Compare Trout & Cyolo
Both run on-premise. Both are agentless. The difference is what sits in the path: software you host somewhere, or an appliance with compute next to the assets.
The problem
OT assets cannot run agents and the plant cannot take downtime, which has produced a generation of secure-access products that broker connections without touching the device. Cyolo is one of the good ones. But brokering access solves half the problem. Once a session is allowed, the plant still needs services near the assets, and a software broker has nothing on the floor to run them on.
Trout Access Gate
A physical appliance cabled into the network, with compute in the data path. It brokers every session with identity and protocol-level policy, and because it is a computer sitting next to the assets, it also runs the services they need: protocol gateways, DNS and NTP, file transfer, a local historian, an update server. One box, no agents, no re-addressing.
Cyolo
Software-based zero-trust access, deployed on-premise or hybrid, aimed squarely at OT. It authenticates users in front of legacy assets, supports MFA for devices that cannot do it themselves, and records supervised sessions. It is a real on-premise alternative to cloud ZTNA, and on access brokering the two products overlap heavily.
| Feature | Access Gate | Cyolo |
|---|---|---|
| Runs on-premise | ||
| Agentless for OT assets | ||
| MFA for legacy OT devices | ||
| Session recording and supervision | ||
| Physical appliance | Compute in the data path, at the asset | Software / VM deployment |
| Hosts services next to the assets | Protocol gateways, DNS/NTP, file share, historian | Brokers access; no compute at the asset |
| Network segmentation | Overlay enclaves, no VLAN redesign | Access-level, not network-level |
| Automatic asset inventory | Discovery of connected assets, not a full inventory | |
| Works with no internet at all | Fully air-gapped operation | On-prem deployment; management plane varies |
| OT protocol awareness | ||
| Compliance evidence generation | IEC 62443, NIS2, CMMC mapping | Access logs and audit trail |
| Deployment unit | One box, cabled to two ports | Software to install and host |
| Deploys without re-cabling or re-addressing | Assets keep their IP, gateway and VLAN; inserted with a routing or DNS change | Software, so nothing to re-cable either |
Compute on the wire
Cyolo is software you host elsewhere on the network. Access Gate is hardware in the path, so it can do work at the asset rather than only deciding who reaches it.
Services, not just sessions
With compute at the edge, Access Gate hosts what OT actually consumes: protocol translation, time, name resolution, file exchange, dashboards. A broker has nowhere to run them.
Segmentation included
Access control decides who connects. Segmentation decides what can talk to what once they are inside. Access Gate builds overlay enclaves without touching VLANs, so lateral movement is contained by default.
Access Gate vs Cyolo FAQ
Access control, segmentation, protocol gateways and compliance evidence in a single on-premise appliance.
No. Cyolo deploys on-premise or hybrid, which is what makes it a closer comparison to Access Gate than cloud ZTNA products. The distinction here is software versus a physical appliance in the data path, not cloud versus on-premise.
If you want identity and MFA in front of legacy OT with no hardware to rack and ship, software is lighter to roll out across many small sites. Cyolo also has a mature supervised-session experience for overseeing vendor work.
Agentless describes what happens on the asset. Compute on the wire describes what happens in the path. Access Gate is a computer between your assets and everything else, so it can enforce, translate protocols and host services in one place. Software that brokers connections cannot do the last two.
Yes. The bastion is built in. Vendors reach a named asset through a proxied session with MFA and recording, with no VPN tunnel into the production network and no separate jump host to patch.
No. Assets keep their IP address, gateway and routing. Access Gate is inserted with a routing or DNS change and represents each asset by an overlay twin, so the underlay is untouched.