feat(ics): dynamic Modbus/TCP probe for PLC/SPS devices (#172)

docs/guide/plc.md

@@ -76,3 +76,22 @@ guard-aware), cleartext/insecure communication (CWE-319), insecure protocol port
 The **SBOM** view lists the CODESYS libraries (`pkg:codesys/<name>@<version>`) and
 the runtime; matching runtime components (e.g. the `Cmp*` / `3SLicense` libraries)
 surface real CODESYS advisories as CVE alerts.
+
+## Dynamic testing — ICS protocol probe
+
+Beyond the static analysis, Certifai can **probe the running device** over
+industrial protocols. Attach a **Live URL** artifact (the device host / WebVisu
+URL) to the PLC/SPS target and enable the **ICS Probe** scan.
+
+The probe is **read-only** — it never writes to the live process. It currently
+speaks **Modbus/TCP** (port 502): it confirms whether the device answers
+unauthenticated Modbus requests and reads its device identity (vendor / product /
+revision). Because Modbus/TCP has no authentication or encryption in the protocol,
+a reachable endpoint that answers is reported as an exposed control interface
+(CWE-306). OPC UA and EtherNet/IP probes are planned.
+
+::: warning
+The ICS probe connects to the live device. It is **opt-in** (off by default) and
+should only be run against targets you are authorized to test. It performs reads
+only, never writes.
+:::