Security & architecture

Designed around the realities of OT environments.

Otector places a controlled access layer between users and OT, deployed and driven from your side. Here is how it fits together, and the principles behind it.

The architecture

Three components, connected from the inside out.

Every layer connects outbound over TLS. Nothing on the outside opens a connection into the OT network.

CloudOtector-managed services
Optional
Component 03Service Provider Portal

Multi-client workspace for external service providers, OEMs and system integrators. It does not receive direct network access into any client OT environment.

logs inService providerRequests and runs approved sessions to granted assets.
↑ client-initiated · TLS
EnterpriseYour network or private cloud
Component 02Client Portal

Your security and management layer for assets, access, approvals, policies, credentials, sessions, recordings, files and audit data.

logs inEmployees & OT teamsReach authorised assets and manage access.
Security & SOCMonitor, review and audit activity.
↑ existing outbound Site Agent channel
Site / iDMZClose to the OT environment
Component 01Site Agent

Lightweight on-site component. It initiates outbound connections and brokers sessions locally to authorised OT assets using native protocols.

OT / Process networkPLCs · HMIs · Engineering workstations · Historians · Industrial applications

Connections towards the OT environment are initiated through the client-controlled architecture. The Site Agent establishes the connection locally. Explore the OT VPN alternative →See controlled native-tool access →

Principles

What the design holds to.

Client-controlled deployment

The Client Portal runs in your enterprise network or your own private cloud, driven by your teams.

Outbound Site Agent connectivity

The Site Agent initiates the connection outward. The OT environment does not need to accept an inbound connection.

No direct provider-to-OT connection

The Service Provider Portal has no direct network path into a client's OT environment.

Credentials remain client-side

Asset credentials stay under client control and are used at the site, not handed to external users.

Default-deny provider access

Service providers reach only what a client has explicitly granted, and nothing more.

Granular permissions

Access is scoped to specific assets and connection profiles, not to whole network segments.

Enterprise identity integration

Users authenticate through your identity provider, with roles mapped to your groups.

Step-up authentication

Higher-risk actions, such as a service-provider launch, can require a stronger factor first.

Recorded & auditable

Session recording, secure file controls and a central audit trail provide the evidence.

Deployment

Where each part lives.

  • The Client Portal may be deployed in the client's enterprise network or private cloud.
  • The Site Agent is deployed close to the OT environment.
  • The Client Portal does not require direct connectivity to individual OT targets.
  • The Site Agent establishes the connection to the asset locally.

Designed with industrial security principles and architectures in mind.

Otector is built for the constraints of OT environments. We are happy to walk your security and architecture teams through the details.

Regulatory & standards alignment

Where architecture becomes assurance.

The architecture and security principles above do more than reduce remote-access risk. They create enforceable controls and attributable evidence that support the requirements organisations face under NIS2 and IEC 62443. Explore NIS2 remote access controls →

NIS2EU Directive 2022/2555

Turn remote-access obligations into enforceable controls.

NIS2 raises expectations around access control, strong authentication, supply-chain security and incident accountability. Otector helps operationalise those requirements where they are often hardest to control: third-party and remote access into OT environments.

How Otector helps
  • One governed path for employees, vendors and service providers.
  • Enterprise identity and step-up authentication for sensitive connections.
  • Asset-scoped access without unnecessary standing permissions.
  • Attributable session records to support investigation, assurance and reporting.
IEC 62443Industrial cybersecurity

Apply industrial security principles to remote access.

IEC 62443 addresses security across service providers, industrial systems, products and components. Otector applies those principles to one of the most sensitive control points in OT: who is allowed in, what they can reach and what happens during the connection.

Supports your security model
62443-2-4Service providers

Supports governed access for OEMs, integrators and other external service providers.

62443-3-3Secure systems

Supports identification and authentication, use control, restricted data flow and event response.

How Otector itself is engineered
62443-4-1Secure development

Otector is being developed using secure product-development lifecycle principles.

62443-4-2Secure components

Otector components are being designed around relevant industrial component security requirements.

The security platform should not become the security gap.

Otector sits on a sensitive path into OT environments. That is why the platform is being engineered around secure development, strong identity, client-controlled credentials, outbound connectivity and hardened components. Security is not added around Otector. It is built into the architecture.

62443-4-1Secure development62443-4-2Component security
Control mapping

From principle to enforceable control.

Otector turns remote-access requirements into controls that can be consistently applied across sites, assets and third parties.

ControlWhat Otector providesNIS2IEC 62443
Access control & least privilegeAsset-scoped, time-bound access with default-deny provider accessArt. 21 · Access control3-3 · FR2
Identity & strong authenticationEnterprise identity and connection-level step-up authenticationArt. 21 · MFA3-3 · FR1
Third-party accessOne governed path for OEMs, integrators and service providersArt. 21 · Supply chain2-4 / 3-3
Controlled connectivityClient-controlled, brokered access without direct provider-to-OT connectivityArt. 21 · Risk management3-3 · FR5
Audit & accountabilityIndividual attribution and a central audit trail for every sessionArt. 21 / 233-3 · FR6
Session evidenceSession recording and controlled file-transfer activityArt. 213-3 · FR2 / FR6
Product securitySecurity of the Otector platform itselfSecure development practices and component-level security requirementsArt. 21 · Acquisition & development4-1 / 4-2

Otector supplies remote-access controls and session evidence that support these frameworks. It does not make an organisation compliant on its own. Formal product conformance claims will only be made following the relevant assessment or certification processes. See how Otector creates remote access evidence →

Talk architecture

Bring your security and architecture teams.

A technical walkthrough of the deployment model, the connection flow and the controls, mapped to your environment.