Method
Method
Passive first. Nothing enters your network without your written authorisation.
We publish this because a method is not a moat; the people who run it are. If you want to check our thinking before you meet us, this is the page for that.
Range runs passive assessments of the control systems in privately owned industrial plants in the UAE. These four commitments hold on every engagement.
Passive by default
We listen to network traffic; we don’t send anything into it. The tool an IT team reaches for can crash a twenty-year-old controller. We don’t use it here.
Written authorisation before anything active
Any step beyond passive listening is scoped, agreed, and signed off in writing before it happens. No surprise scans, no assumed consent.
We work around your turnaround
Some work can only happen during a planned shutdown window. We schedule around it rather than asking you to wait twelve months or make an exception.
Findings in consequence, not jargon
Every finding states what happens to the process before it states the fix. A plant manager should be able to read it without a glossary.
The honest version of the objection you’ll raise
“We’re air-gapped.”
That’s what most plants believe, and it’s usually true by design. What usually happens is that connections get added over the years for good operational reasons: a data feed to a report, a vendor’s service link, an engineer’s laptop. Nobody does anything wrong; it just accumulates.
Our first job is simply to check. If you genuinely are air-gapped, that’s an excellent result, and we’ll tell you so in writing.
05Why the order matters
A validated system is not changed lightly. Neither is ours.
On a regulated line, every change to a controller goes through change control before the next batch. The method here is built the same way: listen first, write down what you heard, propose nothing until the plant has the list in its hands, and then stage the work around the windows the plant already has.
That is slower than a scan and a report. It is also the only sequence that leaves a running plant running. Pharmaceuticals is the clearest case; the other eight differ in equipment, not in the order.
Who does the work
Provenance, not a roster.
We don’t publish a team page. In this sector that’s not an omission: a public roster is a poaching list for the two or three firms with a bigger salary budget, and a named-CV requirement belongs in a tender, under that tender’s confidentiality terms, not on a public website.
What we’ll commit to instead, in writing, on every engagement: work is scoped and led by someone with hands-on control-systems background (refinery and petrochemical control rooms, automation-vendor engineering centres, EPC commissioning teams), not a generalist IT consultant reading about plants for the first time. Named credentials for the people on your engagement are provided as part of the proposal.
The standards we work to
We work to published standards.
| Standard | What it governs |
|---|---|
| ISA/IEC 62443 | Industrial automation and control systems security, our primary reference |
| NIST SP 800-82 | Guide to operational technology security |
| The Purdue Model | How we describe where an asset sits: Level 0 sensors through Level 4/5 enterprise |
| Zones & conduits | The formal language we use for segmentation design |
Questions we are asked
Short answers.
- Do you work with government or critical-infrastructure sites?
- No. Range works with private industry only. We screen out government, semi-government and designated critical-infrastructure engagements by choice.