OT zero-trust licensing and role-based use cases.

OT zero-trust products are licensed in four common models: per-asset (priced per protected device), per-user or per-seat (priced per named identity), per-site or per-appliance (a flat subscription per deployment), and consumption or capacity (priced by throughput or data volume). For asset-heavy OT sites full of legacy PLCs and sensors, per-asset licensing tends to be the most expensive and the least predictable, because cost grows with every device you discover. Access Gate uses a per-appliance all-inclusive subscription instead, so the price does not climb as you find more assets.

For most industrial sites, a per-site or per-appliance model is the best fit. OT environments have high, fixed device counts and long equipment lifecycles, so a flat per-deployment subscription gives predictable budgeting and does not penalize you for protecting legacy assets. Per-user models suit remote-access-only use cases, and consumption models suit elastic cloud workloads, neither of which matches a fixed plant floor. Access Gate is licensed per appliance, all-inclusive of hardware or virtual appliance, software, updates, and support.

The core roles are: operators (read and control specific HMIs and PLCs during their shift), third-party vendors and integrators (time-boxed, session-recorded access to named assets), control engineers (program and configuration access to specific controllers, fully logged), compliance and audit (read-only access to session logs and evidence), and SOC or IT security (visibility into flows and alerts, with no control rights). A zero-trust access layer maps each role to the exact assets, protocols, and time windows it needs, and records every session.

Access Gate binds every connection to an identity and enforces role-based access control at the network layer: by user, by asset, and by protocol. A vendor can be granted read-only access to one PLC for a two-hour maintenance window; an engineer can be granted program access to a controller; an auditor can be granted read-only access to logs. Because enforcement happens in the overlay, these rules apply even to legacy equipment that cannot authenticate on its own, and every session is recorded for audit.

Access Gate is sold as an all-inclusive per-appliance annual subscription covering hardware or virtual appliance, software, updates, and support. Access Gate One, for small and mid-size manufacturers, starts around $9,750 per year. There is no per-asset metering, so the price does not increase as you discover more devices on the network.