Documentation
A Secomea alternative: industrial remote maintenance without a dedicated box
Secomea industrialized a gesture every machine builder knows: put a box on the machine network, let it call the vendor's cloud, and give technicians clean remote access from their workstation. The model works — but it rests on dedicated hardware to buy, ship and maintain on every site, and on a third-party platform at the center of every session. When the site already has a supervision PC or a gateway, another path exists: a software agent that brings that machine into your own private network, encrypted end to end, with no inbound port and no extra hardware. This page compares the two approaches honestly, then walks through the setup step by step.
What Secomea does very well
The Secomea model, described at a high level, has three parts: a gateway installed on site (the SiteManager, a hardware box that also exists as software), a central cloud service (the GateManager) that brokers sessions, and a client (the LinkManager) on the technician's workstation. The gateway expects no inbound connection: it dials out to the platform, and the technician reaches the equipment declared behind it. Licenses cover the platform, the gateways and the technicians.
Built for the factory
Machine network / factory network separation, equipment declared one by one, OEM service access at an end customer's site: the product has embraced the realities of industrial remote maintenance for a long time.
Nothing to ask of the customer's firewall
The gateway needs no inbound port: it establishes outbound connections to the platform, which passes most factory network policies without negotiation.
A self-contained device
Some boxes embed a cellular modem: the delivered machine is reachable without touching the end customer's network at all. When that hardware autonomy is required, the dedicated box is a real advantage.
What the box + cloud model implies
The qualities of this model stem from an architectural choice: dedicated hardware on every site, and a central platform brokering the sessions. That choice is coherent for an industrial appliance — but it has consequences worth weighing when the site already has machines able to carry an agent.
- Hardware on every site. One box per machine or per site means a device to buy, reference, ship, keep as spare stock and replace on failure — multiplied by the fleet of delivered machines. That logistics simply does not exist with a software agent.
- The platform at the center of every session. Brokering is operated by the central service: access to your machines depends on the availability and rules of an external service, and that service holds the accounts and the rights.
- Access through declared services. You reach what the gateway forwards — practical and well-scoped, but different from a real local network: vendor tools that discover their equipment via broadcast may need, depending on configuration, special handling.
The VIGIL-MESH approach: a software agent, a real private network
VIGIL-MESH replaces the box with an agent installed on a machine that already exists: the supervision PC, the line's IPC, a Linux gateway, an NVIDIA Jetson. Enrolled once with a single-use key, that machine joins your private network: stable address, readable name (MagicDNS), reachable only by authorized members. Sessions are QUIC/TLS 1.3 connections encrypted end to end, with a hybrid post-quantum key exchange — and no inbound port is opened anywhere: every machine only dials out.
A real LAN, not a port forward
Multicast, broadcast and automatic discovery work natively: vendor tools that look for their equipment via broadcast keep their habits, just as on the site's local network.
SSH terminal in the browser
The Administration tab of the console opens a terminal on a machine of the network, right in the page: the tab becomes a mesh node, and your credentials never transit through our servers.
Blind relays — self-hostable too
When a relay is needed, the vigie forwards encrypted packets it holds no keys for. And if you want to own that relay as well, a self-hosted private vigie dedicates the relayed path to your workspace.
ACLs, audit log, MFA
Default-deny rules written in terms of identities — machines, groups, tags — via the access policies; every sensitive operation requires MFA and leaves a trace in the audit log.
- The machine name, as it appears in the network inventory.
- Its overlay address: this is what the terminal reaches, never a public address.
- “Terminal” opens an SSH session on this machine, encrypted end to end from the tab.
The details of the model — a single encryption layer, structurally blind relays, immediate revocation — are described in the security model; the broader use case, in Industrial remote maintenance.
Qualitative comparison
This table compares architectures, not datasheets: each row describes a difference of model, at a high level.
| Criterion | Secomea | VIGIL-MESH |
|---|---|---|
| Hardware required | Dedicated gateway on every site, plus the technician's client | No dedicated hardware: an agent on a PC or gateway already present |
| Network model | The gateway dials the vendor's platform; the technician connects to it and reaches declared equipment | Encrypted private network between machines: direct peer-to-peer path when possible, blind relay otherwise |
| Multicast and discovery | Point-to-point service forwarding; broadcast discovery may need special handling | Real LAN: native multicast, broadcast and automatic discovery, MagicDNS names |
| Serial port | Available on some boxes, depending on model | Virtual-IO (virtual serial port) — in beta |
| Real-time UDP and video | Maintenance sessions through the platform | End-to-end UDP flows; on the direct path, no intermediate termination |
| Browser SSH terminal | Remote access via the client or the platform's mobile access | Yes: the tab becomes a mesh node, the session is encrypted end to end in the page |
| Cloud trust model | The central platform brokers sessions and holds accounts and rights | Controller for identity and policy; structurally blind relays, without the session keys |
| Self-hosting the relay | Depends on the vendor's offering | Self-hostable private vigie, dedicated to your workspace |
From the box to the agent: service access to a delivered machine
You are a machine builder or an integrator. A machine ships to an end customer, and the contract includes remote maintenance. With a box, every delivery carries its share of constraints:
- A device to buy, provision, wire and document — then to keep as spare stock for the whole life of the machine.
- A network dossier to get approved by the end customer's IT, even though everything dials out.
- Platform, gateway and technician licenses to track through hirings and departures.
- And on every intervention, a third-party platform at the center of the session — a point some end customers now ask to control.
- 1Install the agent on the supervision machineThe PC or IPC that already drives the line (Windows or Linux) receives the VIGIL-MESH client — no hardware to add, no change to the customer's network.
- 2Enroll with a single-use keyThe 'Add a machine' wizard hands out a key that expires on its own; the machine generates its identity locally and opens no inbound port.
- 3Write least-privilege ACLsDefault deny: the service group reaches only its customers’ machines, port by port. Rules speak of identities, never of addresses — see the access policies.
- 4Work from the workstation or the browserVIGIL-MESH client on the technician's workstation, or SSH terminal from the console: the tab becomes a mesh node, with nothing to install.
- 5Trace, then revoke without delayEvery sensitive operation requires MFA and leaves a trace in the audit log; a technician who leaves the team is revoked immediately, machine by machine.
- Pick the platform of the machine to connect — the suggested client and command adapt.
- The key is single-use and expires on its own: it authorizes exactly one join.
- The command to run on the supervision machine, key included — ready to copy.
Which model for which site?
| Situation | Better choice | Why |
|---|---|---|
| Machine network with no PC, and no permission to add one | Box | The agent needs an OS; the dedicated device is built for this case |
| Integrated cellular modem required in the same device | Box | Hardware autonomy avoids one more device |
| End customer policy: dedicated appliance mandated | Box | The site's policy overrides the architecture |
| A supervision PC or gateway already exists | VIGIL-MESH agent | Zero hardware, zero inbound ports, end-to-end encryption |
| Vendor tools using broadcast/multicast discovery | VIGIL-MESH agent | The real LAN carries discovery natively |
| Requirement: nobody must be able to read the sessions | VIGIL-MESH agent | E2E + blind relays, self-hostable private vigie |
The two models coexist very well in one fleet: the box for locked-down sites that require it, the agent everywhere a machine can carry it — with the same technicians on both sides.