Ultrametrix Validated Its Passive Discovery Module on Labshock
A probe that emits nothing needs traffic to listen to, and a plant whose contents are already known to check its answer against. Ultrametrix built one and pointed UMX Explorer at it.
September 17, 2026 — Ultrametrix has used Labshock to validate UMX Explorer, the passive discovery module in its industrial cybersecurity platform. Axel Franc and his team generated OT traffic inside a Labshock environment during their research and checked what the product found in it.
UMX Explorer listens rather than probes. It sits on a mirrored SPAN or TAP port, emits no packets towards production at all, and builds an asset inventory and a Purdue map from what it hears — PLCs, HMIs, SCADA, historians and network equipment, across fourteen industrial protocol families including Modbus/TCP, S7, EtherNet/IP, OPC UA and DNP3. Its companion module, UMX Risk Manager, turns that map into IEC 62443 zones and conduits, risk scoring and compliance reporting.
That design is exactly what makes validation difficult. A tool that emits nothing can only be judged against traffic somebody else produced, and in a production plant the reference you would check it against is an asset list that is itself a guess. The question is not whether the probe runs. It is whether its picture matches reality — and in a real facility nobody can say for certain what reality is.
A built environment inverts that. The assets, the flows, the network structure and the protocol traffic are all known in advance, because they were specified rather than discovered. Running a discovery tool over it produces an answer that can be marked against ground truth.
Ultrametrix is a French company building sovereign, open-core tooling for industrial operators, designed to run offline and in air-gapped environments. Its site is at ultrametrix.fr.
Media enquiries: info@labshocksecurity.com