Built for cybersecurity and resiliency, Culper-I watches your SCADA, PLCs and remote sites around the clock, learns what normal looks like, and warns your operators the moment something changes, whether it is an intrusion or a failing connection, before it becomes an outage or malicious access affects water pressure and quality.
Culper-I is passive. It listens to a copy of control network traffic and never sends commands to your equipment.
A Culper-I appliance in your control room sees every conversation between HMIs, PLCs, historians and remote sites.
Culper-I builds a baseline of normal: which devices talk, which commands they send, and when.
A new device, an unexpected spike, an off-hours login, an unstable network or a lost connection raises an alert to our operations center within seconds.
An analyst confirms it, calls your operator, and helps your team isolate the problem and run safely in manual.
Culper-I is DT6’s Early Warning System (EWS). Every alert, device and finding lands in one console. Our analysts work in it around the clock, and your team gets its own login. Six, its AI, reads across all of it and says where to look first.
Control network
An alert
AI recommendations
Key metrics
Sample data. Clients, people, devices and addresses are illustrative.
Certified, compliant and managed. Culper-I is modular, so a small utility can start with a non-intrusive assessment and asset inventory, and add the rest as budgets allow.
Each tier includes everything in the tier before it.
Monthly sector updates
Consolidated monthly updates on the themes that matter to water and wastewater systems.
An EWS for MSP and MSSP partners
Everything in Subscription, plus:
Managed resiliency, cybersecurity and governance
Everything in System, plus:
Items marked 2027 are enhancements planned for 2027. A dedicated EWS is available for MSPs and MSSPs, and a dedicated solution environment for water and wastewater systems.
Culper-I watches for failures as well as attacks. Every alert is graded by severity, and the grade sets how we notify you and the service level we work to.
| Severity | Resiliency | Cybersecurity |
|---|---|---|
| HighPhone call and ticket | 1-hour SLA. Outages and loss of operator access. | 1-hour SLA. Signs of compromise in an asset, the network or user activity. |
| MediumTicket | 6-hour SLA, or residual risk accepted. Degraded performance and unstable connections. | 8-hour SLA, or residual risk accepted. Vulnerabilities with no evidence of compromise. |
| LowTicket | 1-week SLA, or residual risk accepted. Legacy operating infrastructure. | 8-hour SLA, or residual risk accepted. Minor version patches less than 60 days overdue, with no security vulnerabilities. |
SLA: service level agreement.
How we run Culper-I day to day: integrate with what you have, turn data into intelligence, and customize controls to your plant.
Objectives alignment
Ongoing managed tasks
Access control management
Every system that treats, pumps or monitors water now connects to something. Culper-I covers the control systems, and our SOC and MSSP++ cover the office network they connect to.
Culper-I keeps an inventory and a record of what it watched, so compliance becomes a by-product of protection.
| Requirement | What it asks | What Culper-I provides |
|---|---|---|
| Safe Drinking Water Act, Section 1433Community water systems over 3,300 people | Assess the security of electronic, computer and automated systems, plan your response, and recertify to EPA every five years. | A current asset inventory, exposure findings and incident records that feed your Risk and Resilience Assessment and Emergency Response Plan. |
| NJ Water Quality Accountability ActNJ systems over 500 service connections | A cybersecurity program aligned to NIST CSF, CIS Controls or ISO 27000, with incident reporting to NJCCIC. | Monitoring and access controls mapped to the framework you choose, and incident details ready for NJCCIC. |
| New York State Department of Health, Appendix 5-ENY community water systems over 3,300 people | A cybersecurity program, a yearly vulnerability analysis, and incident reports within 24 hours. | An asset inventory, vulnerability findings and incident details ready for NYSDOH. |
| New York DEC wastewater rulesNY publicly owned treatment works | Written access, asset, network and incident response controls, and incident reports within 24 hours. | The four Culper-I disciplines map to those controls: asset, access, network and incident management. |
| NJ MEL Deductible Reduction GroupsMembers of a municipal Joint Insurance Fund | Three levels of controls. Members who meet them can reduce the deductible on a cyber claim by up to $80,000. | Support for Basic, Intermediate and Advanced Security, with the evidence your JIF asks for. The groups, explained |
| NIST SP 800-82 and SP 800-53Federal guidance for operational technology | Security controls from the federal catalog, tailored for control systems. | Non-intrusive vulnerability assessments to SP 800-82, and annual risk assessments that follow the NIST Risk Management Framework. |
| CISA Cybersecurity Performance GoalsAll critical infrastructure | A baseline of practices such as asset inventory, changing default passwords and logging. | Inventory, default-credential findings and logs collected continuously. |
Three phases for each control room, scheduled around your operators.
A non-intrusive vulnerability assessment to NIST SP 800-82 and asset discovery, with a report on your network topology, asset inventory, risks and remediation priorities.
We set up the components in the DT6 lab, map your network and trust zones, and configure and test the monitoring rules before anything reaches the plant.
Setup in your control room during manned hours, then operational testing with your plant operators and SCADA integrator.
Timelines are per control room. Your operators, SCADA integrator and stakeholders need to be available on site, and the internet, cellular or fiber connection at each site is the utility’s to provide.
One working session with an OT engineer, built around your plant rather than a slide deck.
Review your current resilience and security goals.
See Culper-I’s modules working on real control traffic.
Map control objectives to your organization’s goals.
Walk through the framework and how implementation would run.
No. Monitoring is passive. It listens to a copy of network traffic and never sends commands to control equipment. Vulnerability assessments are non-intrusive, follow NIST SP 800-82, and run only with your approval.
Your integrator keeps the process running. Culper-I keeps it secure and resilient, giving your integrator better options and secure connectivity without compromising operator efficiency.
Start with an on-demand assessment to measure your operations against EPA compliance requirements. Many small systems add access management next and monitoring later, as budgets allow.
For each control room: a day on site for discovery and two days to write the report, about two weeks of staging in our lab, then two days on site to deploy, during manned hours.
Our operations center confirms it. A high-severity alert, such as an outage, lost operator access or signs of compromise, reaches the operator on duty by phone and ticket within the hour, using the escalation list agreed with you. Then we help your team isolate the problem and run safely in manual.
One working session with an OT engineer, built around your plant rather than a slide deck.
Prefer to talk now? 973-339-0090
© 2025 Digital Team Six, Inc. | Your Cyber. Our Passion.™ | Cybersecurity Solutions Specialized for Municipalities, K12, Education Sector and Non-profits.
