Manufacturing · OT segmentation

Segmenting a manufacturer's plant network without touching uptime or safety

A flat network let IT and plant-floor systems talk freely, so one infected laptop could reach the controllers running the line. The fix could not risk a single minute of unplanned downtime.

Talk to our team ➔

Minutes of unplanned production downtime

Contained

Blast radius if an office endpoint is hit

Passive

Monitoring that respects safety systems

Representative engagement — A discrete manufacturer with multiple production lines (anonymized). Details are anonymized and illustrative of how we work; outcomes are directional, not a claim about a specific named client.

The challenge

IT and OT shared one flat network — ideal conditions for ransomware to spread from an office endpoint to production systems.
Previous IT-style tooling had been ripped out after it interfered with safety interlocks and controller traffic.
Any change had to respect maintenance windows and the plant team's authority over the line.

Our approach

Mapped assets and traffic passively first, then designed segmentation around the Purdue model and real production flows.
Introduced OT-protocol-aware monitoring that watches rather than interferes, with active controls staged only after plant sign-off.
Sequenced every change into maintenance windows with rollback planned in advance.

The outcome

A compromised office device can no longer reach the controllers running the line.
The plant team keeps authority over changes, and monitoring never trips a safety interlock.
The environment is now visible — assets, traffic, and anomalies — instead of a black box.

Built for regulated, audited environments

We deliver the controls and evidence that make your audits possible — hardening and operating practices aligned to the frameworks your assessors and customers recognize.

SOC 2

ISO 27001

HIPAA

PCI DSS

CIS Controls

NIST CSF

GDPR

Services in this engagement

Related insights

Have a similar challenge?

Tell us your environment and priorities — we return scope, ownership, and a plan.

Contact intSignal