A Secure Operation Twin is an in-path industrial proxy the Trout Access Gate places directly in front of a targeted machine, so that every connection to and from that asset passes through a controlled compute layer on the wire. Instead of trusting the machine to defend itself or wrapping a whole zone in a firewall, the twin sits on the path to the asset and applies identity, policy, encryption, and recording to the traffic as it flows. The result is that a single machine, including a legacy controller or a vendor's black-box appliance, can be secured fully without touching the machine itself.
What is a Secure Operation Twin?
It is a way to put security on the wire rather than on the endpoint. Most OT assets cannot run an agent, cannot be patched, and cannot be re-addressed without risking production. The Secure Operation Twin solves this by becoming the asset's network presence: it terminates connections, authenticates the user, enforces what the protocol is allowed to do, encrypts the link, and records the session, then proxies the cleaned traffic onward to the real machine. To the rest of the network the twin is the machine, which is why it can protect equipment that has no security capability of its own.
How does it work: compute on the wire
The Access Gate provides compute directly in the data path. Because it is in-path, it does not depend on the machine cooperating and it does not depend on the cloud. It inspects and controls traffic as a protocol-aware proxy, so it can allow a protocol such as Modbus, OPC UA, RDP, SSH, or HTTP while constraining exactly what that protocol may do. The deployment is resilient by design: the twin can be placed transparently so that a failure falls back to the machine's normal path, and it can be scaled across many assets from one point of management.
How is it different from an industrial DMZ?
An industrial DMZ protects the boundary between IT and OT with a shared buffer zone. It is valuable, but it is coarse: everything inside the zone still trusts everything else inside the zone. The Secure Operation Twin lets you scale that same idea down to the individual machine, so each critical asset gets its own controlled boundary rather than sharing one. In practice teams use both: a DMZ at the site edge, and Secure Operation Twins in front of the specific assets that matter most. This is how you move from zone-level segmentation toward the asset-level control that IEC 62443 and Zero Trust call for, without an overlay redesign or VLAN rework.
What can it protect?
Anything reachable over the network, including the systems that are hardest to secure any other way:
- Legacy equipment that cannot be patched, cannot run an agent, and cannot be taken offline. The twin secures it without changing it.
- Third-party and vendor systems where you do not control the device or the code. The twin gives you identity, least privilege, and a recording of exactly what the vendor did.
- Flat or unsegmented assets that today trust anything on the LAN. The twin becomes the only controlled path to them.
How do you deploy a Secure Operation Twin?
Deployment is designed to be non-disruptive: you place the twin in the path to the asset and cut over without rewiring or IP renumbering. The documentation covers the deployment models and the traffic-control options:
- Choosing a Secure Twin deployment
- Deploy a Secure Twin with DNS
- Secure Twin port for active traffic control
- ARP proxying
- Source-based routing
