Nothing leaves the building. Nothing stops the line.
Two questions decide whether a tool is allowed onto an industrial network: what it sends out, and what it does to the equipment. Nexich runs inside the network you are testing, the AI included when you keep it air-gapped on a local model, and it is read-only on the plant floor by construction rather than by a setting. Neither of those is a policy. Both are how the product is built.
It reads. It does not write.
Every claim below is a property of the code rather than a default you have to keep switched on. A safety control that lives in a boolean survives exactly as long as the boolean does.
The write cannot be framed.
Modbus is the clearest case. The module knows both function-code sets and the function that builds a request accepts only the read set, ending in a default that refuses. There is no branch that produces a write frame, so no flipped default, failed config parse or forgotten flag makes one appear. The same discipline governs the other industrial protocols: S7comm reads the CPU's own diagnostic list and never downloads a block, EtherNet/IP reads an identity and never opens a session it does not need.
Channels that receive nothing, ever.
A short list of ports is refused at the last step of port resolution, after the preset, after the range, after custom ports, and after an operator's own typed entry. A channel we decided not to disturb is not made safe by somebody typing it into a box. GuardLogix safety I/O and SCADA failover synchronisation are on that list.
Name a host, and the aggressive classes close on it.
A per-host exclusion the operator sets. The page that tells you which modules consult it is derived from the source rather than hand maintained, because a hand-maintained version of that list goes stale in a week and under-reports.
What it declined to do is in the report.
When a module withholds a port or an active read, the run says so by name and reason. A capability declined in silence reads as a capability the product does not have, and an operator who cannot see a refusal cannot audit it.
A session slot is a real cost.
A controller has a small, fixed number of connection slots shared with the engineering station and the HMI, and some licensing services count a connection against a seat. Where a cheap identity read exists beside an expensive one, Nexich takes the cheap one. Where the device broadcasts its own identity, it listens instead of asking.
Recognised where the device declares it, and never assumed where it does not.
Four ODVA device profiles are safety profiles by the standard's own naming, and a device declaring one has the aggressive and brute-force classes closed on it for the rest of the engagement, off a single unauthenticated identity reply. The limit is stated rather than hidden: a GuardLogix safety controller declares the ordinary PLC profile, so the absence of that signal is never treated as evidence that a device is not safety related. Rockwell equipment additionally carries a shipped do-not-touch note that reaches the operator and the planner.
Lockout-safe by design.
One scheduler holds the dial for every credential attempt in the engagement, with a per-pair interval, per-host caps and a cooldown. Locking out the account a historian writes with is not a finding, it is a gap in the plant's production record.
And everything stays inside your perimeter.
Recon, harvested credentials, findings, the exploit and the reasoning that drives it all live on your metal. Run air-gapped on a local model and there is no cloud step in the loop and no place for your data to go.
Exploits are proven in a hardened sandbox, off your production hosts.
When Nexich writes a custom exploit, it runs inside a hardened, isolated sandbox and captures the result there. Findings that hinge on code execution or injection have to trigger an independent out-of-band callback, or they are downgraded, not reported as proven. You get a foothold you can reproduce without your live systems being the test bed.
Zero telemetry.
No usage analytics, metrics beacon, crash reporting or callbacks on by default. Optional update and feed sync is operator-configured and stays off unless you turn it on.
No egress required.
Topology, harvested credentials and findings stay in your database, on your host. Air-gap mode enforces an outbound allowlist, and it runs on fully air-gapped networks.
Your data, your database.
Self-hosted storage you control and can wipe on demand. Nothing is retained anywhere you cannot reach.
No third-party fingerprints on the wire.
White labeled to the wire: no bundled third-party tool names, banners or identifiers in your traffic or output.
Your model, your rules. The engine holds the credentials.
Air-gap capable, the AI runs on your hardware. Harvested credentials live in the engine's store and replay from there by reference: the reasoning plans and drives the chain, the engine holds and uses the secrets. Replay is rate-limited and lockout-safe, so proving access stays production-safe and does not trip account lockouts. Model agnostic by design, so you can connect a hosted model when policy allows. Your policy decides where the AI runs.
Authorized use only.
Built and licensed for owners of the network under test. Evaluation builds are supervised and scoped to authorized engagements.
Do not trust it. Prove it.
Sovereignty you cannot check is just a promise. Watch the wire while an engagement runs air-gapped: the outbound counter to the internet holds at zero, and every artifact stays in your own store.
> egress outbound to the internet ..... 0 bytes > telemetry beacons, phone-home .......... none > model inference runs .............. local, on your metal > secrets credential replay ......... engine-side > storage findings and loot ........... your host, your database posture AIR-GAP CAPABLE > verified nothing left the building