Defend the floor. Recover in hours, not weeks.
Thor.SI™. Cyber-resilience for the equipment your AI runs on. The PLCs, robots, SCADA and edge nodes that run your plant are now targets. Thor.SI inventories every operational asset, watches the industrial protocols they speak, contains what should not be there, drills the response on a digital twin before you need it, and gets production back. Built for NIS2 and the Cyber Resilience Act, by a team that has done security before.
The name
The protector of Midgard.
Thor is the one who stands at the wall when the giants come. He does not scheme or counsel; he defends the ordinary world, and his hammer Mjölnir, forged by Sindri, always returns to his hand however far it is thrown.
Thor.SI is that job for the plant floor. It knows every controller and robot on the network, watches for what should not be there, and when something gets through it has already drilled the way back. The hammer returns: production comes back, and you can prove how fast.
Þórr/Old Norse, “thunder”
What it does
The protector of Midgard.
Thor does not plan or counsel. He stands at the wall when the giants come, and his hammer always comes back to his hand. Thor.SI is that job for the plant.
Inventory
Know what is on the floor
Passive discovery of every controller, drive, HMI, robot, gateway and edge node, with firmware, protocol, zone and the known weaknesses that apply to it. You cannot defend what you have not counted.
Detect
Watch the protocols
Learn what normal Modbus, PROFINET, OPC UA and EtherNet/IP traffic looks like on your network, then flag what is not: a new talker, a write to a controller that only ever reads, a firmware change nobody scheduled.
Respond
Mjölnir: the hammer returns
Playbooks for containment and recovery, drilled on a Norns.SI twin of your network so the first time you run one is not during an incident. Measured recovery time, tested backups, a clear line of command.
Connected
The civilian counterpart to Ragnarok.
Every other SI product puts intelligence onto real equipment. Thor.SI is the one that defends that equipment. It knows what Bifröst.SI has deployed and where, watches the fleet Sleipnir.SI is driving, and rehearses incidents on the network model Norns.SI already holds.
Ragnarok.Defence serves defence clients by arrangement. Thor.SI brings the same discipline to every factory, port and utility that is now in scope for NIS2, with Heimdall.SI keeping the evidence trail an auditor will ask for.
Protect
Bifröst.SI and Sleipnir.SI
The deployed AI and the moving fleet that an attacker would reach for first.
Rehearse
Norns.SI
A twin of the network to drill containment and recovery without touching production.
Evidence
Heimdall.SI
Incident records, decisions and reviews kept in the tamper-evident vault for NIS2 reporting.
Use cases
Who is in scope.
NIS2 is in force and the Cyber Resilience Act is coming. These are the operators who come to us.
Manufacturers
Discrete and process plants with decades of controllers on flat networks and a new AI layer on top.
Ports and logistics hubs
Cranes, gates, AGVs and terminal systems that cannot stop and cannot be patched on a Tuesday.
Energy and water utilities
Essential entities under NIS2 with SCADA that predates the internet it is now connected to.
Food and pharmaceutical
Lines where an integrity attack is a safety recall, and where recovery must be proven, not assumed.
Equipment makers
OEMs who now carry Cyber Resilience Act duties for the products they ship and the updates they push.
Multi-site groups
The same controllers in ten countries, one view of exposure and one tested way back.
Ways to start
Three ways to work with Thor.SI.
Every company is set up differently, so there is no price list. Tell us what you run and we will propose a starting point.
Assessment
Know where you stand.
Passive inventory of one site, a map of zones and conduits, exposure ranked against IEC 62443 and NIS2, and a recovery plan you can actually run.
- Passive asset discovery, no production impact
- Zone and conduit map with exposure ranking
- NIS2 and CRA gap report
- Recovery plan with measured targets
Guard
Watched, drilled, ready.
Thor.SI live on your network: continuous monitoring, incidents triaged, playbooks drilled on the twin each quarter and recovery rehearsed until the numbers hold.
- Continuous protocol monitoring and alerting
- Quarterly incident drill on a Norns.SI twin
- Backup and recovery verification
- Evidence trail into Heimdall.SI
Respond
When it happens.
For operators who want us on call. Incident response with an agreed time to engage, containment on site or remote, and recovery managed to the plan we drilled together.
- Agreed response time and escalation line
- Containment and forensics
- Recovery managed to the drilled plan
- Regulatory notification support
Tell us what you need to protect.
Thor.SI is offered by enquiry only. Tell us what you run and what is driving the work, and we will reply within two business days, usually with a few scoping questions.
Defence networks are handled through Ragnarok.Defence.