A cyber security appliance for an operational technology network

A cyber security appliance, comprising:

• an operational technology module configured to receive data on an operational technology network from i) a set of probes, ii) by passive traffic ingestion through a location within the network, and iii) any combination of both, where the operational technology module is also configured to reference
• i) one or more machine-learning models, using machine-learning and artificial intelligence (Al) algorithms, that are trained on a normal pattern of life of users of the operational technology network,
• ii) one or more machine-learning models, using machine-learning and AI algorithms, that are trained on a normal pattern of life of devices in the operational technology network, and
• iii) one or more machine-learning models, using machine-learning and AI algorithms, that are trained on a normal pattern of life of controllers in the operational technology network;
• and
• a comparator module configured to cooperate with the operational technology module to compare the received data on the operational technology network to the normal pattern of life of any of the users, devices, and controllers to detect anomalies in the normal pattern of life for these entities in order to detect a cyber threat;
• and
• an autonomous response module configured to respond to counter the cyber threat, and a user interface to program the autonomous response module.