ICS / SCADA / OT · Morocco & remote
ICS, SCADA & OT security testing
Offensive testing of the industrial control systems that run physical processes — the PLCs, SCADA, HMIs and OT networks where a finding isn't a data leak but a stopped line. I test them the way an attacker would, but safely: worst case stays on a bench, not on your plant floor. I bring an offensive security background and dedicated ICS/OT training to it, based in Morocco, available on-site and remote.
01 · What I test
The attack surface, end to end.
OT security is its own discipline: the protocols are decades old, the devices are fragile, and safety comes before everything. These are the layers I assess, scoped to your environment and always with its tolerance for disruption agreed up front.
L1 · CONTROL
PLCs & controllers
Logic, authentication and firmware weaknesses on the programmable controllers that drive the process — Siemens S7, Modicon, Allen-Bradley and peers.
L2 · SUPERVISE
SCADA & HMI
The supervisory and operator layer: weak authentication, exposed services, and interfaces that trust whatever the network tells them.
PROTOCOL
Industrial protocols
Modbus, S7comm, DNP3, OPC-UA and friends — largely unauthenticated by design, and trivial to spoof or replay once you're on the wire.
ARCH
Network segmentation
How cleanly IT and OT are separated against the Purdue model, and whether a foothold in the office can reach the plant floor.
ACCESS
Remote & vendor access
The jump hosts, VPNs and vendor maintenance paths that are the most common real route into an OT network.
SAFETY
Safety-aware scoping
Safety-instrumented systems are mapped and ring-fenced, never stress-tested live. The goal is proof of reach, not a process upset.
Mapped to IEC 62443, the Purdue model and MITRE ATT&CK for ICS.
02 · How an engagement runs
Scoped, manual, reproducible.
Scope & safety agreement
We map the environment, mark the systems that must never be touched live, and agree what gets tested on a bench, in a maintenance window, or passively.
Passive first
Traffic capture and architecture review before anything active, so most findings land without ever sending a packet to a live controller.
Controlled active testing
Active testing only where it's safe — test benches, lab replicas or agreed maintenance windows — with a clear stop condition throughout.
Risk-ranked report
Findings ranked by impact to safety and availability, not just confidentiality, with remediation that respects how OT actually gets patched.
Walk-through & retest
I work through the findings with your OT and engineering teams, then retest the fixes that can be safely re-exercised.
03 · What you get
A report you can act on.
- A risk-ranked report weighted for safety and availability, not just data
- Evidence and a reproducible method for every finding
- Remediation guidance that fits how OT environments are actually patched
- An architecture and segmentation review against the Purdue model
- A walk-through with your OT and engineering teams
04 · Standards & who runs it
Grounded in the frameworks that matter.
- IEC 62443
- Purdue model (ISA-95)
- MITRE ATT&CK for ICS
- NIST SP 800-82
I've completed dedicated offensive industrial-security training and written up the hidden security risks in factory infrastructure on my blog. It sits on top of a full application-security background — 50+ vulnerabilities closed in production and bug-bounty work since 2020 — which matters when IT and OT meet at the jump host.
05 · FAQ
Questions worth asking first.
- What is ICS / OT penetration testing?
- An offensive security assessment of the systems that run physical processes — PLCs, SCADA, HMIs and the OT network around them. Unlike IT testing, the worst case is physical: a stopped line, damaged equipment or a safety event. So the method is built around not causing one.
- Is it safe to test a live industrial environment?
- Testing is scoped to protect availability first. I start passively with traffic capture and architecture review, keep active testing to test benches, lab replicas or agreed maintenance windows, and ring-fence safety-instrumented systems entirely. The goal is to prove what an attacker could reach, not to disrupt the process.
- Which systems and protocols do you cover?
- PLCs and controllers (Siemens S7, Modicon, Allen-Bradley and peers), SCADA and HMI layers, industrial protocols such as Modbus, S7comm, DNP3 and OPC-UA, IT/OT network segmentation, and the remote and vendor access paths that are the most common way in.
- Do you work with industrial sites in Morocco?
- Yes. I'm based in Morocco and available on-site for plants and facilities across the country, as well as remote for architecture review and IT/OT boundary testing. Reporting can be delivered in English or French.
- Which standards do you follow?
- Engagements are grounded in IEC 62443, the Purdue model and MITRE ATT&CK for ICS, with NIST SP 800-82 as a reference for OT security controls.
- What do I get at the end?
- A risk-ranked report weighted for safety and availability, evidence for every finding, a segmentation review against the Purdue model, remediation guidance that fits how OT is patched, and a walk-through with your teams.
A finding here stops the line, not a database.
If you run industrial control systems — SCADA, PLCs, an OT network behind the office one — I'll show you what an attacker could reach, safely. Tell me about your environment and I'll scope it.