Can contractors use their own unmanaged devices?

Yes. With the CyberElements client, device posture checks can assess antivirus status, OS version and patch level before access. For browser-based clientless access, a protocol break isolates the contractor’s device from the target system, while device posture checks remain more limited.

What happens in environments where there is no internet or smartphone access?

Pulse provides MFA through the user’s typing behaviour, so warehouses, clean rooms and production sites can authenticate users through the keyboard already in place. An internet connection is required because the typing data is processed in the CyberElements cloud.

How does CyberElements handle the IT/OT segmentation requirement under NIS2?

Multi-tenant, multi-gateway architecture manages IT regulated, IT non-regulated, OT regulated and OT non-regulated segments from the same console. Each segment operates under its own access policies. One platform covers the full NIS2 tiering requirement.

Can multiple contractors work on the same asset simultaneously?

Yes. The platform supports concurrent access by multiple named users to the same resource, each in their own isolated session with their own audit trail.

How does session recording work for OT compliance?

Every privileged session is recorded in full and tied to a named identity. Lens monitors sessions in real time and can pause a session automatically when suspicious behaviour is detected, so the recording serves as a preventive tool as well as a compliance artefact.

What is the difference between PAM for OT and ZTNA for OT?

ZTNA controls how external parties and remote workers reach OT systems, keeping the infrastructure invisible and granting task-specific, time-bound access. PAM controls and monitors what privileged users — internal or external — do once they are inside, with real-time session analysis via Lens. CyberElements combines both under the same Zero Trust access model.

How quickly can CyberElements go live in an OT environment?

The platform is live in a few minutes from the browser without infrastructure changes. First connections and access policies can be configured in a working day. Production environments with complex segmentation typically complete full deployment within a few weeks, depending on the number of assets and providers involved.

OT & Industrial Security

Keep remote maintenance from becoming the reason production stops.

Remote maintenance helps teams fix faster, but it also opens new routes towards OT systems. CyberElements runs each session through double-barrier architecture, keeps engineering stations invisible from the internet, limits contractors to the task at hand and monitors every privileged action in real time.

Book a Demo Start For Free

Used by highly regulated manufacturers and multisite industries within complex environments.

Challenges

OT access has outgrown the old rules.

Industrial infrastructure used to wait for the technician’s van. Now contractors connect remotely, maintenance happens from tablets and regulation asks for proof. Every remote route needs control, because a breach in IT can reach the production floor in minutes.

Stopping production costs more than a ransom.

An unplanned production halt in manufacturing costs an average of €130,000 per hour. Most industrial operators sit one successful intrusion away from that number. The line going quiet is the real fear.

The handshake between IT and OT needs a chaperone.

Most industrial companies struggle to define the right level of IT and OT segregation. The hard part is setting the right boundary: open enough for work, but controlled enough for the production chain.

Legacy OT systems were never designed to go online.

Engineering stations, SCADA systems and PLCs were built for longevity and reliability. Remote access came later. These assets still need maintenance, but every new connection adds risk around systems that were never designed for cloud-era access.

The engineer can’t always be onsite by Tuesday.

Bringing an engineer onsite for every maintenance event is too slow and too expensive. The alternative often means contractors connecting from unmanaged devices, expensive dedicated tools or VPNs that grant broader access than the job needs.

Shared logins save time until something goes wrong.

Physical security culture is strong on industrial sites. Cybersecurity habits often lag behind it. Shared computers, shared sessions and shared logins keep work moving, but they leave the record pointing to a terminal instead of a named person.

A shared account can’t explain who clicked.

NIS2 and sector-specific regulations require that every access event is tied to a named individual. Shared credentials make compliance structurally impossible, not just difficult.

Real World ROI

Make remote maintenance easier to approve.

OT incidents move faster when the right person can reach the right asset safely. CyberElements helps teams reduce onsite dependency, shorten contractor onboarding, remove standing access and keep every session ready for audit.

60–80%
Reduced admin time
Faster contractor access
- Start remote maintenance with task-based access.
- Automate JIT access and credential management.
- Reduce setup and support work for IT.
80–90%
Reduction in contractor-related risk
Make standing access expire.
- Open access for the approved task and timeframe.
- Close access automatically when the work ends.
- Prevent forgotten accounts and lingering permissions.
One console
Across distributed data centres
Run BCDR from one rulebook.
- Govern distributed data centres from one console.
- Apply the same rules across primary and recovery sites.
- Keep BCDR access controlled and traceable.
2–5x
Faster audit preparation
Put audit evidence within reach.
- Generate logs and session recordings automatically.
- Keep evidence ready during audit time.
- Cut manual collection work and costly repeat audits.
Real-time intervention
Risky sessions paused automatically
Turn live detection into immediate action.
- Analyse remote sessions in real time.
- Pause or stop suspicious activity automatically.
- Help prevent contractor errors from turning into costly downtime.

*Calculated outcomes are based on an organisation with 10 regular contractors and 1,000 employees.

Benefits

Grant the work, not the network.

Remote access no longer has to mean choosing between operational speed and security control. CyberElements lets contractors, engineers and internal teams reach the right OT asset, through the right route, with every action monitored and recorded.

Security

Give attackers nothing useful to find.

Double-barrier architecture and protocol break keep OT assets hidden. Contractors work through isolated sessions on a just-in-time, least-privilege basis. The old mix of VPN exposure, shared credentials and shadow access becomes a thing of the past.

Governance

Know who’s inside.

Every external and internal connection is visible from one console. One operating model covers contractors, providers, regions and OT segments, so access rules stay consistent across a complex estate.

Operational Fluidity

Keep work moving.

Remote maintenance and fixing runs from the browser, with task-based access and controlled collaboration on the same asset. Teams can resolve issues faster, handle connection peaks at shift start and reduce reliance on expensive dedicated OT connection tools.

Compliance and Audit

Stay ready for questions.

Every action is tied to a named identity. Session recordings meet compliance requirements for forensic traceability. NIS2, EHDS and ISO 27001 evidence is produced continuously, not tediously assembled at audit time.

How It Works

Secure remote OT access through a controlled route, not an open door.

CyberElements combines double-barrier architecture, browser-based access, session isolation and real-time monitoring. The contractors reach only the task they came for, while the engineering station stays invisible. Lens uses AI to analyse behaviour live and automatically blocks the session as soon as activity falls outside the approved pattern.

Step 1

The asset stays invisible.

Double-barrier architecture and protocol break keep engineering stations, ICS assets, HMIs, SCADA systems and OT applications hidden from the internet. The contractor can complete the session while the asset stays out of sight.

Step 2

The contractor connects from their own device.

Access runs from the browser, so contractors can connect without installing a client or dedicated remote tool. Device posture is checked before the session opens, and risky devices stay outside. Capacity scales through peak connection periods, keeping contractor access moving when demand spikes.

Step 3

Pulse handles MFA where phones and tokens don’t fit.

Warehouses, clean rooms and production environments do not always allow smartphones, internet access or extra devices. Pulse authenticates the user through typing behaviour, so no-extra device MFA can work where normal MFA creates friction.

Step 4

The task defines the access.

Just-in-time and least-privilege access give contractors the specific system they need, for the time the task requires. When the work ends, the access closes.

Step 5

Lens watches the session live.

AI-powered Lens monitors privileged activity on critical OT assets while the session is still open. Suspicious behaviour can trigger an automated response before the damage spreads. From evidence after the fact, the recording becomes a preventive material.

Step 6

Tie every access to a person.

Shared credentials and shared sessions give way to named access. Every authentication event, action and administrative change is attributable to a single identity, with the audit trail building as the work happens.

Step 7

Run every IT and OT entity from one solution.

Multi-tenant and multi-gateway architecture separates organisations and networks across IT, OT, regulated and non-regulated environments. Teams manage every segment from one platform, while each tenant, gateway and access zone keeps its own rules.

Industry Applications

Every OT environment has its own version of the same access problem.

The assets may look different across industries, but the access principle stays the same: give each person the right route, for the right task.

Defence & Critical Infrastructure

Give distributed critical systems a controlled route in.

Providers and integrators work on distributed systems from unmanaged devices, with device posture checks, monitored privileged sessions. No bunker room required.

Healthcare

The technician doesn’t need the hospital map to fix one machine.

Telemaintenance for medical imaging, ventilators and diagnostic equipment runs through session isolation. The device vendor reaches the machine. They never reach the ward network. Every action is on the record.

Industrial & Manufacturing

The production line stays running. The engineer stays at his desk.

Manage multi-site production continuity from one console. Support mobile maintenance from a tablet. Cover environments where MFA hardware is impractical. Replace one VPN per production line and per provider with one platform for all of them.

Don’t take our word for it. Take theirs.

Nicolas Verdière

Systems Engineer, Fleury Michon

“CyberElements is the foundation of our access security strategy based on the 3-Tier model. We can centrally manage internal and external access to our OT and IT target resources while applying every Zero Trust principle.”

FAQs

What industrial security teams ask before they go live.

Answers to the questions you will probably ask next. If yours is not here, visit our full FAQ page.

No. The Edge Gateway joins your network from the inside via an outbound-only encrypted connection. No inbound ports are opened and no changes to your existing OT architecture are required. Engineering stations, HMI and ICS systems stay invisible from the internet before, during and after each session.

Give your next OT session a safer route in. Run CyberElements free for 30 days.

Put actual contractors on the platform from day one. See every session, every access decision and every audit entry as it happens. No demo environment. No synthetic data.

Start For Free

They recognise CyberElements as a key European player in Identity and Access Management:

We didn’t write these reports. We just earned them.