Illustrative scenario
A security consultant walks into a treatment plant with a laptop and a big smile. "We'll just run a quick scan of the network."
The chief operator puts down his coffee. "Not on my plant, you won't."
He's right to say no. Some older controllers don't handle active scanning well. A scan pokes every device to see what answers. Most devices shrug it off. A few get confused, freeze, or restart. In an office, a frozen printer is a nuisance. In a water plant, a frozen controller can stop a pump.
In a water plant, a careless scan can do the attacker's job for him.
So how do you see what's on the network without poking it?
You listen.
Every device in a water system is already talking. The controller reports tank levels to the screen. The screen sends commands back. The remote site checks in with the plant. All day, all night, the network carries a running conversation.
Connect a listening device to a monitoring port on the network, and you can hear that whole conversation without sending a single thing to any device. Nothing gets scanned. Nothing gets poked. The pumps never notice.
From listening alone, you learn a lot. What each device is. Who made it. Often what software it runs. And most important, who it talks to and how often.
That last part is where trouble shows itself. A pump controller should talk to its screen, and that's about it. If it suddenly starts talking to an address on the other side of the world, or takes a command at 3:14 a.m. that it has never taken before, something is wrong. You don't need a giant list of known threats to spot that. You need to know what normal looks like.
I'll be honest about the limits, because you should demand that from any vendor. Listening only shows what crosses the part of the network you're watching. A device that never talks can hide. A remote site on its own cellular link won't show up on your wired network at all. That's exactly why Door four matters. A good assessment starts with a clear scope and tells you what it can and can't see.
This is how we built Findavi. It plugs into a monitoring port and listens. It doesn't scan. It doesn't probe. Where your sites use radio or cellular links, it can watch those too, through an RF switch that connects it to the radio side of your sites. The AI runs on a small box inside your plant, and your data stays on your network.
What you get is something most utilities have never had: a living map of every controller, screen, and link, updated on its own as things change. The spreadsheet in the shared drive from 2019 can finally retire.