The OT-exposure cure

Industrial exposure has one root cause, and it fits in a sentence: trusted, not authenticated. A controller obeys a well-formed command from anything that can reach it. The plant is flat, the asset has no identity it can prove, and the protocol underneath authenticates nothing at all. That is not a bug you patch; it is the OT default.

Whisper cures it at the layer the abuse actually lives on: reachability. It makes the address be the asset: a routable IPv6 /128 derived from the key the asset already holds, DNSSEC-anchored and DANE-pinned, that no foothold can forge and one call can revoke worldwide. Who may reach and speak to an asset stops being a matter of position on a segment and becomes a verifiable, revocable question any party (asset owner, integrator, vendor, regulator) can answer from public DNS, across the org boundary no VPN ever closed. This page walks the root cause end-to-end, the reframe, the exact live calls, and the MUD angle that makes declared egress enforceable. It is also candid about the last inch identity does not reach.

The root cause: trusted, not authenticated

OT was not breached into this state. It was built into it. The protocols were designed for isolated, physically-guarded networks; the assets outlive the software that secures them; and IT, OT and connected-device networks have since converged onto one fabric. Strip the sector's 2023–25 incidents down and they rest on the same chain, and no link in it is an exploit.

Exposed, then accessed. The front door is already indexed: research found 145,000+ internet-exposed ICS services across 175 countries (Censys, 2024), and opportunistic actors scan for exposed VNC and HMI at internet scale (CISA AA25-343A). Access rarely needs an exploit: in one documented class a commodity crew compromised 75+ internet-exposed PLCs using the vendor's default password, or none at all (CISA AA23-335A). Where a credential exists it is a bearer secret anyone can copy: a claim, never the identity of the machine behind it.

Converged, then flat. The air gap is folklore. An IT-ransomware or vendor-account foothold flows straight into OT because no independent identity boundary stops it, and remote-access sprawl widens the bridge every year: 55% of OT environments run four or more remote-access tools, 33% run six or more (Claroty Team82). Inside, IP and VLAN segmentation authorize by position: a foothold that owns a trusted address is indistinguishable from the operator. 13% of mission-critical OT assets have an insecure internet connection, and 36% of exposed engineering-workstations and HMIs (the crown jewels) carry a known-exploited vulnerability (Claroty Team82).

The protocol obeys, and no one can say who. Modbus, DNP3-base and PROFINET carry no authentication; of 14,220 exposed OPC UA servers, over half allow unauthenticated access and roughly 80% support the plaintext "None" mode (Bitsight TRACE). A FrostyGoop-class attack weaponized Modbus/TCP :502 register writes to cut heating to ~600 apartment buildings for around two days in sub-zero temperatures, against a landscape of ~46,000 internet-exposed Modbus devices. And with no device identity, the operator cannot say which controller or session issued the destructive write, nor revoke the party that sent it across the vendor boundary.

The reframe: the address is the asset

Whisper has one primitive: the address is the identity. A routable IPv6 /128 out of 2a04:2a01::/32 (announced by AS219419), deterministically derived from a key, DNSSEC-signed to the IANA root, DANE-EE pinned (3 1 1), and RDAP-registered, re-derivable and verifiable by anyone with dig.

Point it at the asset. Whisper derives each PLC's (or each gateway's, historian's or RTU's) /128 from the public key it already holds: the public half of its OPC UA ApplicationInstanceCertificate, an IEEE 802.1AR IDevID, a TPM, or a secure element, with the OPC UA ApplicationUri (or a bare asset serial) as the domain separator. The private key never leaves the asset; only its public SubjectPublicKeyInfo is an input. There is no re-flashing of a brownfield plant: you bind the identity the asset was born with, and even an identity-less Modbus PLC behind a gateway gets a verifiable network identity, a PTR and an RDAP object for the first time.

The reframe is precise about where it acts. Whisper works at the reachability layer (the IP, DNS and transport boundary), not inside the fieldbus command path. It changes who may reach and speak to the asset from a position on a flat segment into a cryptographic identity the asset holds and demonstrates with its own key. A request either proves it is the asset (or the party) it claims to be, verifiable across the org boundary, or it has no reach at all, before a single detection rule ever runs.

What changes

Nothing here is a new detection rule. Each row is an exposure technique that stops being possible at the reachability layer, not one you catch after the fact.

Provision an asset identity

Provisioning is one control-plane call to POST https://graph.whisper.security/api/query with your X-API-Key header. You pass the asset's public key material (the base64 SubjectPublicKeyInfo of its OPC UA ApplicationInstanceCertificate / IDevID / TPM / secure-element key) and its ApplicationUri as the device_id; you get back the deterministic /128 and a WireGuard config to source the asset's traffic from that address.

The call

CALL whisper.agents({op:'connect', args:{
  tier:'wireguard',
  identity_public_key:'<base64 SPKI of the asset key>',   # public half of its OPC UA app-instance / IDevID / TPM cert
  device_id:'urn:example-plant:opcua:line3.plc-42'       # the OPC UA ApplicationUri (or a bare asset serial)
}}) YIELD op, ok, status, result, error
RETURN op, ok, status, result, error

Over stock tools: jq builds the JSON body so the Cypher's own quotes never fight the shell:

# the public key only. The private key never leaves the asset's secure element
Q="CALL whisper.agents({op:'connect', args:{tier:'wireguard', \
   identity_public_key:'MFkwEwYHKoZIzj0…SPKI', device_id:'urn:example-plant:opcua:line3.plc-42'}}) \
   YIELD op, ok, status, result, error RETURN op, ok, status, result, error"

curl -s https://graph.whisper.security/api/query \
  -H "X-API-Key: whisper_live_xxx" \
  -H "content-type: application/json" \
  --data "$(jq -nc --arg q "$Q" '{query:$q}')"

The response

# result carries the deterministic identity plus a ready-to-apply tunnel
address        2a04:2a01:a55::502
fqdn           uri-3f2a4e0.asset.<tenant>.agents.whisper.online
ptr            uri-3f2a4e0.asset.<tenant>.agents.whisper.online
state          active                       # DNSSEC + DANE-EE (3 1 1) live at provision time
wireguard_config   [Interface] …            # source the asset's traffic from its own /128

The asset now has a name it can prove and an address it egresses from. Reverse DNS resolves the /128 to that identity, a TLSA record pins the leaf key, and RDAP registers the object under 2a04:2a01::/32: the full seven-proof chain, published atomically with the allocation, and each mint recorded in the Merkle transparency log.

Idempotency and errors

The call is deterministic and honest about conflicts: conservative in what it emits, liberal in what it accepts.

Revoke worldwide: govern in between

A compromised controller, a module swap, a change of integrator, a decommission: one call tears down the /128, its PTR, and its DANE pin everywhere at DNS-TTL speed, and it is provable with the same stock tools that proved the identity existed, no Whisper software required.

# the control-plane op…
CALL whisper.agents({op:'revoke', args:{agent:'2a04:2a01:a55::502'}})
# …or the CLI
whisper kill --revoke 2a04:2a01:a55::502

# now prove it, worldwide, at DNS-TTL speed:
dig -x 2a04:2a01:a55::502 +short                       # -> nothing
curl -s https://whisper.online/verify-identity/2a04:2a01:a55::502
# -> {"is_whisper_agent": false, ...}

Revocation is the kill-switch, but the same control plane governs what a live asset may reach in between. Because egress is source-bound to the asset's /128, policy is enforced by name and by address: default-deny, allow only the historian and the SCADA controller, cap the traffic, and kill it in one call. This is micro-segmentation at the asset, not the VLAN:

# default-deny: this PLC may reach ONLY its historian, its controller, and the vendor OTA endpoint
whisper policy set 2a04:2a01:a55::502 --default deny \
      --allow historian.example-plant.internal,scada-ctrl.example-plant.internal,ota.vendor.com

# per-asset firewall (allow/deny by host, cidr or port) + a traffic budget with a kill-switch
CALL whisper.agents({op:'firewall', args:{agent:'2a04:2a01:a55::502', deny:['0.0.0.0/0','::/0'], allow:['historian.example-plant.internal:4840']}})
CALL whisper.agents({op:'budget',   args:{agent:'2a04:2a01:a55::502', max_mb_per_day:50}})

Compromise one asset and you've cut off that asset, not filed a change no one downstream will fetch. The cross-org blast-radius failure mode is structurally removed. Full policy surface: Egress governance. And because each telemetry stream and setpoint acknowledgement can be signed under the asset's forge-proof /128, the historian, the integrator and a regulator can trust the numbers came from the real asset, not a spoofed outstation.

The MUD angle: declared egress, finally enforced

An identity you can prove is also an identity you can govern. OT already has the right idea for egress; it just never had a way to make the declaration portable, verifiable, or enforced anywhere but the nearest switch. That is the one place Whisper's egress governance turns a good idea into a control.

RFC 8520 Manufacturer Usage Description (an IETF Internet Standard) lets a device emit a URL (via DHCP option 161/112, an LLDP vendor TLV, or the X.509 id-pe-mud-url extension that co-locates with an 802.1AR IDevID) declaring the exact hosts it should ever talk to: "my manufacturer's cloud, my controller, the local subnet, and nothing else." Its fatal weakness is that the declaration is only a suggestion, validated and enforced at the nearest hop by a local MUD manager: spoofable, site-scoped, with no portable identity behind it and no shared revocation.

# default-deny at the asset's own /128, the MUD manifest, made enforceable
whisper policy set 2a04:2a01:a55::502 --default deny \
      --allow historian.example-plant.internal,scada-ctrl.example-plant.internal,ota.vendor.com
#   ✓ egress governed at /128: 3 destinations allowed, everything else denied

# cap a runaway asset; cut a compromised one off worldwide
whisper budget set 2a04:2a01:a55::502 --cap 50MB/day --then revoke

This is a near-verbatim fit for CISA CPG 2.0's "permit only required communications" and a strengthening of RFC 8520 itself: the manufacturer-declared intent becomes cryptographically pinned, externally checkable, and enforced at the asset's own egress point instead of a switch ACL an attacker on the segment can route around. Recipes: MUD egress · verify · attribute.

Verify it: keyless, no account

The identity is public by design, so anyone (the asset owner, an integrator, a vendor PSIRT, an auditor, a regulator) can check an asset without your key and without taking Whisper's word for it. This is the keyless half of the two-tier surface: verify with no key, provision and govern with your key.

# no key, no account: re-derive and verify the asset's identity, trustless to the IANA root
whisper verify --trustless 2a04:2a01:a55::502
#   ✓ DNSSEC chain valid to the IANA root
#   ✓ DANE-EE (TLSA) leaf matches the asset's key
#   ✓ RDAP: registered under AS219419 · 2a04:2a01::/32

# or with only curl, the keyless full-chain verdict
curl -s https://whisper.online/verify-identity/2a04:2a01:a55::502
# { "is_whisper_agent": true, "dane_ok": true, "jws_ok": true, "evidence": { ... } }

# the address IS the asset: forward-confirmed reverse DNS names it
dig -x 2a04:2a01:a55::502 +short
# uri-3f2a4e0.asset.<tenant>.agents.whisper.online.

# the registry object for the /128: RDAP, typed JSON
curl -s https://whisper.online/ip/2a04:2a01:a55::502 | jq '.handle, .parentHandle'
# "2A04:2A01:A55::502/128"
# "2A04:2A01::/32"

The --trustless flag is the point: nothing there calls back to Whisper's own API as an authority. The CLI re-derives the DNSSEC chain to the IANA root, on your machine, with your resolver. An integrator or a regulator can verify an asset outside your plant's tenancy, with no shared network and no shared private CA: the cross-org check a local OPC UA TrustList could never offer. Full mechanics: Verify an agent and DANE & TLSA.

See who's enumerating your plant

An identity you can prove is also an identity you can watch. Because every asset's name resolves through Whisper's own authoritative DNS and RDAP, the owner can ask who looked: a reconnaissance tripwire the OPC UA TrustList's private, out-of-band registry never gave you. Discovery is the first move of every OT incident; op:lookups surfaces it while it's happening, not in the post-mortem:

# who resolved / RDAP-queried this asset's identity, and when
CALL whisper.agents({op:'lookups', args:{agent:'2a04:2a01:a55::502', window:'24h'}})

# the same reverse-observability view, keyless, per address
curl -s https://whisper.online/ip/2a04:2a01:a55::502/lookups | jq
# → one source RDAP-queried 214 distinct asset identities in 9 minutes: a plant sweep, before any write lands

Paired with op:logs (the asset's own outbound activity) and /ip/<addr>/transparency (its ordered lifecycle), you have both halves: what an asset reaches out to, and who is reaching in to enumerate it. Hand the enumerating source straight to the graph, below.

Name what already got in

Identity stops the next forgery. It does not name the operator behind the remote-maintenance sessions already in your logs, and you will not re-key a brownfield plant by Monday. So the same platform back-traces them, and the attribution survives the rotation because it fingerprints the operator's infrastructure and tooling, not the ephemeral egress IP.

Take a suspect egress IP straight from your SOC logs and ask the graph who really operates it. This runs read-only over the same public graph API, with your key:

# who really operates a remote-access host, even behind a CDN or a cloud front
curl -s https://graph.whisper.security/api/query \
  -H "X-API-Key: whisper_live_xxx" -H "content-type: application/json" \
  -d '{"query":"CALL whisper.identify(\"34.90.x.x\")"}'
# operator fingerprinted across AWS / GCP / Azure; residential swarm collapsed by JA4

You can also express the abuse as a question rather than a signature ("one source touching N distinct asset-identities in a window") in read-only Cypher, and catch a plant sweep by its shape, not by a pattern you had to know in advance:

# enumeration caught by its shape: read-only Cypher over the public graph API
curl -s https://graph.whisper.security/api/query -H "X-API-Key: whisper_live_xxx" \
  -H 'content-type: application/json' -d '{"query":"MATCH (src)-[t:TOUCHED]->(a:AssetIdentity)
  WHERE t.window = \"15m\" WITH src, count(DISTINCT a) AS assets
  WHERE assets > 50 RETURN src, assets ORDER BY assets DESC"}'
# → 1 source → 214 distinct asset identities / 15m: a plant sweep, one operator

The read-only verbs (identify, origins, walk, variants, history) run over that one endpoint against a live internet-infrastructure graph of fused BGP, DNS, WHOIS, TLS, hosting, and threat intelligence. Cloud rotation collapses through origins and walk, which cluster shared ASN, hosting, and certificate lineage into one infrastructure genealogy; history gives a timeline over a suspect operator. Every answer is reproducible, replayable JSON: the paper trail a cross-org remote-access finding needs, not a screenshot.

Honest scope: what this does and doesn't do

We will say this before your assessor does. Identity governs who may reach and speak to an asset, attributes them, and revokes them across the org boundary. It does not reach inside the plant's insecure protocols. Read both columns: the boundary is the same one that makes the cure honest.

Net: Whisper converts OT from "anyone with reachability is trusted" to "only cryptographically-identified, egress-governed, attributable, cross-org-revocable parties are trusted." That neutralizes the access, convergence-bridge, flat-network, remote-access and attribution stages that carry the majority of 2023–25 incidents. Candid about the last inch: the insecure-protocol write must be enforced in-path. We complement that layer; we never claim to be it.

Where it fits: standards, SIEM, integrations

Whisper is additive. It rides on top of the anchors you already ship and the SIEM you already run: it replaces none of them, and it adds no inline chokepoint on an OT command path.

Compliance. A verifiable, revocable per-asset identity plus per-/128 egress logs and the attribution graph are ready-made evidence for the clauses the standards actually require. It maps most directly to the EU CRA (Reg (EU) 2024/2847) Annex I essential requirements (2(d) "protection from unauthorised access by authentication, identity or access-management systems", 2(j) minimising attack surface, and 2(l) recording and monitoring access), a market-access deadline with the CE-marking obligations landing 11 December 2027 and reporting from 11 September 2026. It satisfies IEC 62443-4-2 CR 1.2 (unique device identification) with a HW-key-derived, DANE-pinned identifier a certifier can verify externally, and implements 62443-3-3 zones-and-conduits as micro-segmentation at asset granularity. It is a near-verbatim fit for CISA CPG 2.0's IPv6 asset inventory and "permit only required communications", aligns with NIST SP 800-82r3 and NISTIR 8259A device identification, and serves the segmentation and continuous-monitoring intent of the TSA pipeline security directives and NIS2 Art.21. The clause-by-clause mapping lives in IEC 62443 · EU CRA · TSA.

Nothing issued in the dark. Every identity mint and every revoke lands in a public, append-only RFC 6962 Merkle transparency log (Ed25519-signed C2SP checkpoints, each root anchored to Bitcoin via OpenTimestamps), an auditable, non-repudiable issuance and revocation trail a regulator can replay. Honest status: it is tamper-evident and Bitcoin-anchored today, but not yet independently witnessed (our two servers co-signing is availability, not independence); the log already speaks the C2SP witness protocol, so any external witness can co-sign.

Integrations (proposed, not vendor-endorsed). Whisper anchors the cloud, IP and transport boundary. Never the Modbus, DNP3 or PROFINET command path, the IEC 61850 GOOSE/MMS substation bus, or a fieldbus authenticator:

• OPC UA (ApplicationInstanceCertificate + GDS). Derive the /128 from the public half of the app-instance cert, and DANE-pin that cert under the public DNSSEC chain: cross-org verifiable with no commercial CA, which the spec discourages anyway. Keeps the ApplicationUri↔cert binding OPC UA already enforces; adds public verifiability and DNS-TTL revocation the local TrustList / GDS can't. Complements the trust model; does not replace it.
• RFC 8520 MUD. Take the device's declared egress and enforce it as default-deny governance at the asset's verifiable /128: the missing enforcement and portable identity plain MUD never had. Complements the manufacturer declaration; does not replace it.
• IEEE 802.1AR IDevID / BRSKI. The cleanest bridge: derive the /128 from the device's birth-certificate public key. The publicly verifiable, DNSSEC-anchored layer on top of the silicon identity you already stamp; no second PKI, no re-flashing the fielded fleet.
• The identity-less legacy floor. A Modbus, DNP3-base or PROFINET asset behind a gateway gets a verifiable network identity, a PTR and an RDAP object for the first time: an overlay, exactly the compensating-control pattern NIST SP 800-82r3 sanctions where a device can't do per-device identity itself.
• AWS IoT Core / Azure IoT. Your X.509 + mTLS stays; the cloud remains the CA. Whisper adds the out-of-tenancy identity anchored in DNSSEC / DANE, so a peer can verify an asset outside that cloud. Complements IoT Core mTLS; does not replace it.

And it is built to fail open: a Whisper outage never bricks a controller; checks degrade to the anchors you already ship and connectivity is preserved. Anycast on AS219419, no single node in the path.

Next

• Asset & PLC identity: how the /128 is derived from the device key and the ApplicationUri, in depth
• Control plane: the full whisper.agents op set the provisioning call belongs to
• IEC 62443 · EU CRA · TSA: the clause-by-clause evidence mapping
• MUD egress · verify · attribute: runnable recipes for enforcing a MUD manifest, verifying an asset keyless, and back-tracing a remote-access session