Stop lateral movement before it reaches your controls. Segmentation gateways and access control keep IT incidents from spreading into OT systems — pre-tested in our lab, priced up front, ready to deploy.
SKU:EDR-G9004-VPN-2MGTXSFP-T
Vendor:
SKU:OTCD-KIT-1
Vendor:OT network segmentation divides an industrial network into zones and controls what can pass between them. A flat network lets anything that reaches one device reach all the others. A segmented one keeps an infected office laptop, a contractor's remote session or a compromised HMI inside its own zone. IEC 62443 calls the zones, and the controlled paths between them, zones and conduits.
It isn't the same thing as a perimeter firewall. A firewall between IT and OT protects one boundary. Segmentation carries the same idea inside the plant, down to a single cell, skid or device. It also doesn't have to be a re-addressing project: the Moxa secure router in this collection is built to segment a flat control network without changing the addresses behind it.
Small teams have two practical routes. A segmentation gateway builds encrypted, authenticated tunnels to each device or group and adds secure remote access for staff and contractors. An industrial secure router puts a firewall and NAT in front of a cell or a remote site. Both have been through our IT/OT lab, and both carry a published price.
Many organizations treat OT and IT networks separately due to the inherent differences in their security requirements. Segmentation and access control keep the two isolated so they interact only in a controlled manner — preventing threats from IT systems from spreading to OT systems.
Keep adversaries from moving laterally across the network, and shrink the blast radius if a breach occurs.
When an incident occurs, segmentation makes it faster to identify, isolate, and contain the affected segments.
Enforce strict policies on which users, devices, and systems can reach particular segments — protecting critical OT assets from accidental or malicious changes.
IEC 62443, CMMC, NIST CSF and other frameworks put segmentation and access control at the top of their recommended controls.
Two approaches sit in this collection, plus a bundle that pairs one of them with a discovery tool. What separates them is whether you want to control access device by device, or put a hardened boundary in front of a cell or a remote site.
| Compare | Segmentation gatewayBlastWave BlastShield | Industrial secure routerMoxa EDR-G9004-VPN | Starter kit bundleCyberScope XRF + BlastShield |
|---|---|---|---|
| What it does | Builds encrypted, authenticated peer-to-peer tunnels to each device or group of devices, with remote access for staff and contractors. | Puts firewall, NAT, VPN and routing in one hardened DIN-rail device. | Pairs a NetAlly CyberScope XRF for discovery with two BlastShield gateways for segmentation. |
| How it segments | Least-privilege access policies per device or group, granted or revoked in real time, without complex firewall rulesets. | A stateful firewall in routed or transparent mode, with deep packet inspection that can allow PLC reads and block writes. | Find what is on the network first, then segment it with the gateways. |
| What you need | Two gateways are included at each endpoint tier. Setup takes some networking know-how and, per the vendor, a few hours. | DIN-rail space and a 12/24/48 VDC supply. SFP modules and the IPS license are sold separately. | Nothing else to get started. The bundle includes a 150-endpoint annual license. |
| Best for | Sites that need microsegmentation and secure remote access together, up to 150 endpoints at published prices. | A cell, substation or remote site that needs a hard boundary and a VPN back to the control room. | A first project where you don't yet have an asset inventory. |
| Starts at | From $2,180.00Includes 2 gateways, up to 50 endpoints | $2,300.00 | $14,500.00 |
| Shop | View product | View product | View product |
Not sure which fits? If the goal is to control who and what can reach each device, start with the gateway. If the goal is a boundary in front of equipment that can't be touched, start with the router. Larger or multi-site deployments are quoted on request.
You're asked to add segmentation to a network that is already running, and the client won't accept a long outage or a new IP scheme. The Moxa secure router goes in front of a cell in transparent mode, and its copper ports keep passing traffic if the unit loses power. Published SKUs and prices mean the line items can go in the proposal today.
A ransomware incident on the business network, or an auditor's question about a flat network, usually starts the project. Segmentation limits how far an intruder can move once inside, and it gives you one place to grant and revoke vendor access. Start with the zone that would hurt most to lose, then extend from there.
Every integrator, OEM and contractor who connects remotely is a path into the control network. BlastShield gives each remote user access only to the devices they are approved for, with phishing-resistant biometric multifactor authentication, and lets you revoke that access in real time when the job ends.
Segmentation gateways create controlled boundaries between OT, IT, and cloud zones across sites — isolating control networks while orchestration stays centralized.
Question not listed? Email info@otcyberdirect.com or call (508) 289-1195.
Published prices here start at $2,180 for a BlastShield package covering up to 50 endpoints with two gateways, and $2,300 for a Moxa EDR-G9004 secure router. BlastShield is $3,680 for 51 to 100 endpoints and $5,180 for 101 to 150. Larger or multi-site projects are quoted.
Usually, yes. A boundary firewall controls traffic crossing between IT and OT. It does nothing once something is inside the control network, where many plants are flat. Segmentation limits movement between cells, and between remote users and the devices they have no reason to reach.
Often you can. The Moxa EDR-G9004 runs as a transparent firewall or uses NAT, and Moxa positions it for flat control networks that need segmentation without re-addressing. The device sits inline, so plan the cutover with operations.
No, but they overlap. Segmentation controls which devices can talk to each other. Secure remote access controls which people can reach which devices from outside. BlastShield does both. The Moxa router provides up to 250 IPsec VPN tunnels back to a control room.
For the Moxa router, SFP modules and the IPS license are sold separately, and a wall-mount kit is optional. BlastShield packages include two gateways, and additional users come in packs of three by quote. BlastShield's control application is hosted in AWS, so there is no management server to install on site.
Each vendor ships from its own facility with its own tracking code, so an order from two vendors arrives as two shipments. Ground shipping is free on most products, and some vendors offer overnight for orders placed before 12 PM ET. These products ship within the US only.
