Protect machines that cannot protect themselves. Nothing changes on the machine.
Trout Access Gate is an on-premise appliance that puts an industrial proxy in front of any machine that cannot defend itself: legacy, third-party, or unpatchable, with nothing installed on the machine, no downtime, and no rewiring.
Last updated:
Trusted by leading companies
A Secure Operation Twin puts industrial proxies directly in front of a machine.
Every packet in and out passes through a controlled compute layer on the wire, so the asset is protected with no patching, no agent, and no downtime. This includes legacy and third-party systems.
Security runs on the wire, in front of the machine.
Most OT assets cannot run an agent, cannot be patched, and cannot be re-addressed without risking production. The Secure Operation Twin becomes the asset's network presence. It terminates connections, authenticates the user and limits what the protocol may do. It encrypts the link and records the session. Then it passes the clean traffic on to the real machine.
Because the compute runs in-path, it does not depend on the machine cooperating and it does not depend on the cloud. To the rest of the network, the twin is the machine, which is how it can protect equipment that has no security capability of its own.
Give each critical machine its own boundary.
An industrial DMZ protects the boundary between IT and OT with a shared buffer zone. It is useful, but coarse: inside the zone, everything still trusts everything else. The Secure Operation Twin brings the same idea down to each machine. Each critical asset gets its own controlled boundary instead of sharing one.
In practice teams use both: a DMZ at the site edge, and Secure Operation Twins in front of the specific assets that matter most. This is how you move from zone-level segmentation toward the asset-level control that IEC 62443 and Zero Trust call for, without an overlay redesign or VLAN rework.
Full protection for machines you cannot change.
The twin secures anything reachable over the network, including the systems that are hardest to protect any other way.
Compute on the wire.
The Access Gate provides compute directly in the data path. It does not depend on the machine cooperating, and it does not depend on the cloud.
Controls what each protocol may do.
It terminates the session and inspects the protocol, so it can allow Modbus, OPC UA, RDP, SSH, or HTTP while constraining exactly what each is allowed to do.
Secures legacy machines in place.
Equipment that cannot be patched, agented, or taken offline is protected without changing the machine itself.
Controls third-party systems.
Vendor and black-box appliances get identity, least privilege, and a recording of exactly what was done.
Brings the iDMZ to each machine.
Give each critical asset its own controlled boundary instead of sharing one buffer zone across everything.
No downtime, no rewiring.
Placed transparently in the path to the asset, it cuts over without IP renumbering or VLAN redesign.
How the twin compares with firewalls and agents.
| Capability | Firewall / DMZ | Endpoint agent | Secure Operation Twin |
|---|---|---|---|
| Where security runs | At the zone boundary | On the endpoint | In-path, in front of the asset |
| Works on legacy assets | Coarse, zone-wide only | No, cannot install | Yes, no change to the machine |
| Third-party / black-box devices | Trusted once inside the zone | No control | Identity, least privilege, recorded |
| Granularity | Zone level | Host level | Per machine, per protocol |
| Deployment impact | Re-architecture | Rollout + patching | In place, no downtime or rewiring |
Placed in front of the machine, without rewiring.
The recommended way changes nothing on the machines. One route on your existing switch or router sends the traffic through Access Gate, and removing the route is the rollback. At a large manufacturer in North Carolina, a running production line moved behind the gate in under a minute this way.
Production keeps running.
No rewiring, no downtime.
Protect your machines with one route (recommended)
One route on your existing switch or router sends traffic through Access Gate, matched on its source or its destination. Nothing changes on the machines.
Alternative: protect a machine you reach by its name
Route clients to the twin through DNS, one machine at a time.
Alternative: protect a machine you reach by its address
Point clients at the machine's overlay address, one machine at a time.
Example: one route on a Cisco Catalyst switch
The exact commands to add the route, and to remove it for a rollback.
Questions about the Secure Operation Twin.
It is an in-path industrial proxy the Trout Access Gate places directly in front of a targeted machine. Every connection to and from that asset passes through a controlled compute layer on the wire, so the asset can be secured fully without changing the machine itself.
An industrial DMZ protects one shared boundary between IT and OT, where everything inside the zone still trusts everything else. The Secure Operation Twin scales that idea down to the individual machine, so each critical asset gets its own controlled boundary. Teams typically use both together.
Yes. That is the point. Because the twin becomes the asset's network presence and applies identity, policy, encryption, and recording on the wire, it protects legacy controllers and vendor appliances that have no security capability of their own.
No. The twin is placed transparently in the path to the asset and cuts over without IP renumbering or VLAN redesign. The recommended method is one route on your existing switch: at a large manufacturer in North Carolina, a running production line moved behind Access Gate in under a minute.
No. The compute runs in-path on-premise. There is no dependency on an external service to broker or inspect the traffic.