SigaML2 is a multi-layer machine learning OT cybersecurity solutions suite designed for early threat detection and incident response during OT cyber-attack expression phases. It consists of three components: **SigaGuard – Threat Detection for Critical OT Systems** Continuously monitors raw operational data from industrial processes, providing an unfiltered view of system behavior. Analyzes process-level data in real time to detect anomalies that traditional IT-based systems may miss. **SigaGuardX – Early Threat Detection** Classifies events as either operational events or OT cyber breaches using multiple AI models. Compares detected events against the MITRE database of known attacks. Runs comparisons between Level 0 and Level 1-4 data to identify potential False-Data Injection (Stuxnet-like) attacks in real time. **Siga-PAS – Process Attack Simulation** A software-based simulation tool that replicates real-world OT attack scenarios using simulated anomalies. Enables organizations to prepare for and respond to OT-specific threats without disrupting ongoing operations.