04:02:13ZLOW
A vehicle stops where no vehicle should.
A camera the site already owned sees a vehicle dwell on the access road, hours after the last authorized visit. On its own this is nothing: a note, not an alarm. EXCOM logs it and keeps watching.
Cyber-physical intelligence for critical infrastructure
See the attack chain forming. Before it becomes an incident.
EXCOM combines physical behavior intelligence with cyber threat context, turning disconnected signals from your facilities into one operational picture your teams can investigate and act on.
Request a briefing
EXCOM is a joint cyber-physical offering in partnership with RedSkyAlliance RedXray.
- NDAA §889 / TAA HARDWARE
Software only, built to run on compliant cameras and edge compute you procure.
- NON-BIOMETRIC BY DEFAULT
No facial recognition. Appearance-based continuity, ephemeral by design.
- METADATA-ONLY EGRESS
Raw video stays on site. Only detections, tracks, and incidents leave the edge.
- CUSTOMER-OPERATED
You deploy and operate it. EXCOM has no standing access to your data.
- AIR-GAP READY
Runs fully disconnected on premises when the environment requires it.
- NO VENDOR CLOUD DEPENDENCY
No EXCOM cloud holds your data: your infrastructure or your own government-cloud subscription.
One incident. Not forty alerts.
Related detections collapse into one scored incident with the full timeline attached. Your operators triage a developing situation, not a queue of disconnected alarms.
04:09:51ZELEVATED
Seven minutes at the fence line.
A person leaves the vehicle and holds position beside the west fence. Behavior, not pixels: presence, duration, and place, measured against how this site normally moves at four in the morning. Severity rises, and the reason is written down.
04:12:07ZCRITICAL
The perimeter is crossed at the transformer yard.
Three observations, one story. EXCOM correlates the vehicle, the loiter, and the crossing into a single scored incident with the full timeline attached, so the operator triages one developing situation, not a queue of disconnected alarms.
INC-0417Correlated cyber-physical incidentCRITICAL
- 04:02:13Z vehicle activity on access road, after hours
- 04:09:51Z prolonged presence at fence line
- 04:12:07Z perimeter movement at transformer yard
Illustrative example.
04:14:40ZOPERATOR
One person acknowledges. Everything is on the record.
The operator acknowledges, investigates, resolves: one picture across every site, with cyber exposure from the partner feed raising physical posture when it matters. Every action lands in a tamper-evident audit trail. At 04:31 the incident closes, before the cut, not after the outage.
How EXCOM works
Designed for operational sovereignty
Processing runs at the site, on infrastructure you control. Video stays inside your operational environment; only security events and metadata move to systems you authorize. Built to protect OT, ICS, and facility operations without adding exposure.
- Perimeter crossing, loitering, vehicle dwell, tailgating, approach and route behaviors
- Defined on tracks, geometry, and time. Tuned per site without retraining
- NDAA-compliant cameras and edge compute you procure and own
Collapse signals into one incident.
Related detections collapse into one scored incident with the full timeline attached. Your operators triage a developing situation, not a queue of disconnected alarms.
Operate from one picture.
A common operational picture across every site: live map, incident board, acknowledge, investigate, resolve. When cyber risk against a facility rises, physical posture and severity tighten with it, with the reason attached. Every action lands in a tamper-evident audit trail.
- Multi-site command from one console
- Cyber indicators linked to physical consequences, with the reason attached
- Tamper-evident audit trail on every incident action
Capabilities
Built for the infrastructure societies depend on
Critical asset intelligence
Continuous physical security intelligence for substations, water utilities, data centers, and distributed industrial sites, including remote and lightly-manned perimeters.
Cyber-physical correlation
Cyber exposure monitoring and physical detection in one program: cyber indicators linked to physical consequences for OT, ICS, and building systems, with RedXray as the partner cyber feed.
Threat pattern recognition
Understand movement patterns around protected zones: approach behavior, prolonged presence, unauthorized access routes, and activity outside expected operating windows.
Cyber-physical risk awareness
A more complete view of risk: physical observations and cyber threat context in one picture, so escalation decisions come faster and better grounded.
Configured per site, not re-coded per sector
The same behavior engine covers every vertical below. Zones, lines, and time windows are configuration, not custom code.
Electrical substations & transmission
Perimeter breach, copper-theft staging, fence-line loitering, transformer-approach tampering, after-hours anomaly, correlated into one incident per attack chain.
Water & wastewater utilities
Chemical-storage access, perimeter breach, after-hours movement, and vehicle activity across large, lightly-manned perimeters, deployed through site configuration alone.
Data centers
Tailgating at controlled doors, after-hours presence, unauthorized-visitor behavior.
Rail & transit
Track trespass, cable-theft staging, abandoned objects, platform crowding.
Ports & maritime
Yard intrusion, restricted access, gate and truck behavior, convoy movement.
Renewable energy
Theft staging, vehicle intrusion, tamper approach on remote, low-connectivity sites.
Pipelines & oil / gas
Vehicle presence, loitering near line assets, route deviation along corridors.
Federal & government facilities
Tailgating, lobby and visitor anomalies, loitering at controlled perimeters.
Built to be inspected
NDAA §889 / TAA hardware posture
EXCOM ships software only, designed to run on compliant camera and compute hardware procured by the customer, for example Axis, Hanwha Vision, Bosch, Pelco cameras and NVIDIA Jetson edge compute.
Non-biometric by default
No facial recognition. Multi-camera continuity uses pseudonymous, appearance-based identity that is ephemeral by design.
Metadata-only edge egress
Raw video stays on site. Only event metadata (detections, tracks, incidents) leaves the edge node.
Customer owns the deployment
On-premises, air-gapped, or in the customer’s own Azure Government / AWS GovCloud subscription. EXCOM operates no cloud that holds your data and has no standing access to it; any support access is customer-authorized and audited.
Built together with RedSkyAlliance
EXCOM and RedSkyAlliance share a single operational model: RedXray cyber exposure intelligence and EXCOM physical behavior intelligence, engineered together as one cyber-physical risk program.
- Joint product development between cyber and physical security teams
- Cyber indicators connected to physical consequences
- Operational resilience across the complete attack surface
Your sector has its own 04:02.
A briefing walks your operators through the live console against scenarios from your own sector.