About Range
Normal is a range.
Every plant runs inside limits. We find the ways in that move them.
Range L.L.C. is an OT security company in Dubai. We run passive assessments of the control systems in privately owned industrial plants across the UAE. We listen before we touch, we write findings as what happens to the plant, and we publish what we will not do.
01The premise
OT isn’t IT.
The computers that control machines were built to run for decades, to answer in milliseconds and to be left alone. The tools and habits of office security assume none of that. A scan that is routine on a laptop can stop a controller; a patch that is routine on a server can need a vendor’s sign-off and a shutdown window.
So the work has to start from the plant’s side: what runs, what it talks to, what a stranger on that wire could command, and what that would do to the process. Security that cannot be stated in those terms is not finished.
02The method
Passive before anything else.
Every engagement begins by listening. A passive capture at the switches tells us what is on the network and which conversations cross its boundaries, without sending a packet into a controller. Nothing active happens without written authorisation that names what, where, when and who.
The output is an asset list a plant manager can hold and a set of findings written in consequence: what happens to the process first, then the fix. The method is published in full.
03The scope
Private industry, UAE.
Range is a Dubai company working with privately owned plants and facilities across the Emirates, in nine industries. We do not take government, semi-government or designated critical-infrastructure work.
We do not publish a team page. Named credentials for the people on your engagement come with the proposal.
The last word
What Range will not do.
Each is Range policy, to be confirmed before public use.
- 01Touch a live control network without a named person from the plant beside us.
- 02Run an active scan on Level 1 or Level 0.
- 03Sell you a product to fix a finding. We do not resell anything.
- 04Use fear. No breach statistics, no hooded figures, no countdown clocks.
- 05Change the fee unless the scope changes, and we will say so in writing first.
- 06Publish a client’s name, site or finding without their signature.
- 07Keep your data after the report is accepted. It is deleted, and we send the log.
- 08Call it “cyber”.
Where we work
Nine industries.
Standards we work from
We work to published standards.
Range does not hold certificates against them.
- ISA/IEC 62443The series for industrial automation and control system security: zones, conduits, security levels, the programme an asset owner runs and what a system and its components must do. Our primary reference.
- NIST SP 800-82The United States guide to operational technology security. Freely published, widely read, and useful for its plain treatment of network architecture and risk.
- Purdue / ISA-95The reference model for where an asset sits, from Level 0 to Level 5. The vocabulary every drawing on this site uses.