Cognitive Security · OT · NIS2

Infrastructure
that thinks.

RX-OS is a cognitive operating system powered by ANIMA — the living intelligence inside your infrastructure. It senses behaviour, learns what is normal, detects deviation, and responds before you notice.

Core ANIMA Edge
Deployment On-premise
Runtime RXL kernel
ANIMA · CORESensor-07MQTTSwitch-ATCP/IPS7-1200S7commRTU-17ModbusPLC-04ProfinetHMI-04OPC-UAM340ModbusBACnet-12BACnetUnknown???
eth0 :: passive 9 devices 0.3ms latency

It listens. No agents. No probes.

ANIMA Edge observes passively, on the device itself. It sees every device, every protocol, every handshake — without placing a single byte on your network. Silent, continuous, sovereign.

live observation anima edge :: discover
14:02:03.112 [SENSE] eth0 tap activated · ebpf ok
14:02:03.118 [SENSE] listening on vlan 10, 20, 30
14:02:03.244 [+] 10.4.0.12 switch · arp · ttl 64
14:02:03.291 [+] 10.4.0.14 hmi-04 · opc-ua 4840
14:02:03.330 [+] 10.4.2.22 s7-1200 · s7comm 102
14:02:03.412 [+] 10.4.2.24 m340 · modbus 502
14:02:03.488 [+] 10.4.3.09 rtu-17 · dnp3 20000
14:02:03.552 [+] 10.4.3.14 bacnet-12 · bacnet 47808
14:02:03.607 [+] 10.4.4.02 sensor-07 · mqtt 1883
14:02:03.744 [?] 10.4.9.14 unknown · no fingerprint
14:02:03.801 [MEM] baseline established · 8 devices
14:02:03.812 [CTX] anomaly monitor engaged

It listens.
No agents.
No probes.

Fully passive. No agents on your PLCs, HMIs or RTUs. One appliance, one SPAN port, operational within the hour.

  • ModeFully passive. Read-only by design.
  • SpeaksModbus, S7comm, OPC-UA, BACnet, DNP3, Profinet
  • ImpactNo packets injected. No agents on PLCs or HMIs.
  • SetupOne appliance. One SPAN port. Inside the hour.

Sense. Interpret. Reason. Act.

ANIMA runs a continuous cognitive cycle — not a rules engine. It builds a behavioural model of your plant and measures every new moment against what it knows.

ANIMAcognitive core
01 · Waarnemen

Sensors & telemetry

Current clamps, vibration, occupancy, PLC registers, machine state, environmental signals.

02 · Interpreteren

Contextual interpretation

Raw signals become symbols. A register flip becomes "batch transition, line 4".

03 · Redeneren

Cognitive core

Symbols are tested against learned baselines, causal graphs and evidence chains.

04 · Handelen

Guided response

Alarms, workflows, autonomous isolation — with an auditable evidence trail.

Six pillars.
One cognitive whole.

Every pillar is a neural pathway. Together they form a brain that understands your infrastructure — not a dashboard that aggregates events.

P·01

Cortex

Central reasoning engine. Correlates signals from every subsystem into decisions and evidence chains.

sub-ms correlation
P·02

Sense

Fully passive discovery. Sees every device, every protocol, every handshake — without injecting a single packet.

zero-touch · read-only
P·03

Signal

Real-time learning pulses travel the system in microseconds — so every component learns at once.

microsecond latency
P·04

Guard

Autonomous threat response. Blocks lateral movement at the network edge before it spreads.

< 40ms containment
P·05

Memory

Behavioural baselines. Knows what normal looks like — per device, per shift, per season.

90 dagen rolling baseline
P·06

Sleep

Offline learning cycles. Consolidates patterns during quiet hours — like the brain.

consolidate · 02:00–04:00

Every device.
Fully profiled.

Other OT scanners see "a PLC". ANIMA Edge builds a complete supply-chain profile per device — vendor, firmware, open ports, jurisdiction, NIS2 status. Continuous. Passive. On your site.

device :: plc-04 ● live
Vendor Siemens AG EU
Model S7-1200 · CPU 1214C IEC 62443
Firmware v4.5.2 · 2024-11-08 Signed
Protocol S7comm · Profinet · OPC-UA 3/3
Open ports 102 · 34962 · 4840 3
CVE status CVE-2024-38886 · CVSS 7.4 1
Jurisdiction DE · EU Trusted
NIS2 21.d Covered — audit trail active
Example
  • 01 What ANIMA Edge does todayPassive device identification. Vendor and firmware fingerprinting. Open-port detection. Continuous, agentless.
  • 02 In developmentCVE correlation against NVD + ENISA feeds. Per-component jurisdiction tagging. Auditable BOM per device.
  • 03 Everything on your siteNo cloud lookup. No telemetry. Vulnerability feeds are pulled, never shared.
  • 04 NIS2 Article 21.dSupply-chain security is a legal requirement. ANIMA Edge generates the audit trail, automatically.
Roadmap Full CVE correlation and component-level jurisdiction tagging — available in 2026.

Five sectors.
One cognitive foundation.

Every critical sector has its own protocols, its own risks, its own audit duties. RX-OS adapts — one appliance, every environment.

One screen.
Everything your infrastructure does.

Real-time device inventory, compliance scoring, anomaly detection, causal timelines — all from the same cognitive model.

rx-os.local/dashboard
ANIMA Edge · uptime 23d 04:11
Overview
Command
Devices · 247
Flows
Intelligence
Baselines
Incidents · 3
Evidence
Compliance
NIS2
ISO 27001
System
Sensors
Runtime
Devices discovered
247
+3 in last 24h
Detection latency
0.18ms
p50 · last 15m
Baseline health
99.7%
no drift detected
Cognitive load · last 6h ● live
Live incidents
SEV-1 Unauthorized Modbus write PLC-04 · line 2 · 14:02:11 2m
SEV-2 Baseline drift · pump cycle RTU-17 · 13:44:02 21m
INFO New device appeared on VLAN 30 S7-1200 · auto-fingerprinted 1h
Compliance
NIS2 · Article 21 10 / 10
ISO/IEC 27001 A+
EN 18031 Pass

NIS2, ready on day one. Every article covered.

Article 21 requires ten specific risk-management measures for essential entities. RX-OS covers every one — with evidence you can hand to an auditor.

Compliance score
A+
Article 21 · Risk management 10 / 10
  • 21.aRisk analysis & information system security policyCovered
  • 21.bIncident handling & reportingCovered
  • 21.cBusiness continuity & crisis managementCovered
  • 21.dSupply chain securityCovered
  • 21.eSecurity in network & system acquisitionCovered
  • 21.fVulnerability handling & disclosureCovered
  • 21.gCyber hygiene & training effectivenessCovered
  • 21.hCryptography & encryption policyCovered
  • 21.iAccess control & asset managementCovered
  • 21.jMFA & secured communicationsCovered

Built in Flanders.
Runs in your building.

Unlike cloud-based monitoring, ANIMA Edge runs entirely on-premise as native binaries. No Python, no agents, no telemetry leaving your building.

Runtime

Native binary. Zero dependencies. No Python, no containers, no runtime stack to abuse.

Deployment

On-premise appliance. 1U, fanless, passively cooled. Air-gap capable. SPAN tap + out-of-band management.

Data residency

No egress. All inference happens on the device. Updates are pulled, never pushed.

Jurisdiction

EU-native. GDPR by default. NIS2-compliant. No US Cloud Act exposure.

Architecture

Patent pending. Deterministic data paths. No vendor lock-in. No black boxes.

Supply chain

Auditable. SBOM per release. Reproducible builds. Assembled in Aalst (BE).

RX-OS · 1UPLCHMIRTUSWIOGWNO CLOUD · NO EGRESSYOUR BUILDING · YOUR DATA

Plug it in.
See what is hidden.

One appliance. One subnet. Full cognitive awareness inside the hour — free, no obligation, the pilot stays yours.

  1. 01We ship the appliance2 working days · EU-wide
  2. 02Connect to a SPAN portRead-only · no packets injected
  3. 03ANIMA learns your normal24–72 hours to baseline
  4. 04First findings reportDelivered within the first week
RX-OS · Tweaks