Uptime Comes First. Your Security Should Too.

NetFoundry is an identity-first connectivity and segmentation platform for operational technology (OT) and IoT environments. It connects plants, devices, and vendors through an outbound-only overlay that opens no inbound ports and puts no agent on legacy controllers. Authorized identities can still reach OT and IoT assets, while those assets stay invisible to the internet. The same fabric spans IT, OT, IoT, and embedded devices and deploys on-premises or fully air-gapped.

NetFoundry deploys without downtime or a maintenance window. A lightweight tunneler drops in front of an asset, or an SDK embeds in a device, with nothing installed on the controller and no change to VLANs, firewall rules, or the existing network. Because each asset dials out and local enforcement runs on-site, you add connectivity without interrupting real-time control, and plant-to-plant and on-site traffic keeps running even if the WAN or cloud link drops.

NetFoundry protects unpatchable OT assets by removing the path an attacker would use to reach them rather than requiring a patch. A lightweight tunneler sits in front of a legacy controller or an HMI running an unsupported operating system. The asset then connects outbound-only, with no inbound ports and no software installed on the device itself. The vulnerability remains present but becomes unreachable to unauthorized identities, which serves as a recognized IEC 62443 compensating control for assets that cannot be patched or taken offline.

NetFoundry requires no inbound firewall ports and no VPN into the plant. Every connection is outbound-only: each asset dials out to the overlay, which leaves no listening port to scan and no VPN endpoint to attack. This eliminates the standing entry points that VPNs and jump servers create, and it lets your team add new connectivity without firewall rule changes, VLAN redesigns, or maintenance windows.

NetFoundry maps directly to IEC 62443 and NIS2 by enforcing identity-based, zone-and-conduit segmentation with least-privilege access and immutable audit logs. It supports IEC 62443 requirements for identification and authentication, authorization, boundary protection, and audit, and provides a recognized compensating control for unpatchable assets. Centralized policy and logging produce the evidence auditors expect, and the same model also aligns to NERC CIP and the EU Cyber Resilience Act.

NetFoundry supports the frameworks that govern industrial and critical-infrastructure operations, including IEC 62443, NIS2, NIST 800-171, NERC CIP, the Security of Critical Infrastructure (SOCI) Act, the EU Cyber Resilience Act, DORA, SOC 2 Type II, and FIPS. It maps to them through identity-based, zone-and-conduit segmentation, least-privilege access, and immutable session and policy logs. For assets that cannot be patched or taken offline, removing the network path to the asset serves as a recognized IEC 62443 compensating control.

NetFoundry runs fully on-premises or in a completely air-gapped environment on commodity hardware you already own. It needs no proprietary appliance and no vendor-hosted cloud, which lets it satisfy OT security reviews that prohibit outside connectivity. Local enforcement continues even if the WAN or cloud link drops, keeping plant-to-plant and on-site connectivity running and protecting production during an outage.

NetFoundry stops lateral movement by enforcing default-deny, identity-based segmentation between IT and OT and between individual machines. It grants access by verified identity to a specific service rather than by IP address or network location. A compromise in IT or a single infected device therefore has no authorized path to spread onto the plant floor. Even when an attacker exploits one asset, the blast radius stays contained to that asset, because no lateral path exists to anything else.

NetFoundry does not replace your discovery and detection tools; it enforces what they find. Those tools identify the assets and threats on your network, and NetFoundry provides the connectivity and segmentation layer beneath them, granting least-privilege, identity-based access to each asset and streaming session and policy data back to the SIEM or SOC tooling your team already uses. A single enforcement layer then acts on the visibility your existing stack produces.

NetFoundry gives each vendor or OEM identity just-in-time, least-privilege access to only the specific equipment it is authorized to service, with no VPN and no open inbound ports. NetFoundry authenticates every session by identity and records it in full for audit, and your team grants or revokes access without firewall or infrastructure changes. This replaces broad VPN tunnels and jump servers with a door to one machine rather than the whole plant, and it enables remote diagnostics without a truck roll.

NetFoundry connects IoT fleets by giving each device its own cryptographic identity through an embeddable SDK or a lightweight tunneler, with no traditional agent, no public IP, and no per-device firewall rules. Devices communicate outbound-only, which keeps them invisible to inbound scans, and default isolation prevents any one compromised device from reaching the others. The same identity model works across cellular, edge, air-gapped, and roaming deployments, and NetFoundry’s connectivity ships embedded in Siemens SINEC Secure Connect, proof that it scales inside industrial products.