Why Rhebo

Our Core Principles

Embrace simplicity

OT Security Made Simple is not just a claim, it's a promise. We are convinced that OT cybersecurity solutions must be simple, accessible, and manageable in terms of time, given the shortage of skilled personnel and the (current) lack of expertise in many companies. This is reflected in our clear dashboards, modern technology and our focus on the things that really matter in industrial cybersecurity.

Drive efficiency

No two OT networks or edge devices are alike. We continuously develop our network intrusion detection systems for OT networks and IIoT edge devices with the specific requirements of industrial environments in mind. This includes scalability, resource-efficient integration, and the ability to analyze the multitude of OT protocols for security-relevant events and technical errors.

Ensure support

OT cybersecurity is a new topic in many companies, with many unknowns. We are happy to share our many years of expertise with our customers. Whether as part of an initial vulnerability assessment or in the operation of our industrial intrusion detection system, we are here to help, support you in developing measures, and evaluate anomalies together with you.

Your advantages with Rhebo

Better safe than sorry

Dedicated OT Security and Services

Identify vulnerabilities

... through OT vulnerability assessments.

Defend against known and novel cyber attack

... through network monitoring with anomaly detection.

Establish end-to-end security

... with attack detection solutions from OT to edge.

Simplify OT security

... through OT-focused security analysis and visualization.

Accelerate your ability to act

... with support in risk assessment and forensic analysis.

Ensuring process stability

... through simple and passive integration into OT and IIoT environments.

Enable reliable budget planning

... with a clear licensing structure.

Ensure compliance

... through OT attack detection in accordance with government laws and recommendations.

Reduce system failures

... with integrated network condition monitoring.

Achieve digital sovereignty

... wit OT Security made in Germany.

Schedule a demo

Ensure Operational Capability and Manage Residual Risk

The State of OT Cybersecurity

The situation of OT cybersecurity remains tense in 2025. Although in 2024 - compared to the total number of all cyberattacks - only a few campaigns targeted industrial facilities directly, the attack surface continues to grow. This eBook summarizes the developments in OT cybersecurity based on metrics and official reporting from 2024. It highlights the trends that will be important for 2025, from a global to a European to a German perspective, and concludes with specific observations from Rhebo Industrial Security Assessments at customer sites. The complex and nuanced picture makes it clear that when making decisions about OT security, not only past statistics but also future potential must be considered.

To the download

FAQ

Answers to frequently asked questions

What must an intrusion detection system provide?

There is no clear definition of what an intrusion detection system (IDS) must provide. That’s because there are different types that secure different parts of an infrastructure and can detect different types of threats.

The best orientation can be found in the EU Commission Implementing Regulation C(2024)7151 (12) that accompanies the NIS2 directive: “To detect events, near misses and incidents, the relevant entities should monitor their network and information systems and should take actions to evaluate events, near misses and incidents. Those measures should be capable of allowing the detection of network-based attacks based on anomalous inbound and outbound traffic patterns and denial of service attacks in a timely manner.”

This implies that an effective IDS includes a multi-level strategy that covers the perimeter (firewall), the systems (i.e. virus scanners where applicable and MFA) and a network-based intrusion detection system (NIDS).

This makes sense since zero-day vulnerabilities, attacks with stolen credentials and attacks via supply chain compromise (e.g. via software updates) bypass classic solutions like firewalls and even authentication measures.

Furthermore, since a company’s critical processes are the main focus of NIS2, industrial companies must implement these solutions in their OT environment as well.

Are a firewall and / or a SIEM system enough for an IDS?

Firewalls and a Security Information & Event Management (SIEM) system are undoubtedly relevant components of an intrusion detection system – even in OT. However, they are not in themselves a fully functioning intrusion detection system.

‍

Firewalls

Firewalls are located at the network boundaries and exclusively check (usually signature-based) the traffic that passes through the respective gateway.

However, firewalls are blind to:

communication that takes place within the OT network (e.g., via a maintenance laptop connected directly to the machine)
attacks for which no signatures exist (e.g., through zero-day vulnerabilities, use of stolen credentials, living-off-the-land cyberattacks), so-called anomalies in network behavior
attacks by internal perpetrators
in most cases, communication that uses OT-specific protocols.

‍

SIEM system

A SIEM system collects log data from a wide variety of systems in the networks as well as threat intelligence information at a central location, analyzes it, and attempts to identify patterns that indicate a threat. AI or machine learning is often used at this point to sift through the extensive data sets.

However, a SIEM alone is NOT an intrusion detection system, as it is dependent on its data sources. If data sources are missing, a SIEM can only partially detect or deduce acute threats. Without log data or monitoring within the OT, even a SIEM has no insight into the OT networks and therefore cannot provide any information about the threat situation and OT security.

An OT monitoring system with integrated anomaly detection—such as Rhebo Industrial Protector—closes the security gaps left open by firewalls and SIEM.

What is a network-based intrusion detection system (NIDS)?

A network-based intrusion detection system (NIDS) for OT is a type of intrusion detection system (IDS) that monitors traffic at strategic points within an OT network.

While a firewall monitors the network perimeter and a virus scanner monitors individual end devices, a NIDS keeps an eye on the internal company network (in this case, the OT network) (see also FAQ “Are a firewall and / or a SIEM system enough for an IDS?”).

In praxis, the NIDS – such as Rhebo Industrial Protector – decrypts and analyzes any communication to and from the OT network as well as between devices and systems within the OT network and alerts administrators when there is suspicious activity or security-relevant incidents. In the case of Rhebo Industrial Protector, this is done passively only to prevent any disruption of the sensitive OT communication processes (i.e. through overload of OT devices or the network capacity).

This also enables the detection of cyberattacks that:

have already successfully penetrated the OT network,
originate from an internal perpetrator,
are carried out through zero-day vulnerabilities, backdoors, or stolen access data,
use living-off-the-land techniques or new types of malware,
belong to the lateral movement phase.

What costs do I face with the Rhebo NIDS?

Rhebo follows a transparent and stable pricing policy for its Rhebo Industrial Protector intrusion detection system. There are no hidden costs.

We do not charge based on monitored assets or data volume. We do not sell relevant functions as paid add-ons. Both licensing models are widely used by US providers. While those license agreements suggest flexibility and (in some cases) relatively low initial investment, they usually mean:

rising recurring costs, especially when assets change or increase.
accumulating (recurring) total costs for individual functionalities in order to implement a functioning intrusion detection system.
limited access to your IDS when the license scope is exceeded (i.e. with adding a new asset).

Instead, Rhebo provides licenses that are transparent and reliable for our customers from the very beginning.

How easy is the installation of the Rhebo NIDS?

Very easy, indeed. The installation of Rhebo Industrial Protector in the OT is usually completed in less than an hour. It only requires a free switch port that can receive the entire communication of the OT network to be monitored.

Alternatively, network taps can be used to integrate the data collector into the OT.

The installation is achieved without any disruption of the critical processes or downtime of the OT network.