Contrarian Ventures Bets €7 Million on Indurex Plant Safety

Indurex raised €7 million to protect safety systems on October 22, 2026. The Amsterdam company is selling software that reads trip logic, not another map of plant networks.

Contrarian Ventures led the round, with Axeleo Capital and Curiosity in it. The money is for research and a first commercial push across Europe and the Middle East. The United States and Asia-Pacific come later. The cheque is small next to the OT platforms already in billion-dollar deals. The wager is that those platforms still cannot see a changed trip setting.

A Climate Fund Bets on Plant Trip Systems

Contrarian Ventures is a climate-tech firm founded in 2017, with bases in London, Paris and Vilnius. Its own description of the firm is pre-seed and seed, aiming to write the first cheque, and it says it has backed more than 90 founders in energy and industry. That is an odd lead for a cyber round until the physical thesis is on the table.

Rokas Peciulaitis, founder and managing partner, tied the deal to plants going online as grids, factories and pipelines electrify. He argued that an alert is useless if nobody can say what it does to the process behind it, and that Jalal Bouhdada, Indurex’s founder and chief executive, is rare in knowing both the packet and the plant.

Electrification is putting more critical infrastructure online, and attacks on it are rising, with the damage felt in the physical world: cold homes, dark hospitals, water that stops flowing. Detection alone is no longer enough. Operators need to understand what an alert means for the physical process behind it. Having built and sold a company in this space, Jalal knows what operators across oil and gas, power and manufacturing need, which makes Indurex one of very few companies that understands both the network packet and the physical process.

Rokas Peciulaitis, Founder and Managing Partner, Contrarian Ventures

The other two backers sit in the same early-stage band. Curiosity, founded in 2021 in Amsterdam by Herman Kienhuis and Maurice Beckand Verwée, backs European AI software and lists 24 companies and €50 million under management. Axeleo Capital is a European software and greentech firm with €300 million under management, 18 people, more than 70 investments and more than 20 exits, including Alsid, later bought by Tenable.

The round did not land as a challenge to the OT platforms that already trade in the billions. It landed as a climate fund buying the process layer those platforms never turned into a product. Harm in this market shows up as a dark hospital or water that stops, which is why a climate cheque can sit on a cyber cap table without a category stretch.

What SafeGuard AI Reads Inside a Live Plant

SafeGuard AI pulls live data from the computers that run a process, the trip systems that shut it down, the historian that records what happened, the alarm desk, and the IT security stack already in the room. AI agents then flag odd behaviour and engineering drift so a person still makes the call. Indurex calls that mix Engineering Intelligence.

Traditional OT tools were built to show what is plugged into the network. Plant risk also lives in whether protection settings and safety functions still match the design. A changed setpoint, a bypass left in, or a safety function that no longer matches the paper file can look quiet on a packet capture and still be the event that trips a unit, or fails to.

THE PLANT DATA SAFEGUARD AI INGESTS

• Distributed control systems: The day-to-day computers that run flows, temperatures and levels on the unit.
• Safety instrumented systems: The separate trip gear that shuts a process down when a reading crosses a hard limit.
• Historians: The long record of what the plant actually did, used to spot drift against design.
• Alarm management: The desk that already drowns operators in noise, which the platform tries to cut by adding process context.
• IT security tools: The existing cyber stack, so a network alert can be read against the physical state of the unit.

The company says that mix produces three kinds of work, not one dashboard. Fewer trips and faster cause-finding sit under operations and safety integrity. Detection that is scored against physical impact sits under cyber. Automated evidence against cyber and functional safety rules sits under cost and compliance. A head of OT operations at a global manufacturer, quoted by the company, said the platform correlates OT, safety and engineering signals into one view and has cut noise on the way from detection to action.

Human review stays in the loop. Bouhdada has said the AI is meant to stay inside each client’s boundary, with customer data held in a controlled deployment. That is a trust pitch as much as a model pitch, because a plant will not feed trip logic to a tool it cannot fence.

Bouhdada Already Sold an OT Firm to DNV

Bouhdada is not a first-time industrial-security founder. The Indurex site says he has more than 20 years in industrial cybersecurity, safety and critical infrastructure. He founded Applied Risk, started The NightWatch Conference, sits as a board director at EE-ISAC, and contributes to World Economic Forum cyber-resilience work. Maarten Oosterink, co-founder and chief operating officer, comes from the same OT, process-safety and cyber seam. At launch Oosterink said the aim was to make the connected world safer by bridging the digital and physical.

Applied Risk was established in 2012 in Amsterdam as a specialist in industrial cyber work for energy, maritime, pharmaceuticals, transport, mining, utilities and manufacturing. On November 24, 2021, DNV, the Norwegian assurance and risk group, said it would DNV acquired Applied Risk in November 2021 and fold it in under the DNV brand. Terms were not disclosed. Remi Eriksen, then DNV’s group president and chief executive, said connected control systems had put wind farms, oil and gas kit, ships, factories and medical gear at higher risk, and that life, property and the environment were at stake. Liv Hovem, then chief executive of DNV’s Accelerator, called the deal a first step toward a larger cyber practice beside DNV’s team of nearly 12,000 industrial domain experts.

FROM APPLIED RISK TO THE €7 MILLION ROUND

1. 2012: Applied Risk is established in Amsterdam as an industrial cyber specialist.
2. November 24, 2021: DNV announces it will acquire Applied Risk and operate the combined cyber practice under the DNV brand.
3. January 27, 2026: Indurex comes out of stealth in Amsterdam with Bouhdada as chief executive and Oosterink as chief operating officer.
4. 2026: Gartner names Indurex a Cool Vendor in its Coolest Vendor Innovations in Cyber-Physical Systems Security report.
5. October 22, 2026: Indurex raises €7 million, less than nine months after the stealth exit, led by Contrarian Ventures.

The sequel is a product company, not another services shop. Applied Risk sold assessments, response and training into the same sectors Indurex now names. SafeGuard AI is the attempt to put that plant literacy into software that sits on DCS and SIS data. Peciulaitis’s line about a founder who already sold in this space is the whole investment memo, compressed.

The Trip Logic Lived Off the Network Map

Plant cyber programs spent a decade on passive network monitoring because active scans can crash a controller. That work found assets and odd traffic. It did not, as a rule, ask whether the trip function still matched the safety file. Bouhdada has put the gap in plain language: the older OT tools stayed on the network and never went into the process or the safety element.

Cyber defenses in these critical sectors have focused solely on the network. We focus on the core industrial data itself: the engineering, process and safety signals that determine whether a plant is operating within safe limits.

Jalal Bouhdada, Founder and CEO, Indurex

Indurex’s announcement cites the SANS Institute’s 2025 ICS/OT security survey for the load on that gap. The figures describe a messy year in industrial control, not a single outbreak, and they are why a safety-layer pitch can be sold beside a network platform rather than instead of one.

WHAT THE 2025 SANS ICS SURVEY FOUND

• Incident rate: 22% of industrial organisations had an ICS or OT cyber incident in the prior year.
• Operations hit: 40% of those incidents disrupted operations, which is a subset of the 22%, not of every plant in the survey.
• Slow recovery: Nearly 20% of those incidents took more than a month to clean up.
• Leading path: A separate SANS survey found 58% of respondents named IT compromises spreading into OT networks as the leading initial attack vector.

IT-to-OT spread is exactly the path a network tool is built to watch. The Indurex claim is the next hop: once the attacker, or a sloppy engineer, is inside the process, the question becomes whether protection settings still match design. Gartner’s Cool Vendor note in 2026 sits in that seam. Bouhdada said operators now want to know whether safety systems can still be trusted, and whether an engineering change is maintenance or the first step of an attack. Cool Vendor is an analyst spotlight, not a market-share ranking, and the company is still early.

€7 Million Meets the OT Giants

The 2026 OT market already had its late-stage money. Claroty, which sells a cyber-physical protection platform, secured $150 million in Series F funding on January 22, 2026, led by Golub Growth. Accenture on June 18, 2026 agreed a majority stake in Dragos plus the purchase of runZero and NetRise in an OT security package valued at $4.175 billion. The Dragos majority closed on September 16, 2026. Those are different products and different stages from a €7 million Amsterdam round. They set the scale Indurex is walking into.

HOW THE 2026 OT CHEQUES COMPARE

A seed-scale raise does not buy a seat at that table. It buys time to prove that SIS configs, historian drift and safety-function changes are a product, not a feature request on a network console. If the incumbents add the same ingest, the window narrows. If they stay on packets, assets and exposure, the climate fund’s memo still has room. Indurex already says the platform can sit beside third-party OT security tools rather than rip them out, which is the only realistic path against installed Dragos and Claroty estates.

Early customers, the company says, run from mid-sized energy and manufacturing firms to large global enterprises. Utilities and data-centre operators are named as the next hunt. That mix matters because a data hall and a gas terminal do not share a culture, but they do share trip logic, alarm floods and auditors who want files.

Why Safety Files Became a Cyber Budget Line

Plant owners already run two paper worlds. Functional safety, under IEC 61511 and IEC 61508, is the lifecycle for the trip system. Industrial cyber, under IEC 62443, is the lifecycle for the control system. NIS2 in Europe, NIST’s Cybersecurity Framework, and NERC CIP in North American bulk power add reporting on top. Indurex is selling automated evidence against that stack, which is how a safety file becomes a cyber budget line without a new headcount war between the CISO and the technical safety team.

THE RULES SAFEGUARD AI IS BUILT TO EVIDENCE

• IEC 62443: The industrial automation cyber standard that asset owners already use to structure zones, access and a security program.
• IEC 61511 and 61508: The functional-safety rules for trip systems, including a security look at the SIS itself.
• NIS2: The European duty on essential and important entities to manage cyber risk and report incidents, including in energy, water and manufacturing.
• NIST CSF and NERC CIP: The U.S. framework and the bulk-electric rules that utilities already audit against.

Functional safety rules already ask for a security risk assessment of the trip system. Cyber rules already ask owners to keep safety gear from being poked by non-safety networks. The gap Indurex is selling is operational: those duties still live in separate registers, separate vendors and separate outages. Automated reporting is the wedge that lets a process-safety engineer and a SOC analyst look at the same deviation. It is also the part of the pitch most likely to survive if the AI-agent language ages badly, because auditors want files either way.

Bouhdada has described a “tsunami” of rules as a third pillar beside uptime and cyber, next to operational excellence and resilience. That is a European founder talking to European and Gulf operators first, where NIS2 and IEC work are already on the calendar. The same evidence pack is what he will need if the later U.S. push is to mean more than a sales hire in Houston.

Europe and the Gulf Before the United States

The spending plan is narrow on purpose. Research and commercial build-out come first in Europe and the Middle East. The United States and Asia-Pacific are named as later markets, not this round’s theatre. That matches the founder’s history. Applied Risk’s work sat across Europe, the Middle East and Asia, and Amsterdam remains the headquarters. The about page is already listing machine-learning, security and software engineering roles, which is how a €7 million R&D line looks on a careers board.

Indurex came out of stealth on January 27, 2026. The raise closed less than nine months later. In January the company was still talking about a pre-seed process and staying lean. The October cheque is that process landing, with a climate fund in the lead and two European software funds beside it. The product still has to prove that a trip setting and a safety function can be watched at plant tempo, with a person in the loop, without adding another alarm flood.

The bet is now funded, not won. Contrarian Ventures paid for a layer the OT giants have not productized, in the hands of a founder who already sold the services version of this market. Europe and the Gulf get the first call. The trip systems will decide if the second company is worth more than the first.