Loading the estate…
Manufacturing · Northfield Precision (anonymized)
Segmenting a precision manufacturer before the next Windows update became a line stop
A multi-site manufacturer needed IT/OT separation, monitored vendor access, and a WAN that failed over without folklore.
- OT/IT conduits
- Mapped & monitored
- WAN failover
- Proven in incident
- Standing vendor VPNs
- 0
The situation
Three plants shared a flat network with the business office. A contractor VPN had standing access to historians. One plant’s wireless was a consumer mesh. Leadership wanted cloud analytics without inviting the internet onto the cell controllers. The last 'network project' had been a weekend cutover still described in the break room.
What we did
We mapped conduits, stood up a segmented plant design, and put vendor access behind jump hosts with MFA and expiry. SD-WAN replaced a single-threaded MPLS story. Patch windows were negotiated with operations, not emailed at them. Cloud analytics landed in a DMZ with one-way patterns the OT team would sign.
What changed
- Vendor sessions are now time-boxed and recorded. Standing plant VPNs are gone.
- A circuit failure in Q2 failed over in minutes with operators watching a runbook, not a group chat.
- The first plant-wide Windows maintenance window in three years completed without a line stop.
Start here
Tell us what is actually in production.
A short conversation is enough to know whether we are the right ally. No license dump. No theater.