Split your plant network into safe zones. No rewiring, no downtime.
OT network segmentation puts each machine in its own zone and decides what may talk to it. Trout Access Gate does that from one on-premise appliance that connects to your existing network. No machine is re-addressed. One route on your existing switch moves a running line behind the gate, and production keeps running while the zones go in.
Last updated:
Trusted by leading companies
Why segmentation stalls on a live plant.
Most sites can describe the segmentation they want. The obstacle is that retrofitting it onto a running network means re-addressing equipment that cannot be taken offline. For the levels themselves and where the hierarchy stops matching real traffic, see <a href="/resources/purdue-model">the Purdue Model guide</a>.
The IT/OT boundary is the junction attackers aim for. It is also becoming more brittle with increased digitalization. Remote maintenance and cloud-bound data flows are prime examples of challenges to Purdue and segmentation efforts.
So most sites stay flat or only partly segmented. Operators know the model. Retrofitting it onto a live network is simply too disruptive.
How IEC 62443 zones and conduits work.
In IEC 62443: a zone is a grouping of assets that share the same security requirements and a common Security Level. The standard defines four, from SL1 (protection against casual or coincidental violation) to SL4 (protection against a state-level actor with extended resources). A conduit is the controlled communication path between two zones.
The hard part is implementing conduits on a network that is already running, which traditionally means a VLAN redesign: re-addressing equipment, reconfiguring switches, and taking production down for the cutover. For most operators, that downtime is the blocker that keeps a flat network flat for another year.
Four ways to segment an OT network.
| OT segmentation approach | Enforcement point | Rewiring / downtime | Lateral movement | Audit trail |
|---|---|---|---|---|
| Flat network | None | None | Unrestricted | None |
| VLAN only | Layer 2 isolation | Switch reconfig | Inter-VLAN routing open | None |
| Firewall zones / iDMZ | Zone firewalls | Re-addressing, downtime | Blocked at the zone edge | At the boundary |
| Access Gate overlay | Per-asset, identity-based | None (adjacent overlay) | Blocked per asset | Every session recorded |
Segment your plant without redesigning the network.
Connect Access Gate to your existing network.
Access Gate sits beside your existing network, in an aggregation or lollipop setup. No VLAN changes. Nothing to install on PLCs or other machines.
Move machines behind the gate.
One route on your existing switch moves a whole subnet behind Access Gate at once. A running production line moved in under a minute. IT and OT teams manage the rules together, each with their own role.
Three plants where it fits.
Multi-site industrial group
A group runs Siemens at one plant, Rockwell at the next and Schneider at a third. No single vendor's tool covers them all. Access Gate sets the zones at the network level, whatever PLCs and protocols each plant runs. One central policy covers every plant.
Learn moreSingle-site defense manufacturer under CMMC
A defense supplier handling CUI must show CMMC Level 2 segmentation and access control, without a capital project. Phase 1 brings the plant into scope in a day. Phase 2 moves every machine behind the gate over the following days. Audit evidence is recorded from the first session.
Learn moreUtility with legacy SCADA
A utility runs legacy SCADA at Levels 1-2. It cannot install software on RTUs or accept active scanning near safety systems. Access Gate watches passively and controls access without touching field devices. It becomes the enforcement point as machines move behind it.
Learn moreAccess Gate adapts to your network
Pick your environment to see where the Access Gate sits, how much Zero-Trust coverage you get, and the migration path, from full coverage to partial coverage.
Trusted by industrial and critical infrastructure operators.
distributed sites protected in harsh environments, with nothing installed on machines and no downtime.
Trusted by leading companies
Questions about OT network security.
Purdue, IEC 62443 zones, multi-site policy, and the two-phase Access Gate deployment
The Purdue model is the reference layout for an industrial network: the process at the bottom, control above it, supervision above that, then site operations and the enterprise. Segmentation follows those layers. The full walkthrough, level by level, is in our guide to the Purdue model at /resources/purdue-model.
IEC 62443 formalises Purdue-style segmentation into two constructs. A zone is a grouping of assets that share the same security requirements and a common Security Level (SL1 to SL4). A conduit is the controlled communication path between zones. It sets and enforces exactly which traffic may cross a zone boundary, and under what conditions. Without conduits, a zone diagram is theoretical: any device can still reach any other.
Access Gate deploys in two phases. In Phase 1 it sits adjacent to the existing network at the Level 3 / DMZ boundary and creates a Zero Trust overlay across the Purdue zones. No VLAN reconfiguration, no agents on PLCs or OT endpoints, no production downtime. Visibility and identity-based access control are immediate. In Phase 2 that overlay becomes the new Zero Trust fabric as systems migrate behind the gate, with no forklift replacement of switches.
Phase 1, the adjacent overlay, is live in a day. In Phase 2, one route on the existing switch moves a whole subnet behind the gate at once. At a large manufacturer in North Carolina, a running production line moved in under a minute, and production never stopped. Compare that with the months a traditional VLAN redesign and consolidation project takes, most of which is change-control and validation, not the cutover itself.
CMMC and NERC CIP do not name IEC 62443 explicitly, but the controls they assess (network segmentation, access control, logging) map directly onto the zone-and-conduit model. NIST SP 800-82, the US guidance for OT security, draws on IEC 62443 for segmentation, so building to IEC 62443 zones is a practical route to demonstrating segmentation to an assessor.
Access Gate provides central policy management across every site from a single role-based UI. Each site deploys independently in Phase 1, with no cross-site interdependency and no big-bang cutover. From day one of Phase 2, the sites roll up into one unified Zero Trust fabric. IT admins set enterprise-wide policy while OT operators keep site-level control, so a 50-site group runs a consistent IEC 62443 zone posture without sending a network team to every plant.
OT (operational technology) security protects the industrial systems that run physical processes: PLCs, HMIs, SCADA, and the legacy servers behind them. Unlike IT security it cannot rely on endpoint agents or frequent patching, so Access Gate enforces identity, segmentation, and monitoring at the network layer with a Zero Trust proxy in front of each asset, no agents and no downtime.
IT security defends data and user devices, where agents, patches, and reboots are routine. OT security defends availability and safety on equipment that often cannot be patched, agented, or taken offline. Access Gate adds Zero Trust access, microsegmentation, and audit at the network layer instead of on the device, so protection does not disrupt production.