Documentation

Secure OT/IT convergence: connect without tearing down the walls

OT/IT convergence promises production data in the company's tools and remote interventions on the machines. It worries people for a good reason: done badly, it amounts to plugging the shop floor into the office network — and into its threats. VIGIL-MESH approaches the problem through identity: every machine is enrolled individually, every flow is explicitly authorised, everything else is denied. You connect what needs connecting, machine by machine — without ever tearing down the walls.

The dilemma: connect without exposing

Three forces pull in opposite directions, and any convergence architecture has to satisfy them together.

Data must flow up

MES, ERP, historians, dashboards: production is no longer run blind, machine data has to reach the IT systems — continuously.

Experts must reach down

Automation engineers, integrators and machine builders work remotely on specific machines — see industrial remote maintenance.

OT must stay walled off

The shop floor was isolated for good reasons: office ransomware must never reach a production line. Convergence cannot be paid for with de-segmentation.

The classic answer — industrial DMZ, case-by-case firewall rules, exception VPNs — works, but every new flow is a project: one more rule, one more exception, one more review. The error surface grows with the number of links.

Connecting is not merging: the identity model

The mesh does not connect networks to each other — it connects identified machines. That shift is what changes the security of convergence.

Every machine carries its own cryptographic identity (Ed25519 keys): what connects is a specific machine, not “something from the shop-floor subnet”.
ACLs deny by default: no flow exists until it is written down — machine, group, service. See deciding who talks to what.
Authorisation is per service: the historian exposes its collection port to the authorised IT server — not its admin console, not the rest of the machine.
Never a whole subnet: machines join host by host, every reachable device is declared. What is not enrolled does not exist on the mesh.
Revocation is immediate: end of contract, lost laptop, departed contractor — access drops in one action, direct flows and broadcasts included.

Implementation, step by step

1
Inventory the flows you actually needWhich data flows up (historian to MES, OPC UA to dashboards), who works on what (maintenance, machine builders): convergence starts on paper, not in the firewall.
2
Enroll the OT sideThe agent installs on the machines that embed a PC, or on a workshop gateway — industrial PC, Linux box, NVIDIA Jetson — which reaches the declared equipment, host by host.
3
Enroll the IT sideThe servers that consume the data — MES, central historian, group supervision — get the same agent and the same machine identity as the shop-floor side.
4
Write least-privilege ACLsOne flow per inventoried need, one-way whenever possible: collection flows up, nothing flows back down without an explicit rule. Everything else stays denied.
5
Observe, then widen if neededThe audit log shows who reached what; legitimate requests that fail become visible, and every widening is a traced decision — not a forgotten exception.

Audit log and compliance

OT/IT convergence is also a regulatory requirement: you must be able to show who accesses the industrial systems, how, and on whose decision.

Every access is logged in the console — see the audit log: machine, actor, time.
Per-member roles separate who administers the network, who writes the policies and who merely accesses.
Third-party access — machine builders, integrators — is scoped by ACL and individually revocable, without touching anything else.
Encryption is uniform: QUIC/TLS 1.3 end to end, Ed25519 keys, hybrid post-quantum key establishment — including on relayed segments.

What convergence must not break

Converging does not mean degrading the shop floor. Two properties of the field must survive the arrival of the shared network.

Real time and discovery: multicast and broadcast cross the mesh — mDNS, SSDP, DDS/ROS 2 keep working, see the broadcast domain.
The existing defences: industrial firewall, DMZ and physical segmentation stay in place — the mesh layers on top without requiring their removal.

Frequently asked questions

Do my OT machines end up exposed on the Internet?

No. No machine listens on the Internet: the agent only makes outbound connections, and machines are only reachable at their private overlay address, by the sole peers the ACLs authorise. There is no open port, no DMZ, no public address.

Does the IT network see the whole shop floor once convergence is in place?

No, the model is the exact opposite: every flow is explicitly authorised, machine by machine and service by service, and everything else is denied by default. An IT server allowed to read the historian sees neither the PLCs, nor the supervision, nor anything else.

Can we grant temporary access to a machine builder or an integrator?

Yes: enroll their computer, write an ACL scoped to their machine and the intended services, and revoke at the end of the intervention — access drops immediately, and the audit log keeps a record of what was done.

Does VIGIL-MESH replace the industrial firewall or the DMZ?

No. The mesh solves the links between OT and IT: who reaches what, encrypted, with no exposure. It does not inspect industrial frames and replaces neither an industrial firewall nor the physical segmentation of the machine network — it layers on top of them.

And tomorrowOperate these machines with an AI assistant →

The same network that connects them lets each software announce its capabilities — and an MCP assistant see and operate them, under your control, machine by machine.