitoring and segmentation you already run, so the report speaks about your stack rather than a generic one. | Scope sheet, and the fixed price quoted against it |
| Phase 02Data handling agreed | Retention period, storage location, destruction date and the named individual who will hold the capture are agreed and signed before any capture data changes hands. Your security team reviews this document, not a marketing page. | Signed data-handling agreement |
| Phase 03Capture | We write the capture specification: which port to mirror, in which direction, for how long, and what a usable capture looks like. Your network team makes the mirror-port change, under your own change control — or you hand us an existing PCAP and no change is made at all. | Capture specification |
| Phase 04Engineering validation | We sit with the people who know what each point physically does. Your biomedical or facilities engineer red-lines the map: corrections, deletions, and the consequences we got wrong. This is the phase that turns traffic into meaning, and it is not ours to do alone. | Red-lined register-consequence map (draft) |
| Phase 05Report | The four sections are written up as one document. Your engineer countersigns the findings, so the physical meaning is confirmed by your side, not asserted by ours. | One signed findings report |
| Phase 06Debrief and destruction | We walk the findings with the people who will act on them, in one session, and answer questions on the record. The capture data is then destroyed on the date written into the data-handling agreement. | Findings debrief, then destruction of the capture on the agreed date |
03 · Report
One report. Four sections. One signature.
There is one deliverable, not a folder of documents. The four sections below are inside it, numbered and cross-referenced. The third of them is the part most reports leave out: what the capture could not establish.
Section 1
Register-consequence map
Each write path observed on the conduit, what the register or object physically controls, and the worst realistic outcome if it were misused. Red-lined and countersigned by your engineer — the physical meaning comes from your side, not ours.
Section 2
Existing-control coverage
Which function codes and services reached which critical points during the capture window, and what the firewalls, segmentation and monitoring you already run prevent on this conduit — as configured, and as described to us — and where the gaps sit.
Section 3
What could not be established
The gaps this capture window left open, named for your conduit specifically rather than left for the reader to notice: encrypted payloads, devices that stayed silent, configuration held only on the device, and write paths that did not occur while we were listening.
Section 4
Evidence appendix
The capture hashes, the capture window, and the confidence grade behind every line, so each claim in the report can be traced back to the packet or the person it came from.
Section 3, in more detail
A passive capture sees what crossed the wire during one window. It does not see encrypted payloads, devices that stayed silent, configuration held only on the device, or a write path that simply did not occur while we were listening. Section 3 names those gaps for your conduit specifically, so nobody reads the report as a clean bill of health.
Knowing a controller is vulnerable is not the same as knowing what it does.
Every claim carries its confidence
No sentence in the report is left for the reader to weigh on their own. Each one is labelled, and the labels are defined in the report itself:
| Label | What it means |
|---|---|
| Known | Directly observed in the capture, with the packet reference to look at. |
| Inferred | Derived from what was observed, with the reasoning stated so you can disagree with it. |
| Asserted | Told to us by your team or taken from your documentation, and attributed to the source. |
| Unknown | Not established by this capture. Named rather than quietly omitted. |
What "signed" means here
A human engineering sign-off — in place
Your engineer countersigns the findings, so the physical meaning is confirmed by your side, not asserted by ours. The countersignature is taken line by line against the consequence claims, and it comes from your organisation.
Cryptographic signing — not in place
Detached cryptographic signing of the delivered report is not in place. No page on this site claims a report you can verify without us, and none will until you can.
The countersignature is not a certification, and it is not an enforcement action.
04 · Data
Who touches your capture, where it lives, and when it is destroyed.
This is the section your security team will actually read. Every line below is written into the data-handling agreement signed in Phase 02 — none of it is a website promise.
Who
One named person handles it
The founding engineer scopes the conduit, writes the capture specification, does the analysis, writes the report and runs the debrief. The person on the scoping call is the person who writes the report. You always know who is holding your data.
Who else
No subcontractors
No third-party analyst, no offshore analysis pool, no partner laboratory, no tooling vendor with a support tunnel. Nobody outside the named individual sees the capture.
Where
On hardware we control, stated before handover
The capture lives on Wardhelm-controlled hardware that is not attached to your network. The storage location and the protection applied to it are stated in the data-handling agreement before any capture is handed over.
On what
Encrypted hardware, dedicated to the engagement
Where the capture is stored, and how it is encrypted at rest, is stated in writing in the engagement agreement before you hand over any traffic.
For how long
Retention and destruction
The capture is held only for the retention period written into the data-handling agreement, and that period is stated before any capture is handed over.
Tooling
Every tool a capture passes through is named
The analysis tooling is named in the data-handling agreement, including anything a capture passes through, so your security team reviews a list rather than a reassurance.
Never
No remote access, ever
No VPN, no jump host, no agent, no collector left behind, no persistent connection of any kind. There is nothing of ours on your network to decommission when the engagement ends.
Never
No credentials
We do not request or hold credentials to any control system, HMI, historian, engineering workstation or building-management front end.
Sample capture generated in a laboratory, using invented device names. Five lines of BACnet and Modbus traffic; one line is flagged as a finding — a single-register write from an engineering workstation to a plant controller. Nothing is transmitted back to the network: zero packets.
05 · Price
Fixed price, quoted against the scope sheet.
We publish no price list, because the price depends on the conduit. What we can publish is the shape of the number, which is what procurement needs in order to raise a requisition.
- One conduit is the unit. The quote covers the conduit named in the scope sheet, end to end.
- The price is fixed after scope confirmation. It is put in writing before any work starts and does not move unless the scope sheet is changed in writing.
- What changes the scope: a second conduit; endpoints beyond the two named; a second capture window; on-site attendance beyond what the scope sheet states. Each is re-quoted, not absorbed silently.
- No retainer, no subscription, no licence. Nothing is priced per device, per asset or per site, because nothing is deployed per device, per asset or per site.
- No success fee and no finding-count incentive. The price is identical whether the conduit turns out to be exposed or clean, which is the only arrangement under which a findings report is worth reading.
- One engagement, not a subscription. There is no automatic renewal. A later conduit is a new scope sheet and a new quote.
06 · Change
The questions a change board asks, answered plainly.
Written so this page can be attached to a change request without translation.
Do we need a maintenance window?
Only if your own change process requires one for a mirror-port configuration change on the switch in question — that decision belongs to your network team, not to us. If you provide an existing PCAP instead, no change is made to your network at all and no window is involved.
Who makes the change on the switch?
Your network team, under your change control, following a written capture specification from us. We do not log in to your switches and we are not present in your configuration history.
Does anything get installed on our network?
No. No appliance, no sensor, no agent, no collector, no virtual machine. The mirror-port configuration your team makes is the only alteration to your environment, and it is reversed by your team when the capture window closes.
Could this cause an outage?
We transmit nothing, so no traffic originates from us on your network. The one change to your environment is the mirror-port configuration your own team performs, and it carries exactly the risk your change process already assigns to that class of change — assessed by your engineers, on your equipment, under your procedure. We do not ask you to accept a risk we control, because we do not control one.
Will you need credentials, an account, or domain access?
No. Nothing on the conduit is logged into, queried or interrogated. If a scoping conversation ever seems to be heading toward a credential request, it has gone wrong.
Do you need remote access at any point?
Never — not during the capture, not during analysis, not for support afterwards. There is no remote-access arrangement to review, approve or revoke.
Can we just give you a capture we already have?
Yes. A PCAP you already hold from the conduit is a perfectly good input, and it removes the switch change entirely. Section 3 of the report — what could not be established — will state what that particular capture window could and could not establish.
Where does our data go, and when is it gone?
It lives on Wardhelm-controlled hardware that is not attached to your network, held by one named person, for the retention period written into the data-handling agreement — after which it is destroyed. The storage location, the retention period and the destruction method are all stated in that agreement before any capture is handed over. See data handling above.
Can our security team review your handling before we sign?
Yes, and they should. The data-handling agreement is signed in Phase 02, before any capture data changes hands, precisely so that review happens before there is anything to review it about.
What can a passive capture not establish?
A great deal, and the report says so in its own section 3, what could not be established: encrypted payloads, devices that were silent during the window, configuration held only on the device, and any write path that did not happen while we were listening. A conduit that looks clean in one capture window has been observed to be clean in that window, which is a narrower statement than it first appears.
Who from our side needs to be involved?
Three roles, none of them full-time: someone who can authorise the scope, a network engineer for the capture specification and the switch change, and the facilities or biomedical engineer who red-lines the map in Phase 04. That last one is not optional — without it the map is traffic, not meaning.
What do we hold at the end?
One signed findings report containing four sections — the register-consequence map, existing-control coverage, what could not be established, and the evidence appendix — together with the scope sheet, capture specification and data-handling agreement from earlier phases. Nothing of ours remains on your network.
One call, to name the conduit and confirm the scope.
Nothing is captured, nothing is signed and nothing is priced until that call has happened and the scope sheet reads correctly to you.
If that link does not open in your mail client, write to contact [at] wardhelm.com — spelled out this way so it survives with JavaScript switched off.