// securidigm scout
Scout reads a copy of your network traffic. It builds your equipment list and network map, flags known weaknesses and risky activity, and gives you reports you can hand to your Coast Guard or TSA reviewer. It is built on widely used free tools: Zeek and Suricata (open-source network monitors), with the industrial-protocol add-ons made for CISA by Idaho National Laboratory.
Running an ordinary office rather than a control network? See Scout for offices, with Baseline.
// passive
It only listens
Scout reads a copy of the traffic and never sends anything to your controllers. Its monitoring ports can’t transmit.
// offline
Nothing leaves your building
No internet, no “phone home,” no account with us, no remote access by us. Updates are signed files you load yourself.
// encrypted
Locked when it’s off
On the dedicated box, the disk is encrypted with a passphrase you choose. Files Scout exports for Harbor, Signal and Baseline are encrypted too.
// plain english
Alerts you can act on
Each finding says what Scout saw and what to do next. Reports say plainly which work needs an outside firm.
// see scout work
A narrated tour of Scout on a sample port terminal and pipeline: the equipment list, alerts in plain English, the network map, and the reports for your Coast Guard or TSA reviewer. Beside it: how to install Scout as a virtual machine.
Walkthrough · ports, pipelines, railroads
Play the walkthrough (8 min 12 s, opens YouTube in a new tab)
Installing Scout · Scout and Scout for offices
Play the installation video (4 min 46 s, opens YouTube in a new tab)
// why it matters
U.S. government reports keep finding the same things: office and control networks that aren’t kept apart, remote access that attackers use, and too little monitoring to notice.
94.4%
“The USCG found that 94.4% of their assessed entities had default passwords in place.”
U.S. Coast Guard findings in CISA Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments, September 2024 (CISA, PDF)
Scout flags default SNMP passwords and remote logins sent unencrypted that it sees on your network.
71%
“There was a 71% year-over-year increase in the use of stolen or compromised credentials in reported cyber incidents”
U.S. Coast Guard, on its 2024 maritime cyber trends report, May 19, 2025 (Coast Guard)
Scout lists every remote and vendor connection it sees, and flags sign-ins from new places.
5 years
“maintaining access and footholds within some victim IT environments for at least five years”
CISA, NSA and FBI advisory AA24-038A, February 7, 2024, on intrusions that included the Transportation Systems sector, using tools already built into the systems (CISA)
Scout watches the network itself, so it doesn’t depend on software installed on each computer.
IT → OT
“Insufficient network segmentation configuration between IT and operational technology (OT) assets”
CISA and U.S. Coast Guard threat hunt at a US critical infrastructure organization, advisory AA25-212A, July 31, 2025 (CISA)
Scout maps your zones and flags traffic that crosses between them.
Unseen
“The red team’s activities generated security alerts that network defenders did not review.”
CISA red team assessment, advisory AA24-326A, November 21, 2024 (CISA)
Scout writes alerts in plain English that a small team will actually read.
VNC
“minimally secured internet-facing virtual network computing connections”
Pro-Russia hacktivists’ way in, per joint advisory AA25-343A, December 9, 2025 (cyber.gov.au copy). VNC is a remote screen-control tool.
Scout flags unencrypted remote control and devices talking to the internet.
41% of successful attacks in CISA’s assessments used valid accounts: “Valid Accounts [T1078] were the most common successful attack technique, responsible for 41% of successful attempts.” CISA Analysis: FY2023 Risk and Vulnerability Assessments, September 2024 (CISA, PDF).
“OT devices are easy targets when connected to the internet.” CISA, the FBI, EPA and DOE also name default passwords, insecure remote access and unsegmented networks. Fact sheet “Primary Mitigations to Reduce Cyber Threats to Operational Technology,” May 6, 2025 (CISA, PDF).
Scout never joins your control network as a participant. A standard switch feature, the mirror port, copies the traffic to Scout; or you record a week of traffic and bring us the recording.
From the traffic alone, with nothing installed on your controllers.
Every device Scout sees: address, network-card maker, the languages it speaks, and a guess at its role (controller, operator screen, engineering laptop). Make and model where the traffic reveals them. You confirm, correct and mark the critical ones.
Someone writing new values to a controller, loading a new program, or restarting it. Scout raises these as alerts and explains them.
Remote desktop, VNC, SSH, VPNs and common vendor tools such as TeamViewer and AnyDesk. Scout lists each outside and vendor connection and checks it against the list you allow.
A map of your office and control zones and the paths between them. Scout flags gaps in plain words, such as “Office PCs talk directly to the crane PLCs (Modbus),” and shows paths from the internet or a vendor link to a controller.
Load the signed advisory file from Securidigm Watch (by download or USB stick) and Scout lists which of your devices have known weaknesses, starting with those attackers are already using.
Scout doesn’t make you compliant. It helps you show what your Coast Guard or TSA plan says you do, with evidence from your own traffic. Rule text below is quoted from the published rules.
TSA Security Directive Pipeline-2021-02G and Rail 1580/82-2022-01E · section III.B.1.b (pipeline, PDF · rail, PDF)
All external connections to the Operational Technology system
Helps you show: every connection Scout saw between your control network and the outside world, including vendor and remote access.
TSA Security Directives, same two · section III.D.2.b
Document and audit any communications between the Operational Technology system and an external system that deviates from the Owner/Operator’s identified baseline of communications
Helps you show: new connections Scout alerts on after its learning period, and remote connections not on your allowed list. Dated snapshots show what changed between analyses, in a “What changed” report.
TSA Security Directives, same two · section III.G.2.b (architecture design review)
verification and validation of network traffic and system log review and analysis to identify cybersecurity vulnerabilities related to network design, configuration, and inter-connectivity to internal and external systems
Helps you show: Scout’s findings report is a review of your network traffic. It supports this review; it does not replace your assessor.
Coast Guard, 33 CFR 101.650(b)(3) (eCFR)
Maintain an accurate inventory of network-connected systems, including designation of critical IT and OT systems
Helps you show: the equipment list Scout builds from traffic, with the devices you marked critical.
Coast Guard, 33 CFR 101.650(f)(3)
Monitor and document all third-party remote connections
Helps you show: Scout’s remote-access list: who connected from outside, with which tool, and whether you allow it.
Coast Guard, 33 CFR 101.650(e)(3)(v)
no OT is connected to the publicly accessible internet unless explicitly required
Helps you show: control devices Scout saw talking to the internet, so you can fix them or record why they must.
Plain limit. Scout listens; it doesn’t scan or test. Rules that call for vulnerability scans or penetration tests still need that work, and Scout’s reports say so. Nothing here is legal advice.
Start with a recording, with nothing installed on your network. Move to an always-on box when you’re ready.
Your IT person plugs a laptop into the switch’s mirror port and records about a week of traffic. Scout analyzes the recording on a separate computer. Nothing of ours touches your network. This is Scout Capture.
A ready-made Scout image that runs on a computer you already have. About 16 GB of memory recommended.
A small box from our published parts list, plugged into a mirror port or a one-way network tap that physically can’t send anything back. Watches all the time and sends alerts to your own email or chat. You watch your alerts; we don’t.
Controllers speak their own network languages (protocols). Scout reads these to learn what each device is and what is being asked of it.
Each one was checked on real recordings in our lab with the same engines that ship in Scout. Where no free simulator exists, we used the sample recordings that come with each protocol reader. Scout also recognizes VPNs (OpenVPN, WireGuard, IPsec), historians, serial-to-network converters and CODESYS controllers. Rail signaling and train-control systems (ATCS, PTC) have no free readers; Scout says so plainly where it can’t read something.
Scout is built on the same free tools anyone can download. What you pay for is the work they leave to you: setup, reading the results, and turning them into proof your Coast Guard or TSA reviewer accepts.
$129,180
a year: what a typical security analyst earns, the kind of expert the free route needs.
Median yearly pay for information security analysts, May 2025. U.S. Bureau of Labor Statistics, Occupational Outlook Handbook (BLS)
$6,500
once, for Scout Site: one facility, all features, answers in plain English and reports for your reviewer.
| The work | Free tools alone | Scout |
|---|---|---|
| Setup | Assemble the monitors and industrial add-ons, then tune them | A ready-made image and a short setup wizard |
| Reading the results | Thousands of log lines and alerts; you decide what matters | Plain-English findings ranked high, medium or low, with what to do |
| Control equipment | You learn each industrial protocol yourself | Recognizes the industrial protocols and names the device types |
| Proof for your reviewer | Written by hand, every time | Reports organized by Coast Guard, TSA or NIST CSF 2.0 section |
| Keeping current | You track new advisories yourself | Updates and a signed known-bad list from Watch, still offline |
| Help | Community forums; CISA's free toolkit has no paid support | Email support for the first year; renewal optional |
All three kinds of option, compared fairly. Each one is right for someone.
// free toolkits
// big platforms
// built for everyone in between
One license per organization, paid once. First year of updates and email support included; after that, optional renewal at 20% a year. A site is one facility, terminal, yard or depot; every 3 vessels count as one site. Sensor hardware is yours, from our published parts list: from about $1,100 (budget) or about $4,500 (rugged) per sensor, or about $250–$300 for an office.
| Tier | Covers | License | Yearly renewal |
|---|---|---|---|
| Scout Capture | Recordings only, up to 3 sites | $2,500 | $500 |
| Scout Site | 1 site, all features, up to 2 sensors | $6,500 | $1,300 |
| Scout Multi-site | 2–5 sites or up to 15 vessels, up to 10 sensors | $14,500 | $2,900 |
| Scout Regional | 6–15 sites or up to 45 vessels, up to 30 sensors | $24,000 | $4,800 |
| More than 15 sites | Quoted | Quoted | 20% |
| Extra sensor | Any tier with sensors | $1,000 | $200 |
| Scout for offices | 1 office, 1 sensor, up to 100 employees; office checks (details) | $1,500 with Baseline · $1,950 without | $300 · $390 |
// how they fit with securidigm’s compliance apps
Harbor, Signal and Baseline are Securidigm’s offline compliance apps: the plan and the paperwork. Scout gives each one proof from the network.
// coast guard · 33 CFR 101 Subpart F
Harbor
For ports, terminals and vessels. Scout’s equipment list, network map, third-party connections and risk items support Harbor’s registers and your Cybersecurity Plan.
// tsa · pipeline and rail directives
Signal
For pipelines and railroads. Scout’s equipment list and connection evidence support your Critical Cyber Systems list, segmentation and monitoring sections.
// nist csf 2.0 · small businesses
Baseline
For small businesses. Scout’s office mode lists every device on the office network and links each finding to the CSF 2.0 outcome it supports, such as asset inventory (ID.AM) and continuous monitoring (DE.CM). See Scout for offices.
Today Scout prints reports and writes an encrypted export file for each app. The apps learn to open that file when a customer asks for it.
// see it on your own traffic
We’ll walk you through Scout on a sample network, and explain how to record a week of your own traffic safely. No sales pressure, no account to create.
Low-risk first step: Scout Capture, with nothing installed on your network.
Tell us about your operation
Opens your own email program with the request filled in; nothing is sent until you send it. Or write to michael@securidigm.com.