Reality Over Theory
Brownfield-first execution
Built for existing plants, constrained networks, and mixed vendor environments instead of greenfield assumptions.
Consequence-Based Security
OT Security Built for Real-World Consequences
Assessment-ready consulting and low-friction OT tooling for visibility, risk assessment, and controlled testing without production drag, heavyweight agents, or vendor lock-in.
MarlinSpike beta demand is active. Free seats are capped and fulfilled. New access requests are routed to the paid waitlist and practitioner licensing path.
Why River Risk Partners Exists
Traditional IT security assumptions break down in plants, substations, mines, and remote industrial networks. River Risk applies consequence-based security so teams can act on what matters operationally.
Uptime & Safety First
OT priorities stay intact
Preserve production and safety while building visibility, evidence, and response options for operators and plant leadership.
Actionable Independence
Operators keep sovereignty
Practical tooling and workflows for plant teams, assessors, and engineers who need results without heavy outside dependencies.
Software Ecosystem
MarlinSpike is the core product. Companion tools extend visibility, flow inspection, and emulation while controlled offensive testing remains restricted to vetted engagements.
Core Product
MarlinSpike
Passive OT topology mapping with Purdue level auto-classification and industrial protocol deconstruction from a single pcap. Zero external dependencies.
Companion Tooling
Prism + Artifice
OpenFlow visualization for deep inspection and a complete network emulator for planning, training, and DPI testing in controlled scenarios.
Controlled offensive testing capability is available only through vetted inquiry and authorized consulting
engagements. Public details are intentionally limited.
How MarlinSpike Works
Single pcap -> classify -> assess -> report
MarlinSpike is built to get operators and assessors to a usable outcome quickly. Start with captured traffic, generate classification context, and move into assessment-ready outputs without heavy deployment overhead.
1
Input
Single pcap ingest
Upload or load a packet capture from a controlled collection workflow.
2
Analyze
Protocol + asset classification
Extract vendor, protocol, service, and Purdue-level context from observed traffic.
3
Assess
Risk assessment workflows
Apply practical IEC 62443-informed assessment context in the practitioner/offline path.
4
Output
Report + action path
Generate outputs that support assessor decisions, remediation planning, and operator follow-through.
The live demo shows the interface and classification workflow. Practitioner and site licensing unlock the
offline, assessment-ready path for real operational environments.
Workflow Snapshots
Public Pricing for Qualified Buyers
Pricing is shown publicly to reduce noise and route serious users into the correct path: limited web access, practitioner offline licensing, or multi-site discovery.
MarlinSpike Live
Web-Based Scanners
$29-$100
/ month
Educational and lead-in tiers for sanitized capture uploads. No live capture, no local execution, and no assessment-ready reporting.
- Basic: 50MB uploads, 10 generations / month
- Pro: 200MB uploads, 10 generations / month
- Power: 200MB uploads, unlimited generations (fair use)
Flagship Offline License
Practitioner License
$1,000
/ year
Full offline Docker or bare metal deployment with live capture, passive mapping, protocol deconstruction, and IEC 62443 risk asset assessment workflows.
- Built for field assessors, consultants, and plant engineers
- No permanent production footprint required
- Professional ROI vs. legacy enterprise platforms
Multi-Site Deployment
Site License
Contact Us
bundled discovery
For organizations needing multi-site rollout, training, and consulting integration. Pricing is handled by discovery to scope deployment, support, and operational constraints.
Market Validation
Demand is real and visible
"Want to get my hands on this tool."
Launch momentum
Recent public release generated 140+ reactions and 31 comments from industrial security and controls practitioners. Messaging is now shifting from beta demand to paid access.
Training credibility
River Risk also validates expertise through custom OT security training delivery and published thought-leadership, including consequence-based security framing.
Fast Path
How buyers engage
1
Submit access request
Route to the correct tier: Live, Practitioner, Site, or consulting-led evaluation.
2
Technical qualification
Confirm environment, use case, and whether cloud upload restrictions require offline licensing.
3
Operator-safe onboarding
Deliver access path with clear boundaries, deployment guidance, and escalation support as needed.