Read-only OT vulnerability scanner. Discovers industrial controllers, fingerprints firmware, matches against the CISA ICS Advisory feed (3,600+ advisories), and produces a self-contained HTML report.

No agent. No cloud. No telemetry. No writes to OT devices.

make deadband           # CLI only
make deadband-web       # CLI + embedded web UI

# Refresh the advisory database (one-time)
bin/deadband --update

# Scan a network — auto runs every protocol concurrently
bin/deadband --cidr 10.0.1.0/24

# Single-protocol scan
bin/deadband --cidr 10.0.1.0/24 --mode haas

# Check a pre-collected inventory
bin/deadband -i devices.csv --min-cvss 7.0 --prioritize

# Export an HTML report for a customer engagement
bin/deadband -i devices.csv \
  --site-name "Acme Manufacturing" \
  --out-format html -o acme.html

# CI gate: exit 1 if anything HIGH-confidence matches
bin/deadband -i devices.csv --min-confidence high

Every probe is read-only by construction. None require authentication. Tests assert no unexpected bytes hit the wire.

--mode auto (default) runs all of the above concurrently and merges results.

BACnet/IP lives behind a build tag — go build -tags bacnet ./cmd/deadband — and is excluded from default builds.

Fanuc FOCAS2 (TCP/8193) is stubbed pending live-device access; the FTP banner-grab handles common fingerprinting today.

--out-format html produces a single-file report with no external resources. Everything is inline — open it on an air-gapped laptop, print it from a browser, attach it to an email.

Contents:

• Cover with site name (--site-name), generation timestamp, advisory DB version
• Executive summary (vulnerable / potential / OK / no-match) with a stacked bar
• Top risk items sorted by KEV + CVSS + EPSS
• Device assessment table with status badges
• Per-device vulnerability detail with CVEs, KEV/ransomware flags, remediation links
• Optional compliance mapping with --compliance iec62443,nist-csf,nerc-cip
• Print stylesheet — browser Print → Save as PDF gives a clean light-mode export

A regression test (pkg/output/html_test.go) asserts the rendered template carries zero external references.

bin/deadband serve         # API + UI on :8484

Four panes:

• Dashboard — exposure summary, site risk overview, top findings, Export Report button
• Scan — kick off discovery against a CIDR with any mode
• Report — sidebar action that downloads the HTML report
• Settings — advisory DB status + Update Now

Development with hot reload:

go run ./cmd/deadband serve   # API on :8484
cd web && npm run dev          # Frontend with /api/* proxy

--update resolves its source like this:

bin/deadband --update                                # default: snapshot + fallback
bin/deadband --update --source github                # force per-file
bin/deadband --update --source ./local-csaf-mirror   # air-gapped

For air-gap, copy the resulting database between hosts:

scp ~/.deadband/advisories.json analyst@isolated:~/.deadband/

CSV:

Scanned IP,Device Name,Ethernet Address (MAC),IP Address,Product Revision,Serial Number,Status,Uptime
172.16.12.21,1756-EN2T/D,5C:88:16:C4:26:3C,172.16.12.21,11.002,D060925B,Run,"206 days, 03h:12m:20s"

JSON:

[{"scanned_ip":"172.16.12.21","device_name":"1756-EN2T/D","product_revision":"11.002"}]

• Read-only probes — only documented identification reads or banner grabs
• No runtime internet calls — advisory data is fetched ahead of time via --update
• No authentication, no credential storage, no writes
• Safety banner on every entry point
• Public CISA data only (TLP:WHITE)

cmd/deadband/main.go       CLI entrypoint
pkg/advisory/              Advisory DB load/save
pkg/asset/                 Asset inventory + vulnerability state
pkg/cli/banner.go          Safety banner
pkg/discover/              Active discovery (CIP, S7, Modbus, MELSEC, FINS, SRTP, OPC UA, Haas, Fanuc)
pkg/inventory/             CSV / JSON / flat parsing
pkg/matcher/               Vendor, model, version matching
pkg/output/                Text, CSV, JSON, HTML, SARIF writers
pkg/server/                HTTP API + report export
pkg/updater/               CISA CSAF fetch (snapshot + per-file)
web/                       Next.js frontend

MIT