Read time: 5 minutes
Xage Security is listed among the 31 vendors researched in Forrester’s The Operational Technology Security Solutions Landscape, Q1 2026, authored by Paddy Harrington and published on March 25, 2026. The report explains the value organizations can expect from OT security solutions and describes a selection of vendors in the market. For security and risk teams protecting industrial and critical infrastructure environments, it offers a practical way to narrow a long vendor list to the providers that fit their priorities.
What you’ll learn in this post
- How connectivity is changing how OT environments are attacked
- Why OT security programs need enforcement after asset discovery
- How Xage approaches asset protection, network segmentation, and privileged remote access
- Questions to ask vendors about the extended use cases that matter in your environment
How is the OT security market evolving?
Forrester describes OT security solutions as an established market that has moved past asset visibility. Vendors now use adaptive analytics to detect OT-specific attacks and are adding proactive capabilities, while IT and OT convergence is moving buyers from point tools toward unified platforms.
Operational technology (OT) is the hardware and software that monitors and controls physical processes in sectors such as manufacturing, energy production and transmission, transportation, and healthcare. It includes industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and programmable logic controllers (PLCs). Forrester defines OT security solutions as security controls built specifically to protect OT assets and information from cyberthreats, so operations stay resilient and personnel stay safe.
Connectivity has changed how these environments are attacked. Attacks on industrial processes once required physical access or, as with Stuxnet, a USB device and advanced malware. Today, digitized control systems connect to enterprise IT, cloud services, and the internet.
What matters most is enforcement. Discovery tells you what is on your OT network. The harder question for buyers is whether a solution can control access to those assets and contain an intrusion without disrupting production.
How Xage applies Zero Trust to OT assets
Xage protects OT and cyber-physical systems (CPS), which connect digital controls to physical processes, by authenticating and authorizing every interaction against identity-based policy. The Xage Fabric Platform deploys as an agentless overlay, so you can protect legacy PLCs, remote terminal units (RTUs), and engineering workstations without replacing equipment or redesigning the network.
Many OT environments rely on zones and edge firewalls organized around the Purdue Model, a reference architecture that separates industrial networks into hierarchical levels. Inside a zone, users and devices are often implicitly trusted. Xage adds identity-based microsegmentation and access control at the asset level on top of existing segmentation, which limits how far a compromised account or device can move within the same zone.
What makes Xage different?
- Identity-based enforcement to the asset: Policies follow the verified identities of users, machines, applications, and AI agents, so you control which identities can reach a specific PLC or workstation and what actions they can perform.
- Agentless deployment: Protects legacy and proprietary OT devices without installing software on them or rearchitecting existing networks.
- Pre-emptive Security: Eliminates reconnaissance and vulnerability scanning opportunities by hiding assets from unauthorized users, AI agents, and systems.
- Distributed, resilient enforcement: Enforces policy locally at remote, disconnected, and air-gapped sites, so protection continues when a site loses its connection to central management.
- Unified access and asset protection: Combines identity-based microsegmentation with secure remote access and Extended Privileged Access Management (XPAM), including just-in-time (JIT) and just-enough access (JEA), credential management, and session monitoring.
Xage Critical Asset Protection extends these controls across industrial assets, data center workloads, and cloud services. It combines identity-based segmentation, access control, and virtual patching, which places protective controls around a vulnerable asset when you cannot patch it directly. That gives you a compensating control for legacy systems that cannot be patched or replaced, while reducing reliance on complex firewall rules for east-west traffic, the communication between assets within the same environment.
Aligning OT security with federal Zero Trust guidance?
Download the whitepaper to see how Xage maps to the Department of War’s Zero Trust for OT activities and outcomes.
Final thoughts
Finding OT assets is where an OT security program starts. The harder work is enforcing controls around those assets in environments that cannot tolerate downtime and where equipment stays in service for decades. Look for controls that limit which identities can reach each asset, contain lateral movement inside Purdue Model zones, govern employee, vendor, and AI agent access, and keep enforcing policy when a site goes offline.
Key takeaways
- Asset discovery is the starting point; the harder work is enforcing controls without jeopardizing uptime.
- Xage delivers asset protection, network segmentation and traffic control, and privileged remote access through agentless, identity-based controls in the Xage Fabric Platform.
See identity-based Zero Trust in your OT environment. Talk with a Xage expert about protecting your industrial assets and the remote access paths that reach them.
Frequently asked questions
How is OT security different from IT security?
OT security protects systems that control physical processes, such as PLCs, SCADA systems, and safety systems, where availability and safety usually take priority over data confidentiality. OT assets often run for decades, use proprietary protocols, and cannot tolerate downtime for patching or agent installation, so OT security controls must protect them without interrupting operations.
How do I secure third-party remote access to OT systems?
Replace shared VPN accounts and jump servers with identity-based remote access that grants each employee or vendor access only to the specific assets they need, for a limited time. Vault device credentials so vendors never see them, and monitor sessions to keep an audit trail of every action on critical systems.
What is OT network segmentation?
OT network segmentation divides industrial networks into zones, often following the Purdue Model, and controls the traffic allowed between them. That keeps an intrusion in enterprise IT from reaching control systems directly. Because devices within a zone often trust each other, many organizations add microsegmentation, which applies identity-based policy to individual assets so a compromised account or device cannot move freely within the same zone
Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.
