Which devices in your plant have published vulnerabilities, and which firmware fixes them.
Upload a CSV or Excel inventory (vendor, model, firmware). OT Patch Radar matches it against every CISA ICS advisory and the Known Exploited Vulnerabilities (KEV) catalog, and tells you which devices are affected, which are being actively exploited, and which version clears the most advisories. No sensors, no network scans: it runs on your computer and your inventory never leaves it.
Early version, looking for feedback. If you work with PLCs, RTUs, switches or SCADA and try it, I would really like to hear what works and what doesn't: open an issue or write to otpatchradar@proton.me. To hear about the launch (early access and 40% off the first year): join the waiting list.
One row per device, exploited first, with the version to update to
Every advisory behind a device, with the published range and the vendor's fix
Evidence of how each finding was handled: owners, decisions with justification and an audit trail
- Vendor: names are normalised (
Allen-Bradley=Rockwell Automation); different companies with similar names are not mixed (Siemens≠Siemens Energy). - Model: similarity with extra weight on model numbers (
1200,M580), plus known family names (M580→Modicon M580). An order number (e.g. Siemens MLFB) gives an exact match. - Version: reads CSAF ranges (
<V4.7,>=13.4.1|<=13.4.3,>=V4.5.0<V4.5.2), letter revisions and per-branch fixes (<v36.011_v35.013_v34.014). - It never guesses. If the firmware is missing or a range is free text, the finding says "check version".
- Priority: actively exploited (KEV) first, then ransomware use, then CVSS.
You need Python 3.10 or later (python.org; tick "Add python.exe to PATH" when installing). An installer is planned.
- Download this repository: green Code button → Download ZIP, and unzip it.
- Open PowerShell in the unzipped folder (the one containing
app.py) and run:
python -m venv .venv
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
.\.venv\Scripts\Activate.ps1
pip install -r requirements.txt
python -m radar.cli refresh
python app.py- Open http://127.0.0.1:5000, upload
sample/demo_inventory.csv(fictional data) and press Import and scan.
macOS / Linux: same steps with source .venv/bin/activate.
To use your own inventory: one row per device with at least vendor and model; firmware is strongly recommended, and order/part number, client, site and tag are optional. Column names can be in English or Spanish. Only use inventories you are allowed to use, and share only what is needed (no IP addresses).
| Free | Pro | Integrator | |
|---|---|---|---|
| Clients or plants | 1 | 5 | Unlimited |
| Matching against CISA advisories and KEV, by-device view, printable report, CSV | ✓ | ✓ | ✓ |
| Audit trail recorded | ✓ | ✓ | ✓ |
| Evidence report (NIS2) and audit-trail export | – | ✓ | ✓ |
| Email alerts for new advisories | – | ✓ | ✓ |
| Your own brand on screens and reports | – | – | ✓ |
The Free plan works as downloaded. Paid plans are not on sale yet: join the waiting list. Licenses are verified offline on your computer.
- Data sources: CISA ICS advisories in CSAF format and the CISA KEV catalog.
refreshdownloads only when CISA publishes something new. Not affiliated with or endorsed by CISA or DHS. - No findings does not mean no vulnerabilities. Some vendors publish only on their own portals, and matching depends on how the inventory names each device. Always confirm with the vendor advisory before acting on a production system.
- Local, single user. There is no login: run it on your own computer and do not expose it to the internet.
- Interface in English and Spanish (EN | ES in the header). Advisory texts are shown as CISA publishes them.
- Optional: model aliases for internal names (
sample/model_aliases_example.csv→data/model_aliases.csv), email alerts (python -m radar.cli check --notifywithSMTP_*settings, Pro).
python -m unittest discover -s tests -t .Created by FBJ · © 2026 FBJ. All rights reserved. Free to use under the terms of the Free plan in
LICENSE; third-party software and data keep their own licenses (THIRD_PARTY_NOTICES.md).
Vendor and product names are trademarks of their owners and are used only to identify products.