IT, Security & Deployment.

GENESIS is an on-premises operational intelligence system for factory floors. It connects — read-only — to the OT and IT systems a plant already runs, identifies production deviations as they happen, explains the likely cause, and recommends what to do about it. Everything runs on a single appliance inside the plant. Nothing leaves the premises.

This page answers the questions IT and security teams ask first: where the system sits on the network, what hardware is involved, how it connects to plant systems, how data is stored and retained, and what — if anything — has to cross the firewall.

GENESIS is deployed as a self-contained system in the industrial zone, at Level 3 of the Purdue model (site operations / control room), alongside MES and SCADA — not in the cell/area zone, and not in the enterprise zone.

• All OT telemetry into GENESIS is read-only. No flow ever points from GENESIS back down into PLCs, tools, or sensors.
• Nothing crosses the IDMZ into the enterprise zone or the internet in the real-time path. Alerts, findings, and dashboards stay inside the plant network, delivered to operator mobile devices and manager browsers.
• Any enterprise analytics exchange (Databricks, Microsoft Fabric, Power BI, or bespoke ML tooling) is non-real-time and separately decision-gated through the IDMZ: aggregated findings, KPIs and logs out; trained models and reference data in, offline. It is deliberately kept off the real-time detection and alerting path.

Serious AI supplies the hardware. GENESIS ships as a pre-built appliance that we bring, install, and commission. You do not procure, spec, or build server hardware, and there is no client software to distribute — every surface is served from the appliance to a standard browser or phone on the plant network.

The GPU and memory are fixed by the platform, not by plant size. Storage is sized from three numbers: production lines in scope, approximate signal/tag count per line, and sample rate per signal. The final configuration is confirmed at order time.

What you provide for it

• Rack space in the control or server room.
• Power and cooling to standard server specification.
• A network drop on the plant network.

The appliance lives inside your plant, on your network, behind your firewall, and under your physical control. If your policy requires the hardware itself to be an asset you own rather than a supplied appliance, that is straightforward to accommodate — raise it early.

GENESIS reads from the systems you already run — no new instrumentation is required to start. An orchestration layer scans the OT network, builds connector configurations, deploys the matching connector, and health-monitors it. Site-specific integration lands as configuration and connectors, never as per-customer branching in core code. That is a hard architectural rule, and it means a new source type is a bounded, repeatable piece of work rather than a project risk.

Direction of traffic in every case: outbound from GENESIS to the source. No source needs to reach into GENESIS. What your OT team provides: read-only accounts and endpoints for the sources in scope, and firewall rules permitting GENESIS-to-source traffic on the relevant ports.

Documents and files — optional, high value

GENESIS can ingest your existing plant knowledge — equipment manuals, maintenance and repair logs, SOPs and work instructions, quality and 8D reports, shift notes — so that both its analysis and its question-answering surface can draw on it and cite it.

• Ingestion paths: on-demand upload by engineers and operators, or pointing GENESIS at an existing read-only plant network share.
• Formats: text and PDF, including OCR for scanned pages. Complex image-based schematics and CAD drawings are outside current scope.
• Structured files: CSV, Excel, and exported reports are mapped onto the plant model so the data becomes queryable alongside live telemetry.

GENESIS is served entirely from the appliance. There is no client software to distribute and no external service for users to reach. Three surfaces, all inside the plant network:

Identity. GENESIS integrates with Microsoft Entra ID, with an administrator/user role split so that configuration is restricted to nominated staff. What you provide: an Entra ID app registration and the group mapping for those two roles.

Entra ID is not a prerequisite. GENESIS can run its own self-contained user and role management, disconnected from any enterprise SSO, if you prefer to keep the appliance off the corporate identity plane. Other enterprise SSO providers can be discussed. Who receives which notification is configurable, not fixed.

Everything GENESIS reads and produces is stored on the appliance, on your premises. There is no cloud data store anywhere in the system. Four classes of data sit on the appliance and nowhere else:

• Plant data read from your systems (§04).
• The plant model and your team’s corrections to it — the corrections are authoritative.
• System output and its audit trail.
• Documents and files you have provided, indexed so they can be searched.

Alongside these: configuration, and a change history over it.

Retention. GENESIS holds full-granularity data for a configurable window — typically around 60 days — and then rolls it up into aggregates. GENESIS is not an enterprise data lake and does not attempt to be one: it references MES, ERP, and the historian rather than absorbing them. Long-horizon raw retention stays in your historian and database systems, which GENESIS reads from.

• No actuation path. GENESIS never writes to OT equipment (§04). Architectural, not configurable.
• Internal credential boundary. The analysis components inside GENESIS hold no direct credentials to the underlying data stores. They reach data only through a constrained, audited interface, and have no filesystem access, no ability to execute operating-system commands, and no ability to initiate work outside that interface. This is enforced by the runtime rather than assumed, and it holds even in a single-appliance deployment.
• No egress in the real-time path. The appliance is airgap-capable; detection, investigation, and all AI inference run on-box. No external AI service is called (§08).
• Identity. Entra ID with an administrator/user role split, or GENESIS’s own self-contained user and role management (§05).
• Physical control. The appliance lives inside the plant, on your network, behind your firewall, under your physical control (§03).

Operating-system hardening and patching

During commissioning, Serious AI brings the OS fully up to date with all security updates and patches, so the appliance goes live on a current, patched base.

After commissioning, patching is a handover decision: either your IT takes over OS patching as it would for any Linux host in the plant, or Serious AI maintains it under an ongoing service arrangement. This is settled before go-live, since it determines who holds root on the box and who owns the patch cadence.

For normal operation: none. GENESIS is designed to run airgapped. The real-time path — reading telemetry, detecting, investigating, alerting, logging — has no internet dependency and makes no external service calls. Your plant firewall stays closed by default; every row marked optional below is an explicit, separately agreed carve-out you control. Nothing opens implicitly.

Commissioning (first ~4 weeks)

External internet access from the appliance is expected during commissioning. Our engineers are on site, applying and deploying changes daily, and the appliance needs a path to our container registry and model store to receive them. The appliance is pre-staged before shipment so nothing large has to come over your network — but this phase does assume a working outbound path rather than an offline-only one.

Steady state

No external access is required for the system to function. The only rules required are internal, plant-side: GENESIS outbound to each data source on the relevant ports, plus operator devices and manager browsers reaching GENESIS on the plant network.

Ongoing support (post-commissioning)

One outbound, audited, revocable channel for software updates and engineering support: outbound-only to a single destination, off by default and enabled plant-side, named individuals with MFA, full session logging, and session recording available on request. This is the medium for support and troubleshooting once our engineers are no longer on site.

GENESIS is commissioned with your team, not delivered over the wall. The deployment runs in three phases:

People we work with during deployment

The SME step matters: GENESIS discovers the available signals and proposes a model of the plant — lines, stations, assets, signals, and how they relate. A person who knows the line reviews and corrects that model, and their corrections are authoritative.

What accelerates a deployment

• An early data export from the historian or tool databases — lets us author the plant model and pre-warm baselines before arrival.
• A written source inventory: what each plant application exposes (database, REST API, file export), tool controller makes and models, PLC types and protocols.
• Network preparation started early — drop, IP allocation, and internal firewall rules carry lead time in a plant environment and cannot be compressed once we are on site.
• Your existing standard for OEM/vendor remote access, if one exists — onboarding GENESIS to an already-approved path is faster than agreeing a bespoke rule.