Method & data
What we receive, what we do with it, and what the report says.
This page is written for the engineer who has to sign off on us. It states the boundary of the engagement, how every statement in the report is graded, and where a passive capture stops being able to tell you anything. It does not describe our analytical technique: results and posture belong on a public page, detector logic does not.
01 · Boundary
The engagement has no active step to authorise.
Passivity here is architectural, not a promise on paper. The assessment reads a traffic copy your team produces — a SPAN/mirror feed or a PCAP — and no step in the engagement transmits anything back. The mirror change itself is made by your team, under your change control. If you hand us a capture instead, there is no change at all.
Specimen capture, lab-generated, five lines of facilities-OT traffic: a BACnet/IP read of an air-handling unit supply temperature, an SNMP read of a UPS input phase, a BACnet Who-Is routed to an MS/TP network, one Modbus write to a single holding register — flagged as the finding — and a Modbus read of a holding-register block. Addresses are documentation ranges, not a customer network. Every line travels one way, into the assessment.
We receive · we do · we never do
| We receive | We do | We never do |
|---|---|---|
| A SPAN/mirror feed or a PCAP, produced and handed over by your team. | Read that copy on Wardhelm-controlled hardware that is not attached to your network. | Transmit anything into your network — no packet, no probe, no poll. |
| The scope document naming one conduit and its two agreed endpoints. | Reconstruct which control actions the conduit carries, and which of those can change a physical state. | Sit inline, in the packet path, or anywhere a failure of ours could interrupt traffic. |
| Engineering context your staff supplies: point lists, drawings, what a point means. | Grade every statement, write one signed findings report, and walk your engineers through it. | Block, filter, rate-limit, write to a device, scan, log in, install an agent, or hold remote access. |
Failure mode: nothing Wardhelm operates sits in the packet path, so a fault on our side has no route into your traffic. The one change that touches your equipment is the SPAN/mirror configuration on your own switch — made by your team, under your change control, and reversible by your team without us.
02 · Sequence
Input, analysis, report.
Input
Before analysis starts, four things exist in writing: one named conduit and its two endpoints; the capture window; who on your side produces the capture, under which change record; and the SHA-256 of every file handed over, recorded at handover by both sides. A capture that arrives outside that scope is returned, not analysed.
Analysis
Analysis runs off your network and establishes four things: which control actions the conduit carries; which of those are capable of changing a physical state; whether a control observed in the same capture already constrains them; and what the capture could not establish at all. The fourth is written down as carefully as the first three.
This page describes what the assessment establishes, not how. Rule sets, analytical tooling and detector logic are not published and are not part of the deliverable — the graded findings are what you are buying.
Report
One signed findings report, with four sections inside it: the register-consequence map, existing-control coverage, what could not be established, and the evidence appendix — capture hashes, capture window, and the grade behind every line. Your biomedical engineer red-lines the map: it is an artifact your clinical-engineering staff owns and corrects, and anything they supply is labelled ASSERTED rather than promoted to fact because we wrote it down.
03 · Grading
Every finding says how we know it.
Four labels, one on every statement in the report. A statement that cannot carry one of them does not go in.
- Known
- Directly observed on the wire, inside this capture window.
- Inferred
- Derived from observed behaviour, with the reasoning written out so your engineer can disagree with it.
- Asserted
- Supplied by your documentation or your engineering team. Recorded and attributed, not independently established by us.
- Unknown
- Not established. Flagged as a gap in the report, never quietly filled in.
04 · Limitations
What a passive capture cannot see.
This section exists because you would find these limits yourself, in week three, and it is cheaper for both of us if you find them now.
- Encrypted payloads. Where the conduit is encrypted and we are not given keys, we see that a conversation happened and what shape it had — not what it said. That is recorded as a gap rather than read as intent.
- Devices silent during the window. A device that transmits nothing while we are capturing is absent from the evidence. Absence from the capture is not absence from the network, and the report says so.
- Configuration state. Traffic shows what a device did, never what it is configured to do: stored setpoints, firmware level, local accounts and access control do not travel past a mirror port. Those reach the report as ASSERTED at best.
- Anything that does not cross the capture point. Traffic local to a segment, a serial link, a wireless hop, or a second path around the mirror is invisible to us. The map is bounded by where the mirror sits — which is why the scope document names that point.
- Frames a mirror port drops. A SPAN session under load discards frames. Where the gap is detectable we report it; loss we cannot detect stays an open limit rather than a silent one.
- The future. A capture describes its window. It is not monitoring, it does not carry forward, and a configuration change made the day after delivery is outside it.
- Device condition. We do not touch devices, so we do not establish patch level, credential strength or exploitability. Nothing in this engagement attempts an exploit or a proof-of-concept write.
These limits are not confined to this page. Each one that applies to your engagement is printed in the report, next to the findings it constrains.
05 · Data
Where your capture goes.
- Who touches it
- The founding engineer named in your engagement letter. No subcontractors, no external analysts.
- Where it lives
- On Wardhelm-controlled hardware that is not attached to your network. The storage location and the protection applied to it are stated in the engagement letter before any capture is handed over.
- Retention and destruction
- Stated in the engagement letter before any capture is handed over.
- Remote access
- None, at any point. We hold no credentials on your network during the engagement and none after it.
- Tooling
- Named in the engagement letter, including anything a capture passes through.
06 · Signature
What “signed” means here.
Three separate things travel under that word. Two of them are in place today and one is not, and this page says which is which rather than letting the word cover all three.
- Countersignature — in place
- The assessor named in your engagement letter signs the report. Your engineer countersigns the register-consequence map, which makes the map an artifact your team owns rather than a document we asserted at you.
- Capture hashes — in place
- The SHA-256 of every file handed over is recorded at handover by both sides and printed in the evidence appendix, so the report you hold can be tied to the exact capture it was drawn from.
- Cryptographic signature — not yet
- Detached cryptographic signing of the delivered report is not in place. No page on this site claims a report you can verify without us, and none will until you can.
What a signature does not do. It establishes who stands behind the report. It says nothing about whether a finding is correct — that is what the grading in section 03 and the limits in section 04 are for.
Security contact for anything about this site or a delivered report: [email protected].
07 · Frameworks
This is not a certification.
A passive network assessment can evidence the network-observable, technical clauses your programme reports against — not administrative or policy safeguards, and never a regulatory outcome. We map the shape; your counsel renders the conclusions. The assessment is not a certification, it does not replace your audit or your regulatory submission, and it carries no endorsement from any ministry or authority.
Next step
One conduit, scoped in a call.
One conduit is the unit of work; a second conduit is scoped and priced separately. The price is fixed after scope confirmation, before anything begins. The person on the scoping call is the person who writes the report.
If that link does not open — some browsers and mail clients block it — write to contact [at] wardhelm.com with the subject Scoping call - Critical-Conduit Assessment.