The company behind the platform.
OTRISK is the OT compliance platform for IEC 62443, built in Eindhoven, the Netherlands. It turns the IEC 62443 series into a working system: the flagship IEC 62443-3-2 risk assessment, requirement assessments across the rest of the series and adjacent standards, evidence and supplier audits, all ending in the documents a regulator, customer or auditor accepts.
Why OTRISK exists
OT compliance grew up in spreadsheets: one workbook per assessment, evidence in mailboxes, the method in one consultant's head. That way of working does not survive NIS2-era scrutiny. Regulators, customers and auditors now ask who decided what, when, and on what grounds. A spreadsheet has no answer.
So OTRISK is built with the people who answer to regulators. The flagship risk workflow follows IEC 62443-3-2 clause by clause, with a maintained gap analysis against the standard; around it the platform runs requirement assessments for the rest of the IEC 62443 series and for adjacent standards like ISO/IEC 27001 and NIST SP 800-82. The launching customer is a Dutch grid operator.
We think compliance is an engineering discipline: owners, reviews, versioning and an audit trail. The accountable engineer deserves tooling as rigorous as the plants they protect.
Who builds it
OTRISK is designed, built and supported from Eindhoven. The people who build the product are the people you get in the demo and in onboarding: OT security experts, not a rotating bench. It also means your feedback lands unusually close to the roadmap.
Those numbers sit at one table: the team combines hands-on experience in the energy sector with careers in cybersecurity and software engineering. That mix is why OTRISK reads like the standards and works like the plant.
Carlos Montes Portela
ISA-certified IEC 62443 trainer and subject-matter expert; CISSP and CISM. Member of NEC 65 and IEC TC65 WG10, the committees where IEC 62443 is written, after 25+ years in software architecture and OT security.
LinkedIn →
Harm van den Brink
Cybersecurity specialist for critical infrastructure: smart grids, EV charging and the OT behind them. Chairs the cybersecurity working group of the Dutch national charging infrastructure agenda and works with DIVD on vulnerability disclosure.
LinkedIn →
Ton Smets
Software engineer building the OTRISK platform. A decade in the energy domain, from smart charging to grid operations and innovation teams, turning proofs of concept into software that survives production. OTRISK is that discipline applied to compliance: engineering with the method built in.
LinkedIn →How we work
Software first.
The product carries the method. Services exist to get your team running it, not to keep us in the room.
Services until you do not need them.
Guided onboarding, your first assessment together, whether a IEC 62443-3-2 risk assessment or a requirement assessment against another standard, training at your site or at ours. The goal of every engagement is that you stop needing it.
Experts, not sales scripts.
Demos, onboarding and support come from OT security experts who work in the platform daily and in the standard weekly. Thirty minutes with us is thirty minutes about your installation.
No magic, by design.
No AI features, and we say so. The diagram parser is deterministic: it reads what it can prove and flags the rest for a human. In OT, trust must be checkable.
Contact
Luchthavenweg 54
5657 EB Eindhoven, The Netherlands
Talk to the people who build it.
Bring one installation in mind. In thirty minutes we show you which parts of OTRISK fit your situation and how the way of working looks. You leave with concrete next steps and pricing.