A cyber security appliance, comprising: an operational technology module configured to receive data on an operational technology network from i) a set of probes, ii) by passive traffic ingestion through a location within the network, and iii) any combination of both, where the operational technology module is also configured to reference i) one or more machine-learning models, using machine-learning and artificial intelligence, Al, algorithms, that are trained on a normal pattern of life of users of the operational technology network, ii) one or more machine-learning models, using machine-learning and Al algorithms, that are trained on a normal pattern of life of devices in the operational technology network, and iii) one or more machine-learning models, using machine-learning and Al algorithms, that are trained on a normal pattern of life of controllers in the operational technology network; and a comparator module configured to cooperate with the operational technology module to compare the received data on the operational technology network to the normal pattern of life of any of the users, devices, and controllers to detect anomalies in the normal pattern of life for these entities in order to detect a cyber threat, a gateway device with a single endpoint IP address, where the gateway device is configured to serve as a routing device to components in the operational technology network, a graphical user interface configured to display components of the operational technology network, where a plurality of operational technology components in the operational technology network do not have an IP address but are still individually identifiable and then displayable by the graphical user interface, and an autonomous response module configured to respond to counter the cyber threat in the operational technology network, and a user interface to program the autonomous response module. an operational technology module configured to receive data on an operational technology network from i) a set of probes, ii) by passive traffic ingestion through a location within the network, and iii) any combination of both, where the operational technology module is also configured to reference i) one or more machine-learning models, using machine-learning and artificial intelligence, Al, algorithms, that are trained on a normal pattern of life of users of the operational technology network, ii) one or more machine-learning models, using machine-learning and Al algorithms, that are trained on a normal pattern of life of devices in the operational technology network, and iii) one or more machine-learning models, using machine-learning and Al algorithms, that are trained on a normal pattern of life of controllers in the operational technology network; and i) one or more machine-learning models, using machine-learning and artificial intelligence, Al, algorithms, that are trained on a normal pattern of life of users of the operational technology network, ii) one or more machine-learning models, using machine-learning and Al algorithms, that are trained on a normal pattern of life of devices in the operational technology network, and iii) one or more machine-learning models, using machine-learning and Al algorithms, that are trained on a normal pattern of life of controllers in the operational technology network; and a comparator module configured to cooperate with the operational technology module to compare the received data on the operational technology network to the normal pattern of life of any of the users, devices, and controllers to detect anomalies in the normal pattern of life for these entities in order to detect a cyber threat, a gateway device with a single endpoint IP address, where the gateway device is configured to serve as a routing device to components in the operational technology network, a graphical user interface configured to display components of the operational technology network, where a plurality of operational technology components in the operational technology network do not have an IP address but are still individually identifiable and then displayable by the graphical user interface, and an autonomous response module configured to respond to counter the cyber threat in the operational technology network, and a user interface to program the autonomous response module.