Protect the plant's Windows and Linux servers from ransomware.

Mimic protects the Windows and Linux servers above the controllers. That means MES and historian servers, the OT management servers that patch and administer the plant, engineering file servers and Active Directory. Each protected server gets a Mimic node and its own known-good profile. Controllers, HMI panels, engineering workstations, field devices and the OT network stay out of scope.

Yes. A protected server with no connection to the management plane stays in enforcement. Upgrades, updates and changes to its known-good profile go in from physical media, such as a USB drive or CD. Plan for that physical step when you scope which plant servers stay off the network, and decide who carries the media and who approves what's on it.

Until a planned outage lets the patch in, Mimic checks each change against the server's known-good profile and stops unauthorized ones at the point of execution. Virtual Patching works in two forms, and both require baselining. Disruption blocks the specific mechanism an analyzed vulnerability depends on, so the exploit doesn't succeed. Containment limits what an exploit can do once it lands, so one safeguard can cover a whole family of exploits. It's part of Mimic's known-good enforcement approach.

Enforcement overhead is tunable, and you measure it on your own servers before you decide. Take a performance baseline on a pre-production MES or historian server, install Mimic and run the same tests your plant already trusts. Mimic decides inline, before the change executes. No reboots required, so plan the install for a window your plant already uses.