Wardhelm · Critical-Conduit Assessment
A hospital OT assessment that never touches your network.
We work from a mirror-port copy or a packet capture your team provides, analyse it off your network, and hand you one signed findings report. No agents, no inline hardware, no writes to any device — the only change request is enabling a SPAN port, and none at all if you hand us the capture yourself.
One conduit · Fully passive · One signed findings report · Fixed price after scope confirmation
Specimen capture, lab-generated, five lines: a BACnet/IP read of an air-handling unit supply temperature, an SNMP read of a UPS battery status, a BACnet Who-Is broadcast, a Modbus read of a holding-register block, and one Modbus write to a single holding register, which is flagged as a finding. Traffic arrives in one direction only; nothing in this drawing returns to the network.
Sent back to your network 0 packets The assessment reads a copy. There is no return path in this drawing, and none in the engagement.
01 · Sequence
How it enters your building.
Three steps, each with a named artifact. Two of them are a conversation; the middle one is your team copying traffic, under your own change control.
-
Step 01
Scoping call
We agree the one conduit and write it down. For a Wardhelm assessment, one conduit means one named control path between two agreed endpoints. Price is fixed after scope confirmation. A second conduit is scoped and priced separately.
-
Step 02
Mirror port or capture file
Your network team enables a SPAN or mirror port under your own change control, or simply hands us a PCAP. Nothing of ours is placed in the path, and no credentials to any control system change hands.
-
Step 03
Signed report and debrief
One signed findings report, then a working session where your biomedical engineer red-lines the map. Corrections are welcome, and expected — the physical meaning is yours to confirm.
02 · Boundary
What we will never do.
- We never place a device in your network path.
- We never write to a controller, a PLC, or any building or medical device.
- We never scan, probe, or transmit on your network.
- We never install an agent on a hospital system.
- We never hold remote access to your environment.
- We never block, filter, or enforce anything.
This is architecture, not policy. There is nothing to switch off, because there is nothing in the path. If Wardhelm disappeared mid-engagement, your control network would not notice.
What a passive capture cannot establish.
A copy of traffic is a copy of what happened to be said during the capture window. It cannot see a serial leg, a vendor's dial-in, a device that stayed silent, the contents of an encrypted payload, or the configuration sitting inside a controller. We name those blind spots in the report rather than let a map imply coverage it does not have.
Every finding therefore carries how we know it:
- Known
- Inferred
- Asserted
- Unknown
Method & data — what we do with the capture, and what we do not
03 · Fit
Knowing a controller is vulnerable is not the same as knowing what it does.
No rip-and-replace, and no pretending we are alone here. This is what the assessment adds to the stack you already run.
| You already have | It gives you | The assessment adds |
|---|---|---|
| Asset discovery (Claroty & co.) | What exists on the network | What each control point physically does |
| Protocol visibility | That a write happened | Which write paths can reach a critical point |
| Vulnerability / CVE data | That a flaw exists | The real-world consequence of an actual operation |
| Firewalls / NAC / segmentation | Rules you're afraid to enforce | Which rule would be safe — and what it would have interrupted |
| SOC alerts & reports | Noise to triage | Findings your engineer countersigns before the report is final |
Where we overlap, we say so: some platforms already offer approval-routed, time-boxed vendor access windows. We are not claiming to invent that. Two things are genuinely ours — passive off-path observation that does not depend on your sensor vendor, and a findings report your own engineer countersigns before it is final, so the physical meaning is confirmed by your side, not asserted by ours (what the report contains).
04 · Assessor
One engineer performs every assessment.
The person on the scoping call is the person who runs the capture, does the analysis, writes the report and signs it. You always know who is on your site, and there is no bench of rotating consultants behind the name.
The next step is one call.
Bring the conduit you are least comfortable with. We will tell you on that call whether a passive capture can say anything useful about it — including when the answer is no.
Or write to us — in plain text, so it survives with scripts disabled: contact [at] wardhelm.com