Kaspersky Industrial CyberSecurity for Networks Standard Server Upgrade

What is included in Kaspersky Industrial CyberSecurity for Networks Standard Server Upgrade?

Server component – Central site server that collects and correlates network events.
Traffic analysis – Deep packet inspection of more than 50 industrial protocols.
Intrusion detection – Rule sets covering more than 5000 known network attacks.
Asset discovery – Passive monitoring plus active polling of OT devices.
Web console and API – Browser interface plus REST API for external connectors.
Important – Endpoint protection is not included, KICS for Nodes covers hosts.

What are the main benefits of Kaspersky Industrial CyberSecurity for Networks Standard Server Upgrade?

Kaspersky Industrial CyberSecurity for Networks is the OT network traffic analysis and detection component of the KICS platform, and it runs as a site-level server that operators work with through a browser console. Management is central from that console, and the server can also be connected to Kaspersky Security Center through the administration plug-in.

No process impact – Analysis runs on mirrored traffic, not inline.
Learning mode – Interaction rules are generated automatically from observed normal traffic.
ATT&CK mapping – Incidents are mapped to MITRE ATT&CK for ICS techniques.
Vulnerability visibility – Flags known weaknesses in identified equipment with mitigation advice.
Existing tooling – Events are forwarded to the SIEM your SOC already runs.
Tested compatibility – Checked against more than 200 industrial systems and devices.

Which company size is Kaspersky Industrial CyberSecurity for Networks Standard Server Upgrade suitable for?

This is a product for organisations that actually operate an industrial or building-automation network with mirrored traffic available, not for a general office network. The decisive question is not headcount but whether you have a SPAN or TAP feed from your OT switches and someone who will read the alerts.

Does Kaspersky Industrial CyberSecurity for Networks Standard Server Upgrade meet the requirements of Swiss cybersecurity legislation?

The obligation applies to operators of critical infrastructure named in the revised Information Security Act, including energy and drinking water suppliers, transport companies and cantonal and municipal administrations, and it has been in force since 1 April 2025. Those organisations must submit an initial report to the Federal Office for Cybersecurity (BACS) within 24 hours of discovering a cyberattack, with 14 days to complete missing details. Within that 24-hour window the product helps mainly with the facts you have to state: it records the detected network events with timestamps, shows which devices communicated with each other, and lets you export the event data to a SIEM so the incident can be reconstructed later. What it does not do is decide whether an incident is reportable, produce the report, cover attacks that never touch the monitored network segments, or give you host-level forensics from the affected workstation. It also does not replace the internal escalation process that has to move an alert from the control room to the person who signs the report. This text is not legal advice, and the responsibility for assessing your own reporting obligation remains with your organisation.

Does Kaspersky Industrial CyberSecurity for Networks Standard Server Upgrade meet the requirements of European cybersecurity legislation?

No product creates compliance with the NIS 2 Directive, because the directive addresses the organisation and its processes rather than a single tool. NIS 2 requires measures in categories such as risk analysis and security policies, incident handling, business continuity and backup, supply chain security, network and information system security, procedures to assess whether the measures work, cyber hygiene and training, cryptography, and access control including multi-factor authentication. This product contributes to three of them in a concrete way: it delivers the asset inventory of the OT network, it provides continuous monitoring and intrusion detection as part of network and information system security, and it produces the detection and event data that incident handling depends on. It does not address backup and business continuity, cryptography, access control or multi-factor authentication, staff training, or supplier management, and it does not evaluate whether your own measures are effective. Those gaps have to be closed with separate tools and documented internal procedures.

What should you know about official assessments of Kaspersky?

Two official positions are relevant and both are still in force. The German Federal Office for Information Security (BSI) issued a warning against the use of Kaspersky virus protection software on 15 March 2022 under section 13 of the BSI Act, and the BSI confirmed again in early 2026 that it maintains this warning. Separately, the US Department of Commerce issued a Final Determination on 20 June 2024 that barred new agreements with US persons from 20 July 2024 and stopped signature and codebase updates as well as operation of the Kaspersky Security Network in the United States from 29 September 2024. Kaspersky states that it is a privately held company with no ties to any government, describes the German decision as politically motivated, and points to its relocation of data processing for European users to two data centres in Zurich in 2018. Independent and third-party assessments of the technology itself are unaffected by these decisions: Kaspersky Industrial CyberSecurity for Networks holds a TÜV AUSTRIA certification against IEC 62443-4-1 for its secure development process, and Kaspersky holds ISO 27001 and SOC 2 Type II certifications. In practice the warnings matter most if you sell to or operate on behalf of public bodies, if you have a US parent company or US customers, or if your own customers pass supply-chain requirements down to you in contracts. For a purely private industrial operator in Switzerland or the European Union there is no sales restriction, but the vendor question will come up in procurement reviews and it is better to have an answer prepared than to be surprised by it.

Norton vs. Kaspersky – Which antivirus program offers the best protection in 2025?
A side-by-side look at detection results and product scope for both vendors, useful background if the vendor question is being discussed internally.

Does Kaspersky Industrial CyberSecurity for Networks Standard Server Upgrade help with security questionnaires from large customers?

Yes, but only for the network and detection block of a typical questionnaire. It answers questions about whether you maintain an inventory of OT assets, whether industrial network traffic is monitored, whether you can detect unauthorised communication and known attack patterns, whether security events are logged and forwarded to a central system, and whether you have visibility of known vulnerabilities in your control equipment. It answers none of the following: malware protection on servers and operator workstations, patch management, encryption of devices, multi-factor authentication and access governance, backup and restore testing, security awareness training, and supplier risk management. The cheapest way to close the endpoint part of that list is usually KICS for Nodes from the same family, because it shares the management path and the reporting rather than adding a second console and a second support contact. Backup, access control and training will need separate answers regardless of which security vendor you use.

Data loss is expensive: How backups help you avoid outages
Explains the backup and restore questions that questionnaires ask about and that network monitoring does not answer.

Which limitations should you know before buying?

The most important regional point is that Kaspersky products may not be sold, updated or resold in the United States following the Final Determination described above, so this is not a workable choice for a group with US sites or US-based obligations. The product is passive by design: it analyses mirrored traffic and raises alerts, and although manual response actions and network access restriction exist, it is not an inline firewall and will not block an attack on its own. It needs a traffic feed, which means SPAN or TAP ports on your OT switches, and additional capture points in other segments are sold separately as Additional Sensor packages rather than being included with the server. Endpoint protection, patch management and encryption are outside its scope entirely. Finally, this article is the Upgrade variant of the Standard Server licence rather than a first-time base purchase, so confirm with the shop that your existing KICS for Networks deployment qualifies before you order.

Best antivirus? Why Windows Defender alone is not enough
Covers the endpoint protection layer that this network product does not include and that operator workstations still need.

Frequently asked questions about Kaspersky Industrial CyberSecurity for Networks Standard Server Upgrade

Which industrial protocols are actually understood?

Deep packet inspection covers more than 50 industrial protocols. Verified examples include the IEC 60870-5-101 and IEC 60870-5-104 telecontrol standards, IEC 61850 for substation automation with support for loading device and tag configurations, and BACnet for building automation systems.

Can it run in an isolated or air-gapped network?

Yes. Kaspersky positions the platform for distributed, air-gapped and isolated environments, and the update functionality can be activated with a license key file without contacting Kaspersky activation servers. You should still plan how database and rule updates reach the isolated segment.

Does it work together with Kaspersky Security Center?

Yes. An administration plug-in for Kaspersky Security Center is available, which lets you search devices and events in the databases of the KICS for Networks servers and receive updates through the Kaspersky Security Center Administration Server. This is useful when the same team already runs Kaspersky products on the IT side.