Many grid operators are using specialized intrusion detection systems (IDSs) for their OT networks. These IDSs have become a key tool to effectively monitor OT systems.
But for grid operators it is often difficult to know how well these IDSs really work. In pilot projects, grid operators can test if the systems give a good view into the OT systems, and if they do not generate to many false alarms. The pilot periods however do not usually include any real cybersecurity incidents. So, operators cannot determine how well the IDSs detect such incidents.
Therefore, we tested 10 of these IDSs in our test lab in 2024 to determine if they can reliably detect incidents and vulnerabilities. This intermediate report gives a summary of the tests results for five IDSs:
- Dragos v2.4.3
- FortiGate VM64-KVM v7.6.0
- Nozomi Guardian v24.0.0
- Radiflow iSID v7.1.5.9
- Rhebo Industrial Protector v3.6.3