Building Centralized OT Threat Visibility for Continuous Production

Complete the phased rollout of centralized, passive OT cybersecurity monitoring across five industrial sites by November 2026 without disrupting continuous production. Build a common view of industrial assets, communication flows and anomalies; test SIEM/OT-SOC integration; and establish repeatable deployment and response practices across heterogeneous control systems. The project also includes an R&D stream for ML-based anomaly detection. Planning estimates after full commissioning are approximately 350 visible OT assets, 930 communication relationships and 1,365 traffic flows, extrapolated from the 2021 pilot to five comparable monitoring footprints. These are forecast coverage indicators, not achieved 2026 results.

2026

ACHIEVED BY OCTOBER 2026: a central OT monitoring console was launched, passive sensors entered deployment, and the first network-visibility results were observed. The R&D program and methodology were approved, with its first-stage report recorded as accepted. SIEM/OT-SOC integration is in testing. Full operational commissioning is scheduled for November.

AFTER FIVE-SITE ROLLOUT: >350 visible OT assets, 930 communication relationships and 1,365 monitored flows; 24/7 observation across five sites (43,800 site-monitoring hours annually).

Passive industrial network monitoring sensors; centralized OT monitoring console; switch port mirroring (SPAN); DeltaV and PLC environments; industrial protocols including Modbus, IEC 60870-5-104 and PROFINET where applicable. The deployed technology is Nozomi Networks Guardian sensors and Central Management Console (CMC). Integration with the corporate SIEM/OT-SOC is currently in testing.

The project does not use solutions from the Global CIO catalog

The project operates in live, continuous-process industrial environments where unplanned changes to control networks can affect production. Sites differ in control technology, protocols, network design and available maintenance windows. A passive monitoring architecture was selected to avoid active interaction with controllers. Deployment involves securing traffic-mirroring access, coordinating with process owners, managing OT change controls and aligning IT infrastructure, cybersecurity, automation engineers and external partners. The wider challenge is to turn a validated single-site pilot into consistent central monitoring across multiple facilities without weakening local operational accountability. The multi-site rollout and SIEM/OT-SOC testing are still in progress. The total project effort is estimated at approximately 5,000 person-hours, reflecting the coordination required across multiple industrial facilities and technical disciplines.

INITIAL SITUATION. Kazzinc operates continuous metallurgical, mining, processing and energy facilities. Industrial control networks did not have a unified, continuous view of OT assets, communications or potentially suspicious commands. The project was designed to improve cybersecurity visibility while respecting strict production constraints and corporate industrial security requirements.

PILOT VALIDATION IN 2021. At the Ust-Kamenogorsk Metallurgical Complex, passive monitoring was tested on DeltaV and PLC networks in copper production and on a DeltaV network in zinc production. It discovered 70 assets, identified 186 communication relationships (141 persistent) and monitored 273 traffic flows. All simulated security events in the test set were detected, with no production interruptions attributed to the pilot deployment. These figures describe the 2021 pilot, not the 2026 rollout. The pilot also revealed device-classification and update-criticality limitations that informed the subsequent approach.

FROM PILOT TO SCALE. The 2021 pilot validated safe passive monitoring at one production footprint; it was not an ongoing rollout. Scaling to five continuously operating sites poses a different challenge: common monitoring and incident-response practices, local OT readiness and carefully coordinated deployment windows. The interval therefore separates technical feasibility from a risk-controlled enterprise deployment, which began in January 2026.

2026 IMPLEMENTATION. The rollout spans January–November 2026 and targets five industrial sites in three regions. By late October, the central monitoring console had been deployed and launched, passive sensor deployment was under way and early network-visibility results were being observed. Installation, traffic baselining and site commissioning will be completed in stages through November. The research stream includes an approved program and methodology and a first-stage report recorded as accepted in project materials. SIEM/OT-SOC integration is in testing.

IMPLEMENTATION APPROACH. The team used mirrored network traffic to observe industrial communications without sending active commands to controllers. Rollout activities require coordination among plant automation, IT infrastructure, cybersecurity and implementation teams, as well as alignment with site-specific operating restrictions. The program is introducing central visibility while keeping responsibility for production systems with local operating teams.

EXPECTED COVERAGE. Assuming that each site has a monitored footprint comparable to the 2021 pilot, five sites would yield >350 visible industrial assets, 930 communication relationships and 1,365 traffic flows. Continuous observation of five sites corresponds to 43,800 site-monitoring hours per year after commissioning. All figures in this paragraph are planning estimates; actual 2026 measurements will be confirmed during operational acceptance.

Kazakhstan. The target rollout covers five industrial facilities across three regions, including metallurgical, mining/processing and energy operations. The production pilot was conducted at the Ust-Kamenogorsk Metallurgical Complex. The five-site rollout will be complete by November 2026. The initial central platform is deployed; site commissioning and operational acceptance are being completed in phases.