IRMA is a security appliance from Achtwerk for operational technology (OT) in production plants and critical infrastructure. It discovers assets passively, without sending traffic into the plant network, and learns a baseline of normal communication with machine learning. Deviations are reported as anomalies, so signature or threat-intelligence updates are not needed, according to the vendor. IRMA supports industrial protocols such as Profinet, Modbus/TCP, EtherNet/IP and IEC 60870-5-104, uses distributed sensors (client TAPs) for segmented networks and offers a management console with alerting and risk views.
Achtwerk GmbH & Co. KG is based in Bremen, Germany. IRMA is installed on premises; the vendor states that attack detection works without a cloud and without data from the internet, and that software updates can be applied offline. Monitoring data therefore stays in the operator's own network. Achtwerk refers to its TeleTrusT membership. For European plant operators it is an OT monitoring tool run entirely in their own network by a German vendor.