AI Assistant · CYB

Cyber Defense AI

Defend OT + IT, every packet, every login.

Online
For you as · Team Leader · Nawaf Al-Mutairi
You have decisions waiting in Cyber Defense AI. Approving unlocks value from the KWD 38M pool today.
KOC business value P-06 · Operational Excellence· Uptime HSE KWD 38M annualised value
The problem today

OT/IT convergence widened the attack surface; SCADA writes now need real-time policy.

What Bayan does

Validates every SCADA command, hunts the OT network, and scores IEC 62443 live.

Path to KOC 2040
Operational Excellence88%
847 days LTI-free · 99.4% uptime → Top-quartile HSE + uptime

Cyber defence scorecard

Industry-standard upstream KPIs · targets · peer benchmarks
84
Cyber posture
OT segmentation coverage 96%. Mean time to detect down to 8 minutes. Patch compliance stable across IT / OT zones. Two IEC-62443 SL-2 gaps under closure.
MTTD (min)
Mean time to detect
on target
8min
tgt15min+7.0
IOC top-quartile12min+4.0
Below target — SIEM tuning delivered a step change.
MTTR (hrs)
Mean time to respond
on target
1.6hrs
tgt2hrs+0.4
IOC top-quartile1.4hrs-0.2
Below target; still gap to top-quartile.
Patch comp.
Patch compliance (IT+OT)
on target
96%
tgt95%+1.0
IOC top-quartile97%-1.0
On target — critical OT patches in change window.
OT segmented
OT zones fully segmented
near miss
96%
tgt98%-2.0
Peer NOC95%+1.0
Just below target — 2 Purdue L2 zones under remediation.
Phishing fail
Phishing simulation fail rate
on target
2.4%
tgt3%+0.6
IOC top-quartile2%-0.4
Below target; approaching top-quartile.
IEC-62443
IEC-62443 SL-2 coverage
near miss
92%
tgt95%-3.0
Peer NOC90%+2.0
Below target — 2 sites under closure this quarter.

Going good

On plan right now
  • Block phishing campaign · 28 mailboxes
    Stops credential harvest. · 00:10
  • Quarantine OT workstation · Burgan GC-08
    Contained before lateral move. · 03:30
  • EPS (SIEM): 84,210
    +4%

Needs attention

Early warnings — not decisions yet
  • Validate SCADA write · choke command BG-441
    Out-of-policy command from new identity.
  • Quarantined Burgan GC-08 workstation after DNS to known C2 indicator — lateral move blocked.
  • Holding SCADA write to BG-441 choke from new identity — policy mismatch; approval queued.
External signals
  • CISA ICS-CERT· 2h agohigh
    ICSA-26-201: Emerson DeltaV DCS — authenticated command replay vulnerability
    ↳ EPF-50 sour-gas DCS is on affected version band — schedule patch inside 14 days.
  • Kuwait NCC· 5d agomed
    National Cybersecurity Centre publishes updated OT segmentation guideline
    ↳ IEC 62443 scorecard needs remapping to new zone/conduit definitions.

Needs your decision

Approval goes to the audit ledger
Action Center
  • Rotate 14 privileged credentials
    Risk score elevated after audit findings.
    Reduces blast radius.10:00· 89%
  • Issue IEC 62443 compliance scorecard
    Weekly cadence + 3 control deltas detected.
    Closes audit loop.15:00· 92%

Automation

2 active rules
Recently auto-handled
  • Auto-approve09:40 PM
    Blocked phishing domain kwaitoil-support.co
    Domain reputation 12; 41 recipients
Rules ready to run now
  • Auto-approveAuto-block phishing domain matches
  • Auto-notifyNotify SCADA Engineer on out-of-policy write