Most AI-assisted OT tools produce confident output that may or may not be right, in a format that makes the difference invisible. Valkyrie is built around a methodology that labels what's observed, what's inferred, and what's assumed, shows what was considered and rejected, and names what wasn't done. So your team can tell a finding from an opinion.
We ran an experiment. The same network capture from a multi-vendor industrial facility, three AI-assisted assessment runs. Eighty percent of the application-layer traffic was on a non-standard port that Wireshark couldn't identify. All three runs produced confident vendor-specific protocol identifications. All three named different vendors. Only one was right. That is the AI in OT problem in a sentence.
In an AI-generated assessment, observed claims and assumed claims look identical on the page. The reader can't tell which findings rest on direct evidence and which rest on the model's best guess. That distinction is the difference between a finding and an opinion.
The first vendor identification that fit the data wins, even when the right answer is the second or third hypothesis. Without a considered-and-rejected register, there's no structural mechanism forcing the AI to check its work against the most plausible alternatives.
Comprehensiveness is impossible in OT. Six to eight vendors, twenty-five years of installations, protocols nobody documented. The honest answer is to name the gaps explicitly. Most AI-assisted deliverables hide them, because gaps sound like excuses. The reader pays the cost six months later.
Valkyrie wraps Claude in a section-by-section methodology that mirrors how senior OT analysts have always done assessment work. Each section produces an artifact the next section consumes. Each finding gets labeled with how the AI knows it. Each engagement ends with an explicit record of what wasn't done. Discipline is the difference between a finding and an opinion.
Scoping, asset discovery, architecture mapping, threat correlation, findings, framework mapping, deliverable. Each section produces validated output before the next one starts. Inference cannot outrun observation.
Observed claims come from direct evidence in the data. Inferred claims come from cross-correlation. Assumed claims come from sector-norm fill-ins pending confirmation. The reader can tell what rests on evidence and what rests on inference.
Every finding ships with the alternative explanations that were examined and why they were rejected. Every deliverable ends with an explicit section naming what wasn't done. Comprehensiveness is impossible in OT; the gaps just have to be visible.
Valkyrie ingests your PCAPs, asset exports, configs, and prior reports, then runs them through a section-by-section methodology that mirrors how senior OT analysts have always worked. The output is an assessment your team can hand to a controls engineer, a CISO, or a regulator without rewriting it first.
Every finding is labeled with how the AI knows it. Every finding ships with the alternatives that were examined and rejected. Every deliverable ends with an explicit section naming what wasn't covered. So when somebody asks "are you sure about this?" six months from now, the answer is on the page.
Observed, inferred, or assumed. The reader can tell what rests on evidence and what rests on inference.
Every finding ships with the alternative hypotheses that were examined and why they were rejected.
The same findings re-presented against IEC 62443, NIST 800-82, NERC CIP, or your internal taxonomy.
What wasn't accessed, what wasn't probed, what was filled in with sector norms. Documented, not buried.
The same analysis re-framed for engineers, executives, and auditors. One source of truth, three audiences.
Most tabletop exercises die in the first fifteen minutes because the scenario references a generic plant, a generic threat, and a generic response. Plant engineers check out. Operations stops engaging. The exercise produces compliance documentation, not operational improvement.
Valkyrie generates tabletops grounded in your specific environment. Your assets. Your segmentation. Your safety systems. Your real maintenance windows and reporting calendars. The scenarios pass the laugh test with the senior controls engineer in the room, which is what makes the exercise actually useful.
Built from your actual host and network data. References your real assets, real protocols, real segmentation choices.
No "the pump explodes in a way the pump physically cannot." Process consequences that hold up under scrutiny.
Pre-built decision points that map to your real recovery procedures, including the ones that depend on vendor support contracts and scheduled outages.
Electric utility content stays in electric utility exercises. Water treatment stays in water. No accidental copy-paste from someone else's industry.
Your generated scenarios become your library. Build once, run with different teams, refine over time.
Reasons across host and network data with ICS protocol awareness, including the messy edges and one-off vendor quirks other tools quietly skip.
Ask the questions you actually have, in the order you want to ask them, against the data you have. Customization is built in, not sold as a services engagement.
Add sites, add data, add scope. Valkyrie scales without doubling your headcount or your professional services bill. The work that breaks other platforms is what this one is built for.
Assessments. Tabletops. Executive summaries. Framework mappings. All from the same analysis. All shaped to what you need, not what a template expected.
Built by OT practitioners who pick up the phone, return the email, and ship the fix. You won't be the customer whose ticket is older than their last child.
That's the consistent reaction from practitioners who put Valkyrie next to whatever they bought two years ago. The visibility is wider. The workflows adapt. The outputs are usable on day one instead of after a six month professional services engagement.
This is not AI replacing OT expertise. It's AI finally building the tool your expertise deserves.
In critical infrastructure, the difference between a finding and an opinion is the discipline of the workflow that produced it. We build ours to fail loudly when it should fail loudly, because the alternative is to fail quietly in production.
The hardest one. The one you've been working around in Excel because the dashboard doesn't go there. The one your vendor said would be on the roadmap "soon."
30 minute call. Live demo. Your data or ours. You walk away with a clear data point either way.
We'll respond within one business day. Actually.