The AI Security Layer for manufacturing: append-only audit log for IP / trade-secret defensibility, contained subprocess execution for AI predictive-maintenance agents, command-allowlist enforcement on control-system APIs, and pre-mapped controls across 12 compliance frameworks (+8 reference catalogs). All 4 platforms from $2,000/mo, billed annually.
Proactive protection against threats targeting industrial systems and OT networks
Attackers pivot from IT APIs to OT systems. Purdue model zone enforcement + Zero Trust risk scoring + SSRF guard on backend registration block lateral movement at the API layer.
Nation-state actors target manufacturing APIs to steal designs, formulas, and production processes. Behavioral baselines + adaptive Z-score breaker catch slow-and-low exfiltration over 24h windows.
Attackers manipulate production APIs to alter set points or cause quality defects. Schema validation + command allowlisting + HMAC signature verification block tampered control payloads at the gateway.
API Security + MCP Security + AI Gateway + Verification Engine — unified on one finding bus for Industry 4.0 workloads
Secure MES, SCADA, and ERP APIs. Purdue model zone enforcement with command allowlisting on every control-system call.
Secure AI agents that monitor equipment health and predict failures. Every tools/call passes 7 sequential checks — permission, MFA, rate limit, rug-pull (SHA-256), threat detect, forwarding, response scan — before touching sensor data or PLCs.
Route LLM calls for quality control and defect detection. Proprietary IP scrubbing before LLM processing; adaptive Z-score circuit breaker for failover.
Validate every AI-generated set point or maintenance directive before it reaches a PLC or work order. Real-time checks on AI gateway traffic; a response carrying a critical PII or secret finding is blocked before delivery, streaming or not.
Zero code changes to your MES, SCADA, or AI agent stack. Target: Sub-5ms gateway proxy overhead on cached, single-region paths.
Not in Anthropic's MCP spec. Not in API gateways. Not in WAFs. Platform-level additions built for industrial workloads.
MCP servers the proxy launches locally (stdio, off unless the operator sets MCP_STDIO_SERVERS_ENABLED) run in their own session (setsid), drop to nobody if started as root, and get no-new-privs, ambient capabilities cleared and RLIMIT_AS/FSIZE/NOFILE/NPROC ceilings. Remote (HTTP) servers are proxied and inspected, not sandboxed, and network egress is not filtered.
SHA-256 hash of every maintenance tool definition pinned at tools/list. On every tools/call, the cached definition is re-hashed and compared. Drift raises MCPRugPullDetectedError, blocks execution, publishes a CRITICAL event.
Statistical, not threshold-based. Z-score > 3.0 against per-shift time-of-day baselines (day shift vs lights-out). 4 overlapping sliding windows (1m/5m/15m/1h). Progressive recovery (10→25→50→100%).
Findings from all four pillars land on one threat-event bus. A compound correlator groups them in 5-minute windows by correlation ID and by organization + client IP, and raises one incident when they match a known multi-stage pattern: a prompt injection at the gateway plus an SSRF probe and a path traversal at the API from the same client become a single critical Lethal Trifecta finding.
HMAC-SHA256 hash chain on authentication and domain events (since 2026-09-13), each entry signing the previous. Three verification levels (full / single / last-N). Control mapping (not an attestation) for IEC 62443 audits, FDA 21 CFR Part 11, and IP-theft litigation.
Cross-session attack detection: 6-dimension risk score (max 110) across tool sensitivity, data volume, burst, denials, prior detections, and tool diversity. Catches coordinated APT espionage and 24h slow-and-low patterns.
Every pillar publishes its findings to one threat event bus. The compound correlator joins findings on the same request by correlation ID, and separate requests from one client by organization + client IP.
mcp_tool_calls with its correlation ID • Compound findings link every contributing finding • Hash-chain entries are tamper-evident for IEC 62443 auditsEvery control-system access written to the append-only audit log. Control crosswalk: each SOC 2 control is mapped to its overlapping ISO 27001 controls.
"-aligned" reflects capability posture. IEC 62443 certification requires an accredited certification body engagement on the customer's side; SOC 2 Type II observation in progress with external audit H2 2026.
Built for every type of manufacturing organization
Protect automotive, aerospace, and electronics manufacturing APIs. Secure MES integrations and production scheduling.
Secure chemical, pharmaceutical, and food processing APIs. Protect batch records and recipe management systems.
Industry 4.0 API security for connected factories. Protect IoT sensors, digital twins, and cloud manufacturing platforms.
Join manufacturers using G8KEPR to protect OT/IT systems, secure AI maintenance agents, and maintain IEC 62443 / NIST 800-82 alignment with documented evidence.