Locating systems that do not flatten your OT security model.

You cannot secure gateways, anchors and cloud agents you have not listed. We start with a living OT/IoT inventory and data flows — including the vendor’s remote support path.

See OT cybersecurity and IT/OT ownership.

IEC 62443-minded zoning beats a flat wireless subnet. East-west monitoring, least privilege for location platforms, and store-and-forward that does not punch holes “temporarily” forever.

OEM tunnels and always-on support VPNs are a common breach path. Time-box, MFA, log, and refuse architectures that require permanent vendor presence on the plant floor.

We do not resell the stack under review. Architecture recommendations are written so you can swap suppliers without inheriting their security shortcuts.

Gateways, anchors and cloud agents belong on the OT/IoT inventory with data-flow diagrams that include the vendor remote-support path. IEC 62443-minded zoning beats a flat wireless subnet. Time-box OEM tunnels, require MFA, log access, and refuse permanent unrestricted presence on the plant floor.

We do not resell the stack under review — architecture recommendations are written so you can swap suppliers without inheriting their security shortcuts. See IT & OT.

We map data residency, identity federation and blast radius before recommending cloud location platforms vs on-prem/enclave. Firmware is OT change: windows, signed updates, rollback — not shadow IT.

Before scale: inventory complete, zones documented, remote access time-boxed with MFA and logging, firmware change process agreed, and an exit plan that does not depend on the vendor’s goodwill. We write those into the SOW so “temporary” tunnels do not become permanent plant fixtures.