DeepTempo and the Technology Advancement Center Validate AI-Based Threat Detection for Critical Infrastructure

LogLM surfaced a rogue HMI in a water-plant range with no device-specific rule; Vigil delivered the evidence to analysts, entirely on premises

MENLO PARK, Calif.--(BUSINESS WIRE)--DeepTempo, the company behind LogLM and Vigil, today announced the results of a joint operational validation with the Technology Advancement Center (TAC), a nonprofit established by the National Security Agency that advances technological capability for the nation through proof-of-concept innovation and training of defenders. Running on TAC's WS3 water-plant range, DeepTempo's Intelligent Defense Platform detected an advanced attack, without a signature, device rule, or model fine-tuning written for that endpoint.

Operational technology (OT) environments present constraints that conventional cybersecurity tooling was not designed for. Controllers run for years on firmware that cannot be patched on demand. Networks are segmented or fully air-gapped, and telemetry frequently cannot leave the plant. The validation demonstrated that DeepTempo’s AI based behavioral detection and investigation can operate within those constraints: passively, locally, without a prior learning period on the plant, and with protocol-level evidence available to the operator immediately.

How the assessment worked

Packet captures from the WS3 range were processed locally. The LogLM captured Modbus reads and writes as semantic events. LogLM, DeepTempo's encoder-only transformer foundation model for security telemetry, then evaluated sequences for divergence from typical behavior and for similarity to malicious patterns of behavior. Results were imported into Vigil, the leading open source AI SOC (Apache 2.0), where analysts could inspect each finding alongside the underlying flows and register operations.

DeepTempo identified a particular HMI as the source of an attack. The TAC independently confirmed the endpoint as the rogue HMI responsible for a simulated flow valve fluctuating against the benign controller.

"Conventional OT monitoring watches a plant for weeks to learn what normal looks like there, while hoping not much changes in the meantime, and waits for a researcher to characterize the adversary first," said Evan Powell, founder and CEO of DeepTempo. "TAC's validation shows a third path: a purpose built AI model that recognizes malicious behavior on day one, running on hardware the plant already has rather than another vendor appliance, paired with an open source SOC that shows the operator exactly where to look for the source of an attack."

"DeepTempo is delivering a powerful analyst-assistant capability that adds true plant-operating-state semantic analysis, pairing its established IT analysis with meaningful, plant-aware OT analysis," said Steve Hutchinson, Director of Research at the Technology Advancement Center.

The full case study and a new resource page on OT and critical infrastructure security are available at https://www.deeptempo.ai/critical-infrastructure.

About DeepTempo

DeepTempo builds the Intelligent Defense Platform for detecting and responding to AI-powered and other attacks. LogLM is a cybersecurity foundation model, an encoder-only transformer trained across diverse security telemetry, that detects malicious behavior zero-shot with no baselining period. Vigil is the leading open source AI SOC, released under Apache 2.0, giving analysts agentic investigation and response workflows they can inspect and extend. The platform runs entirely inside the customer environment: on premises or fully air-gapped, inside an existing data lake, or in a customer-controlled cloud or Kubernetes cluster. DeepTempo is headquartered in Menlo Park, California. Learn more at https://www.deeptempo.ai and https://vigilsoc.org.

About the Technology Advancement Center

TAC is a nonprofit focused on creating and propelling enduring technological advantages for the nation through workforce development, proof-of-concept innovation, and collaboration.