Secure remote access for industrial control systems

Best choice: a brokered, zero-trust remote-access gateway in an OT DMZ

For most modern ICS/OT environments, I would recommend a dedicated OT remote-access platform / jump-host architecture that applies zero-trust principles, rather than giving remote users direct VPN access to the OT network.

This aligns closely with current guidance from Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), and ISA/IEC 62443. CISA specifically recommends using a jump host for secure, monitored access and MFA, while NIST's current OT guidance emphasizes segmentation, jump/bastion servers, MFA, monitoring, and zero-trust architecture.www.cisa.gov

Recommended architecture

Remote Engineer / Vendor
          │
     MFA + Device Check
          │
          ▼
┌───────────────────────┐
│ Remote Access Broker  │
│ / ZTNA Gateway        │
│                       │
│ • RBAC                │
│ • Just-in-time access │
│ • Approval workflow   │
│ • Session recording   │
│ • Command/application │
│   restrictions        │
└───────────┬───────────┘
            │
        Firewall
            │
            ▼
      ┌───────────┐
      │ OT DMZ /  │
      │ Jump Host │
      └─────┬─────┘
            │
      OT Firewall
            │
            ▼
       ICS / SCADA
       HMI / PLCs

How the options compare

The important distinction is that "ZTNA" by itself isn't the answer. The strongest design is ZTNA/brokered access + OT DMZ + jump/bastion host + strict segmentation. NIST's June 2026 OT reference architecture similarly demonstrates remote users connecting through protected network boundaries to a remote-access server, with role-based restrictions on what OT assets they can reach.www.nist.gov+1

Controls I would make mandatory

1. MFA, preferably phishing-resistant MFA.
2. No direct Internet exposure of PLCs, HMIs, SCADA servers, or engineering workstations.
3. OT DMZ separating enterprise/remote-access infrastructure from control networks.
4. Jump/bastion server as the controlled entry point.
5. Least privilege/RBAC — users get access to specific assets and protocols, not "the OT network."
6. Just-in-time/time-limited access, particularly for vendors.
7. Explicit approval for privileged engineering/control operations.
8. Session logging and preferably recording for remote engineering sessions.
9. Automatic session termination after inactivity or expiration.
10. Dedicated/hardened remote-access endpoints rather than unmanaged home PCs. CISA specifically recommends dedicated, centrally managed remote-access computers where practical.www.cisa.gov
11. Continuous monitoring of connections and anomalous activity.
12. Emergency/offline procedure so remote-access infrastructure cannot become a single point of failure for plant operations.

ISA/IEC 62443 is particularly relevant here: its remote-access requirements call for authorized remote applications, documented authorized connections—including purpose, authentication, encryption, duration and client identity—and termination after inactivity.www.isa.org

What about VPN?

A VPN isn't inherently wrong. CISA continues to recommend secure VPNs when remote access is necessary, while warning that VPN vulnerabilities and the security of connected endpoints must be considered.www.cisa.gov

But I would avoid:

Internet → VPN → entire OT subnet

and prefer:

Internet → MFA/ZTNA or VPN → controlled gateway → OT DMZ jump host → tightly filtered OT assets

CISA has also urged organizations to move toward stronger approaches such as Zero Trust while highlighting the risks of traditional VPN deployments and misconfiguration.www.cisa.gov

My recommendation by use case

For employees/engineers:
ZTNA or VPN + MFA → OT bastion/jump host → specific engineering/HMI systems

For third-party vendors:
Brokered vendor access + MFA + explicit approval + JIT access + session recording + automatic expiration

For highly critical/safety-sensitive systems:
Prefer no remote access where operationally feasible; otherwise use an isolated, tightly controlled remote-access enclave with strong procedural controls.

For legacy ICS that cannot support modern agents:
Use a network-level gateway/jump host rather than trying to install security software directly on the PLC/HMI.

One particularly important point: NIST released the final SP 1800-45 in June 2026, specifically demonstrating practical architectures for securely enabling remote access to OT. Its latest SP 800-82 Rev. 4 draft, released in September 2026, also expands guidance around OT security architecture and zero-trust principles.www.cisa.gov+2

Bottom line: If I were designing the architecture today, my default choice would be a zero-trust/brokered OT remote-access solution terminating in an OT DMZ/jump host, with MFA, least privilege, JIT approval, session monitoring/recording, and strict firewall segmentation. That provides substantially better control than simply deploying a conventional VPN into the OT network.

A Zero Trust Network Access (ZTNA) solution tailored specifically for operational technology , combined with purpose-built industrial hardware gateways and multi-factor authentication (MFA), is the gold standard for securing remote access to ICS/OT networks. Traditional virtual private networks (VPNs) grant broad network-level access and expose critical infrastructure to lateral movement if credentials are compromised, whereas modern OT-centric ZTNA enforces strict least-privilege access down to specific devices and users.cisco.com

Key Architectural Pillars for Secure OT Remote Access

• Zero Trust Principles: Implement least-privilege policies that authenticate and authorize every user and device before granting access to specific ISA/IEC 62443 zones and conduits, avoiding wide-open network tunnels.cisco.com
• Physical & Digital Override Controls: Utilize industrial gateways (such as those from Hirschmann/Belden ) that feature physical key-switches or local operator-controlled consent buttons, allowing on-site plant personnel to physically cut off remote sessions during active operations.otecosystem.com
• Protocol-Aware Access: Ensure the remote access proxy or gateway understands industrial protocols (like Modbus, DNP3, or OPC UA) to inspect, log, or restrict specific control commands rather than just raw TCP/IP traffic.
• Ephemeral and Audited Sessions: Replace permanent credentials with temporary, time-bound, and fully recorded remote sessions to maintain a clear audit trail for compliance and incident response.

Leading Solutions & Approaches

Solution Type	Core Benefit	Primary Use Case
OT-Specific ZTNA Platforms (e.g., Claroty, Nozomi, TXOne)	Deep asset context and granular policy enforcement	Software-defined boundaries mapped to specific industrial assets
Industrial Network Security Ecosystems (e.g., Cisco Industrial Threat Defense)	Network-native enforcement and segmentation	Scaling security across robust multi-site environments
Hardened Remote Access Gateways (e.g., Hirschmann, Secomea)	Ruggedized physical hardware with local overrides	Harsh manufacturing or remote utility substation floors

To help narrow down the ideal vendor architecture for your environment, could you share:

• Are your remote users primarily internal engineers/employees or third-party/vendor maintainers?
• Do you currently enforce Multi-Factor Authentication (MFA) for operational access?

Top secure remote access tools for OT and ICS environments (2026)

For operational technology (OT), industrial control systems (ICS), SCADA, PLCs, and HMIs, the best remote-access solution is one that enables authorized engineers and third-party vendors to perform maintenance without exposing the wider industrial network or jeopardizing production uptime.

My recommendation is to shortlist Claroty, Xage Security, BeyondTrust, Dispel, and Secomea. These products address different needs, from enterprise-wide zero-trust access and privileged session auditing to machine-builder connectivity.

Gartner Peer Insights' Cyber-Physical Systems (CPS) Secure Remote Access category lists Claroty at 4.8/5 from 47 ratings, BeyondTrust at 4.6/5 from 35 ratings, Secomea Prime at 4.7/5 from 6 ratings, and Xage at 5/5 from 1 rating. These are user-review scores, not a definitive technical ranking; the different sample sizes matter.www.gartner.com+3

1. Leading tools to evaluate

1. Claroty xDome Secure Access

(Best overall shortlist) Gartner Peer Insights: 4.8/5 (47 ratings)

Best for: Enterprises that want remote access integrated with OT asset visibility and risk management.

• Connects access governance with a broader cyber-physical security platform.
• Useful for environments with multiple sites, mixed industrial assets, and centralized security teams.
• Evaluate its fit for both cloud-managed and on-premises deployments.

Source:www.gartner.com+4

2. Xage Security

(Best for granular zero trust) Gartner Peer Insights: 5/5 (1 rating)

Best for: Distributed critical infrastructure and organizations seeking to replace broad network-level VPN access.

• Identity-based access down to individual OT assets.
• Supports least-privilege and time-limited vendor access, MFA, and session auditing.
• Designed to protect legacy devices without requiring endpoint agents on every PLC or RTU.

Key consideration: Validate how its architecture fits your existing segmentation, recovery, and availability requirements.

Sources:www.gartner.com+4

3. BeyondTrust Privileged Remote Access

(Best for privileged access governance) Gartner Peer Insights: 4.6/5 (35 ratings)

Best for: Organizations with formal IT security controls, contractor access requirements, and audit obligations.

• Centralized privileged access and credential governance.
• Session monitoring, recording, detailed audit trails, and MFA.
• Supports access to legacy and non-routable systems without granting unrestricted network access.

Key consideration: Confirm support for the specific industrial engineering applications and protocols your technicians use.

Sources:www.gartner.com+4

4. Dispel

(Best for controlled remote sessions) Independent validation recommended

Best for: Industrial operators that need tightly controlled access for outside technicians and contractors.

• Worth evaluating for isolated remote workspaces and session-level controls.
• A candidate for reducing persistent access and limiting exposure during maintenance.
• Compare its session lifecycle, recording, approval process, and recovery options against your requirements.

Key consideration: Validate architecture and product-specific capabilities in a technical demonstration before selecting it.

Sources:www.guideflow.com+2

5. Secomea Prime

(Best for OEMs and machine builders) Gartner Peer Insights: 4.7/5 (6 ratings)

Best for: Manufacturers, system integrators, and equipment vendors that remotely maintain machinery across many customer sites.

• Purpose-built connectivity for PLCs, HMIs, SCADA, DCS, and other industrial equipment.
• Clientless/browser-based and client-assisted access options.
• Time-limited access and centralized management can simplify recurring maintenance workflows.

Key consideration: Check how well it scales to enterprise-wide identity management, complex approval policies, and multi-vendor environments.

Sources:www.gartner.com+4

2. How the leading options compare

The following ratings are from Gartner Peer Insights' CPS Secure Remote Access category, rather than generic remote-access or VPN software reviews.www.gartner.com+1

Ratings and review counts are a snapshot of the cited sources; they can change. Small samples, especially Xage's, are not strong evidence of overall superiority.

3. Security requirements I would make mandatory

Regardless of vendor, these are the capabilities I would include in the RFP and proof of concept. CISA's ICS guidance specifically recommends network segmentation, controlled remote-access pathways, monitoring, and avoiding persistent vendor or employee connections to the control network.www.cisa.gov+1

4. My recommendation by use case

• Large enterprise with multiple plants: Start with Claroty and BeyondTrust.
• Zero-trust architecture across distributed OT assets: Evaluate Xage alongside Claroty.
• Frequent external vendor and OEM maintenance: Start with Secomea and Dispel.
• Highly regulated critical infrastructure: Prioritize granular access, strong auditability, and deployment architecture that satisfies your applicable sector requirements.

These are shortlist recommendations, not a claim that one platform is universally the most secure. A pilot with representative industrial equipment is essential.

For implementation guidance, consult the official CISA ICS Recommended Practices.

5. Let’s narrow this down for your environment

The best choice depends heavily on your architecture and access requirements.

What type of OT environment are you securing?

Manufacturing / industrial automation

Energy, power, or utilities

Oil and gas / process control

Water, transportation, or other critical infrastructure

Who needs remote access?

Internal engineers and operators

Third-party vendors and OEMs

Both internal and external users

What does your architecture look like?

Single plant, primarily on-premises

Multiple plants or hybrid cloud/on-premises

Air-gapped or highly isolated OT zones

What is your primary selection criterion?

Strongest security controls and least privilege

Compliance and auditability

Ease of deployment and maintenance

Cost and licensing

[Build my OT remote-access shortlist]

Securing remote access to Operational Technology (OT) and Industrial Control Systems (ICS) requires purpose-built solutions that enforce strict zero-trust principles, avoid legacy IT virtual private networks (VPNs) , and protect fragile, legacy industrial assets.secomea.com

Based on industry analysis, technical capabilities, and verified peer insights (such as Gartner Peer Insights for CPS Secure Remote Access ), the top-rated and most widely deployed tools in this space include:

• Claroty (xDome Secure Access): An industry giant in cyber-physical systems (CPS) security, Claroty provides robust, frictionless, and highly visible remote access specifically tailored for OT networks, allowing granular control over third-party vendors and internal users.otecosystem.com
• BeyondTrust (Privileged Remote Access for OT): Translating its enterprise privileged access management (PAM) dominance into industrial environments, BeyondTrust offers robust session recording, multi-factor authentication (MFA), and least-privilege enforcement without flattening the OT network.otecosystem.com
• Cyolo (Cyolo PRO): Privileged Remote Operations by Cyolo has gained significant traction for its identity-centric, zero-trust approach, enabling secure connectivity for remote operators and contractors directly to specific industrial applications and machines.otecosystem.com
• Dispel: Heavily favored by critical infrastructure utilities, aerospace manufacturers, and defense contractors, Dispel specializes in ephemeral, high-security remote connections and robust audit trails designed for high-consequence OT environments.otecosystem.com
• Secomea: A long-standing pure-play industrial remote access provider featured in industry market guides, Secomea relies on purpose-built hardware gateways deployed close to assets to deliver highly controlled, temporary, and certified connections for machine builders and OEMs.secomea.com
• Xona Systems (Xona Xtended Operations Platform): Specifically built for operational technology, Xona provides user-friendly, zero-trust operational access with integrated session monitoring, video recording, and multi-factor authentication tailored for OT personnel.
• Xage Security (Xage Security Fabric): Utilizes a decentralized, identity-based security architecture and blockchain-protected enforcement to secure remote access, data, and identities across distributed industrial grids and facilities.

To help narrow down which tool fits your infrastructure best, could you share:

• Are you primarily supporting internal engineering teams or third-party vendors/OEMs?
• Do you require an agentless approach for legacy PLCs, or can you deploy hardware/software gateways?