05 The Trail They Left

Findavi could not have seen the wind-farm break-in or the grid operator's network. Those sit outside the plant.

Inside the plant, the attack was loud, for days.

A controller learned a new trick. The doorway controller had one job. Then remote login appeared on it. If that login traffic crosses the switch Findavi watches, Findavi flags a device running a service it has never run. If it arrives only over the cellular side, the next two signals are where Findavi sees the attack.

New paths opened inward. Traffic flowed from that controller to parts of the plant it had never reached. Findavi flags new paths into operational systems.

A stranger spoke to the turbine controllers. On Christmas Day, commands reached the Siemens controllers through the doorway controller, a device that had never sent them before. Findavi flags that source as unfamiliar.

The STOP command arrived. Findavi recognizes a STOP command to a Siemens controller when it sees one. But by then, the damage is underway. That is why the earlier signals matter most.

The factory password was a signal too. Findavi can flag devices likely still on factory defaults by make and model, while only listening. A login is actively tested only with the customer's approval.

Findavi sits beside the plant's network switch, on a mirror (SPAN) port or a network tap. It sees everything that crosses that switch and touches nothing. So placement matters: it belongs on the control-network switch where the doorway controller connects.

This is the step CERT itself recommends: watch traffic between the control network and the private cellular network, and flag anything unusual.

In Approve mode, each signal goes to a named person with one recommended action, such as blocking a single connection, while the grid operator's normal data keeps flowing. Then two checks: is the unsafe path closed, and is the plant still running?

The honest line. No public report shows any monitoring at this plant, and we don't claim Findavi would have stopped this attack. We claim the attack left eleven days of plant-side signals, and those are the signals Findavi is built to catch.