OT network segmentation. Without rewiring.
OT network segmentation puts each machine in its own zone and decides what may talk to it. Trout Access Gate does that from one on-premise appliance that plugs into the network you already have. Nothing is re-addressed, no switch is reconfigured, and production keeps running while the zones go in.
Last updated:
Trusted by leading companies
Why segmentation stalls on a live plant.
Most sites can describe the segmentation they want. The obstacle is that retrofitting it onto a running network means re-addressing equipment that cannot be taken offline. For the levels themselves and where the hierarchy stops matching real traffic, see <a href="/resources/purdue-model">the Purdue Model guide</a>.
The IT/OT boundary is the junction attackers aim for. It is also becoming more brittle with increased digitalization. Remote maintenance and cloud-bound data flows are prime examples of challenges to Purdue and segmentation efforts.
The result is that most sites stay flat or only partly segmented, not because operators do not know the model, but because retrofitting it onto a live network is too disruptive.
IEC 62443 Zones and Conduits.
In IEC 62443: a zone is a grouping of assets that share the same security requirements and a common Security Level. The standard defines four, from SL1 (protection against casual or coincidental violation) to SL4 (protection against a state-level actor with extended resources). A conduit is the controlled communication path between two zones.
The hard part is implementing conduits on a network that is already running, which traditionally means a VLAN redesign: re-addressing equipment, reconfiguring switches, and taking production down for the cutover. For most operators, that downtime is the blocker that keeps a flat network flat for another year.
Flat, VLAN, firewall zones, or an overlay.
| OT segmentation approach | Enforcement point | Rewiring / downtime | Lateral movement | Audit trail |
|---|---|---|---|---|
| Flat network | None | None | Unrestricted | None |
| VLAN only | Layer 2 isolation | Switch reconfig | Inter-VLAN routing open | None |
| Firewall zones / iDMZ | Zone firewalls | Re-addressing, downtime | Blocked at the zone edge | At the boundary |
| Access Gate overlay | Per-asset, identity-based | None (adjacent overlay) | Blocked per asset | Every session recorded |
OT Cybersecurity without a network redesign.
Connect Access Gate to the Network
Access Gate deploys alongside the existing network in an aggregation or lollipop architecture. No VLAN changes. No agents on PLCs or OT endpoints.
Zero Trust consolidation.
The overlay becomes the new Zero Trust fabric. Migration runs at about 10 systems per hour through the Access Gate proxy, so a 100-system site is done in a single day. IT admins and OT operators manage policy through role-based access in a shared UI.
Deployment scenarios.
Multi-site industrial group
A large group with heterogeneous OT (Siemens at one plant, Rockwell at the next, Schneider at a third) cannot standardise on any one vendor's tooling. The overlay is vendor-agnostic: it enforces zones and conduits at the network layer above whatever PLCs and protocols each site runs, and centralises policy across all of them.
Learn moreSingle-site manufacturer under NIS2
An Important Entity under NIS2 needs to demonstrate Article 21 segmentation and access control without a capital project. Phase 1 brings the site into scope in hours; Phase 2 consolidates to a full Zero Trust fabric over the following days, with audit evidence generated from the first session.
Learn moreUtility with legacy SCADA
A utility operator running legacy SCADA at Levels 1-2 cannot put agents on RTU or accept active scanning near safety systems. The adjacent overlay observes passively and brokers access without touching the field devices, then becomes the enforcement point as the estate migrates behind it.
Learn moreAccess Gate adapts to your network
Pick your environment to see where the Access Gate sits, how much Zero-Trust coverage you get, and the migration path, from full coverage to partial coverage.
Trusted by industrial and critical infrastructure operators.
distributed sites protected across harsh operational environments, securing critical infrastructure without agents or downtime.
Trusted by leading companies
OT network security, answered.
Purdue, IEC 62443 zones, multi-site policy, and the two-phase Access Gate deployment
The Purdue model is the reference layout for an industrial network: the process at the bottom, control above it, supervision above that, then site operations and the enterprise. Segmentation follows those layers. The full walkthrough, level by level, is in our guide to the Purdue model at /resources/purdue-model.
IEC 62443 formalises Purdue-style segmentation into two constructs. A zone is a grouping of assets that share the same security requirements and a common Security Level (SL1 to SL4). A conduit is the controlled communication path between zones. It sets and enforces exactly which traffic may cross a zone boundary, and under what conditions. Without conduits, a zone diagram is theoretical: any device can still reach any other.
Access Gate deploys in two phases. In Phase 1 it sits adjacent to the existing network at the Level 3 / DMZ boundary and creates a Zero Trust overlay across the Purdue zones. No VLAN reconfiguration, no agents on PLCs or OT endpoints, no production downtime. Visibility and identity-based access control are immediate. In Phase 2 that overlay becomes the new Zero Trust fabric as systems migrate behind the gate, with no forklift replacement of switches.
Phase 1, the adjacent overlay, is live in hours, not months. Phase 2 migration runs at about 10 systems per hour through the Access Gate proxy, so a 100-system OT environment is done in roughly a single working day. Compare that with the months a traditional VLAN redesign and consolidation project takes, most of which is change-control and validation, not the cutover itself.
NIS2 Article 21 does not name IEC 62443 explicitly, but its technical measures (network segmentation, access control, logging) map directly onto the zone-and-conduit model. National guidance for OT operators, including ANSSI guidance in France, treats IEC 62443 as the recognised technical implementation standard for those obligations, so building to IEC 62443 zones is the practical route to demonstrating Article 21 segmentation.
Access Gate provides central policy management across every site from a single role-based UI. Each site deploys independently in Phase 1, with no cross-site interdependency and no big-bang cutover. From day one of Phase 2, the sites roll up into one unified Zero Trust fabric. IT admins set enterprise-wide policy while OT operators keep site-level control, so a 50-site group runs a consistent IEC 62443 zone posture without sending a network team to every plant.
OT (operational technology) security protects the industrial systems that run physical processes: PLCs, HMIs, SCADA, and the legacy servers behind them. Unlike IT security it cannot rely on endpoint agents or frequent patching, so Access Gate enforces identity, segmentation, and monitoring at the network layer with a Zero Trust proxy in front of each asset, no agents and no downtime.
IT security defends data and user devices, where agents, patches, and reboots are routine. OT security defends availability and safety on equipment that often cannot be patched, agented, or taken offline. Access Gate adds Zero Trust access, microsegmentation, and audit at the network layer instead of on the device, so protection does not disrupt production.