OT zero-trust licensing and role-based use cases.
How OT zero-trust products are priced and which roles they serve. Per-asset pricing grows with every machine you find. Access Gate uses one all-inclusive price per appliance instead.
Last updated:
OT zero-trust tools are licensed four ways: per-asset, per-user, per-site or per-appliance, and consumption.
For asset-heavy OT:
- Per-asset metering is the costliest and least predictable, because the bill grows with every legacy device you find.
- A per-site model fits the fixed, high device counts of a plant floor.
- Trout Software's Access Gate uses a simple all-inclusive per-appliance subscription.
- Access Gate enforces role-based access by user, asset, and protocol.
OT zero trust is priced in four ways.
| Model | How it is priced | Fit for OT | Watch-out |
|---|---|---|---|
| Per-asset | Per protected device or endpoint | Weak | Cost grows with every legacy device discovered; unpredictable at scale |
| Per-user / seat | Per named identity | Partial | Good for remote access, weak for asset-heavy control networks |
| Per-site / appliance | Flat subscription per deployment | Strong | Predictable; matches fixed, high OT device counts |
| Consumption / capacity | By throughput or data volume | Weak | Cloud-style elasticity does not match a fixed plant floor |
Access Gate is priced per appliance, all-inclusive: hardware or virtual appliance, software, updates and support. There is no per-asset metering. The price does not climb as you discover more devices, so the budget for an OT rollout stays predictable.
One access layer serves five roles.
Operator
Read and control specific HMIs and PLCs during a shift, nothing else.
Third-party vendor / integrator
Time-boxed, session-recorded access to named assets for a maintenance window.
Control engineer
Program and configuration access to specific controllers, fully logged.
Compliance / audit
Read-only access to session logs and tamper-evident evidence.
SOC / IT security
Visibility into flows and alerts, with no control rights on the process.
Access Gate maps each role to the exact assets, protocols, and time windows it needs and records every session. Because enforcement lives in the overlay, these rules apply even to legacy equipment that cannot authenticate on its own. See what Access Gate is and agentless Zero Trust for OT.
Access Gate comes in three form factors.
All three use the same all-inclusive subscription per appliance. Buy through a partner, with a quote scoped to your plant.
Access Gate Essential
For small & mid-size sites
Recommended up to 200 assets, depending on traffic volumeAll-inclusive annual subscription. Hardware, software, updates, and support. No per-seat fees, no hidden costs.
- Trout Access Gate Essential hardware appliance
- Network visibility & automatic asset discovery
- Secure Remote Access
- Legacy equipment protection
- Software updates & security patches
Access Gate Performance
For large sites & critical infrastructure
Recommended up to 1,000 assets, depending on traffic volumePerformance hardware powered by Trout CyberOS™. All-inclusive annual subscription. Premium Support.
- All Access Gate Essential Features
- Premium hardware appliance
- CMMC, NERC CIP & IEC 62443 compliance
- Priority support with dedicated SLA
*List price per appliance, billed annually, covering hardware, software, updates and support. Shipping and tax excluded. Final pricing is set by your local certified partner. Find a partner near you.
Common questions about OT zero-trust licensing.
OT zero-trust products use four common licensing models. Per-asset pricing charges per protected device. Per-user or per-seat pricing charges per named identity. Per-site or per-appliance pricing is a flat subscription per deployment. Consumption or capacity pricing charges by throughput or data volume. OT plants are full of legacy PLCs and sensors, so per-asset licensing tends to cost the most and vary the most: the bill grows with every device you discover. Access Gate uses an all-inclusive subscription per appliance instead, so the price does not climb as you find more machines.
For most industrial plants, a per-site or per-appliance model fits best. OT environments have high, fixed device counts and long equipment lifecycles. A flat subscription per deployment keeps the budget predictable and does not penalize you for protecting legacy machines. Per-user models suit remote-access-only use cases. Consumption models suit elastic cloud workloads. Neither matches a fixed plant floor. Access Gate is licensed per appliance, including the hardware or virtual appliance, software, updates and support.
There are five core roles. Operators read and control specific HMIs and PLCs during their shift. Third-party vendors and integrators get time-boxed, session-recorded access to named machines. Control engineers get program and configuration access to specific controllers, fully logged. Compliance and audit teams get read-only access to session logs and evidence. SOC or IT security gets visibility into flows and alerts, with no control rights. A zero-trust access layer maps each role to the exact machines, protocols and time windows it needs, and records every session.
Access Gate ties every connection to an identity. It enforces role-based access control at the network layer: by user, by machine and by protocol. A vendor can get read-only access to one PLC for a two-hour maintenance window. An engineer can get program access to a controller. An auditor can get read-only access to logs. Enforcement happens in the overlay, so these rules also cover legacy equipment that cannot authenticate on its own. Every session is recorded for audit.
Access Gate is sold as an all-inclusive annual subscription per appliance. It covers hardware, software, updates and support. Access Gate Essential is the model for small and mid-size plants, and current list prices are on the pricing page. There is no per-asset metering, so the price does not rise as you discover more devices on the network.
The gate is the first service you run, not the last.
Price a deployment for your plant.
One all-inclusive price per appliance, with no per-asset metering. Get a quote scoped to your network.