Extending Secure Digital Workspace into Operational Technology Environments

How organizations can modernize the endpoint edge while preserving the production systems that have to keep running.

Industrial organizations are modernizing the factory floor without the luxury of treating operational technology like a greenfield IT environment. Production systems must remain available, validated processes must be preserved, and OEM-specific control stacks often need to coexist for years. The modernization opportunity is therefore not to replace every control system. It is to standardize the execution, access, policy, and governance boundary around them.

The IGEL Adaptive Secure Endpoint Platform™ extends the secure digital workspace model into OT by providing an immutable endpoint execution layer, centralized policy and lifecycle control through IGEL Universal Management Suite™ (UMS™), modular application delivery, and integration with identity, network access, remote access, and industrial workloads. This creates a common foundation across operator stations, engineering access points, HMIs, packaging and logistics terminals, facilities systems, and emerging edge/AI workloads.

The key architectural shift is not to standardize on a single OEM or access technology, but to standardize the interfaces used to reach them. Agent-based clients, browsers, RDP/VDI, secure remote access, virtual machines, containers, and emerging open industrial-edge approaches such as Margo can coexist behind one managed endpoint and policy model. This reduces the number of unmanaged access paths without forcing a disruptive redesign of the underlying production process.

The endpoint is one of the few parts of the OT estate you can standardize without touching the control system. Manage that layer well, and it becomes a reliable place to enforce configuration, application, and access policy before users reach production systems.

Why the OT Modernization Boundary Is Moving to the Endpoint Edge

OT estates have accumulated layers of technology around production: legacy Windows workstations, OEM engineering tools, RDP and Citrix sessions, web HMIs, local agents, jump hosts, remote vendor access, thin clients, industrial PCs, and increasingly containers and AI-enabled workloads. Each may be justified in isolation. At enterprise scale, however, the combination creates fragmented identity, inconsistent endpoint state, duplicated security tooling, shadow access paths, and plant-by-plant operating models.

• Availability remains the first constraint: endpoint maintenance cannot become a production event.
• Validated and certified systems may need to remain unchanged even while the access layer is modernized.
• Multiple OEMs and generations of technology require coexistence, not a single-protocol assumption.
• Third-party and remote support require tightly scoped access rather than broad network reachability.
• AI, analytics, and software-defined automation introduce new workloads at the same edge where users, tools, sensors, and production systems intersect.
• Governance must span cybersecurity, resilience, identity, data sovereignty and industrial frameworks without creating a separate control stack for each requirement.

Standardize the Interfaces, Not the Factory

A scalable OT endpoint architecture needs to accommodate the access method that the workload requires. The objective is to reduce bespoke endpoint designs by placing approved access patterns on a common trusted execution foundation.

Interface pattern	Best fit in OT	Architectural value
Approved agent	OEM clients, security clients, specialized access tools	Retains native capability while controlling deployment and configuration.
Browser	Modern MES/HMI, dashboards, SaaS, web-based engineering or support	Reduces local application footprint and simplifies lifecycle management.
RDP / VDI	Legacy Windows applications, centralized engineering tools, existing virtual estates	Preserves applications while removing the need for a general-purpose Windows endpoint at the console.
Secure remote access	OEM/vendor support, privileged maintenance, third-party access	Scopes access to the required system or application rather than extending broad network access.
VM / container	Legacy local workloads, isolated utilities, edge services, AI/analytics components	Separates workloads and enables controlled modernization without collapsing trust boundaries.
Margo / OCI pattern	Emerging multi-vendor industrial-edge workload orchestration	Creates a path toward open, repeatable workload packaging and fleet interoperability as the standard matures.

IGEL Adaptive Secure Endpoint Platform™ provides interoperable orchestration of industrial edge applications, devices, and fleet-management software. The practical customer value comes from architectural alignment around open workload packaging, OCI/container patterns, device enrollment, and lifecycle interoperability rather than dependence on a proprietary edge stack.

One Enrollment Point for Network Access and Comply-to-Connect

The highest-leverage control is often not another endpoint agent. It is the ability to determine whether an endpoint is known, enrolled, correctly configured, and authorized before it participates in the plant network or reaches a critical application. UMS™ provides the central endpoint policy and enrollment plane. Through integration with network and security policy systems, endpoint context can be used as an input to network access control and conditional access decisions.

• Enroll the endpoint into UMS™ and establish a managed device identity.
• Apply a known-good configuration and approved application set.
• Combine device posture with persona, location, application, and risk context.
• Pass relevant context to NAC or other policy engines such as Cisco ISE or Forescout.
• Allow, restrict, segment, or deny access according to plant, zone, role, and workload policy.
• Maintain centralized evidence of configuration and policy state for operational review and audit workflows.

Comply-to-connect turns endpoint management into an access prerequisite: the device does not merely receive policy after it connects; its managed state becomes part of the decision to connect.

Secure Remote Access Without Recreating a Flat OT Network

Remote access is a persistent OT requirement for OEM support, engineering, maintenance, after-hours response, and specialist troubleshooting. The architectural objective is to preserve that operational capability while reducing standing credentials, unmanaged jump boxes, and broad VPN-style network exposure.

A controlled IGEL endpoint can serve as the trusted user-side execution point for browser-based privileged access, RDP, SSH, VNC, or partner access technologies. Policy can be aligned to persona and device state, while the remote-access platform governs the session, destination, and privileges. This separation is important: IGEL establishes and governs the endpoint; the remote-access or Zero Trust service governs access to the target resource.

Eliminate Shadow IT and Shadow AI by Creating an Approved Execution Path

Shadow IT in OT often begins as a practical response to a real need: a local utility, a browser plug-in, an unmanaged laptop, a vendor tool, a Python script, a small analytics service, or a new AI assistant. The risk comes from allowing each need to create its own unmanaged execution environment.

UMS™ provides the centralized management, policy, and endpoint-state foundation for IGEL OS™ devices. When integrated with NAC and identity systems, that managed endpoint context can contribute to comply-to-connect and conditional-access decisions. Devices accessing the OT environment can be enrolled in UMS™ and differentiated by persona or role, such as maintenance, process engineering, HMI/MES, HMI/WMS, signage, or kiosk. Approved applications can then be curated and delivered centrally, with least-privilege policy applied at the endpoint. Workloads can be segmented or isolated; containers can provide bounded execution for modern services; and access to tools, data, networks, and peripherals can all be policy-controlled. The same pattern can be extended to AI workloads so that the organization can distinguish sanctioned AI execution from unmanaged local agents or scripts.

A Bridge from Current State to Future State

The most successful OT modernization programs do not begin with a mandate to replace the control system. They begin by identifying the access and execution boundary that can be standardized with the least production risk. This creates a repeatable migration path:

Stage	What changes	What can remain
1. Establish the trusted endpoint	Replace or repurpose the operator/access endpoint with IGEL OS™ and UMS™ policy.	MES, HMI, SCADA, DCS, and control applications.
2. Normalize access	Use the appropriate approved pattern: agent, browser, RDP/VDI, or secure remote access.	Existing application hosting and validated processes.
3. Add comply-to-connect	Integrate endpoint enrollment/posture with NAC and segmentation policy.	Existing switching, plant zones, and security architecture where appropriate.
4. Consolidate workloads	Move selected local utilities or legacy Windows workloads into managed VMs/containers where validated.	OEM applications and peripheral dependencies until tested.
5. Introduce open edge patterns	Adopt container/OCI and emerging Margo-aligned workload patterns for new software-defined use cases.	Legacy systems can coexist during the transition.
6. Govern AI and advanced workloads	Apply identity, isolation, policy, observability, and approved tool/data access to AI at the edge.	Core production control remains separated unless explicitly designed otherwise.

Multi-Framework Governance from a Common Technical Control Set

Industrial organizations rarely operate under a single framework. A global manufacturer may simultaneously need to address IEC 62443, NIST CSF 2.0, Zero Trust principles, NIS2, CMMC, or sector-specific requirements, plus internal policies for sovereignty, resilience, and third-party access. Building a separate endpoint architecture for each framework increases complexity without improving control.

Common control objective	Platform contribution	Evidence / operational outcome
Asset and endpoint accountability	UMS™ enrollment, inventory, and centralized configuration	Known managed endpoint population and configuration state.
Least privilege / contextual access	Device, persona and conditional policy; integration with IAM/NAC	Access aligned to role, device state, location, and application.
Segmentation / network admission	Comply-to-connect integration with NAC/policy engines	Managed-state input to allow, restrict, or deny network participation.
Attack-surface reduction	Read-only endpoint OS and curated applications	Fewer mutable local components and less configuration drift.
Secure remote access	Trusted endpoint plus partner ZT/PRA controls	Scoped vendor/admin access with reduced reliance on broad network access.
Change control / repeatability	Centralized policy, app delivery, and golden configuration	Repeatable deployment across plants with controlled variance.
Resilience / recovery	Known-good endpoint state and rapid reprovisioning patterns	Reduced dependency on manual endpoint rebuilds during disruption.
Advanced workload governance	Isolation through managed workload patterns and ecosystem controls	A governed path for containers, analytics, and AI instead of shadow execution.

These capabilities support implementation of framework controls; they should not be presented as automatic certification or compliance. Final control ownership, evidence requirements, and applicability remain customer-specific.

What Field Deployments Are Showing

Recent manufacturing and life-sciences engagements reinforce several repeatable patterns. Customer names are intentionally omitted here because the lessons are architectural, not account-specific.

• Pharmaceutical manufacturing: persistent RDP/Citrix access, strict qualification requirements, and global standardization needs are driving interest in persona-based policy, NAC, browser modernization, and controlled migration of legacy Windows workloads.
• Discrete manufacturing: web interfaces are increasingly preferred for dataless operator use cases, while RDP remains necessary for legacy applications. This makes a multi-interface endpoint more practical than a single-protocol strategy.
• Factory-floor modernization: customers want to preserve OEM control stacks while reducing endpoint variance, support burden, and local Windows dependency.
• AI planning: customers are beginning to design agent and analytics use cases at the edge, increasing the importance of a governed execution environment before local AI becomes another unmanaged endpoint layer.
• Analyst feedback: immutability alone is not sufficient. The endpoint must participate in a broader architecture that includes hardware trust, a control plane, network access control, contextual policy, and an ecosystem capable of supporting real operational workloads.

Reference Architecture: Secure OT Access and Execution Fabric

The reference architecture below is intentionally OEM-agnostic. It shows where standardization can occur while allowing plants to retain the systems and protocols that production requires.

Layer	Representative components	Role
Enterprise / security policy	IAM, SASE/ZTNA/PRA, SIEM/SOC, GRC, PKI	Identity, access, security analytics, governance, and enterprise policy.
IGEL control plane	UMS™, policy, enrollment, configuration, app/workload lifecycle, APIs	Common policy and lifecycle authority for the endpoint estate.
Network policy	Cisco ISE, Forescout, switching/firewall segmentation	Comply-to-connect, admission, segmentation and zone policy.
Trusted execution edge	IGEL OS™, approved apps, browser, RDP clients, IMH™/IMC™ patterns	Immutable endpoint execution and controlled workload boundary.
OT application layer	MES, SCADA/HMI, DCS, WMS, BMS, historian, engineering tools	Production and operational applications reached through approved interfaces.
Industrial workload layer	OEM agents, VMs, containers, OCI/Margo-aligned packages, analytics/AI	Modern and legacy workloads with isolation and lifecycle control.
Physical process	PLCs, controllers, robots, sensors, scanners, printers, instruments	Production assets remain governed by the appropriate safety and control architecture.

Design principle: do not collapse IT and OT into one trust zone. Use a common policy and execution foundation to make the boundary explicit, manageable, and repeatable.

Business and Operational Outcomes

Taken together, these architectural choices translate into a set of practical business and operational outcomes:

Outcome	How the architecture contributes
Operational resilience	Reduces endpoint variability and enables rapid restoration to a known-good state without redesigning the production application.
Lower lifecycle complexity	Centralizes policy and application delivery across heterogeneous access methods and hardware classes.
Reduced Windows dependency	Moves selected console and access use cases away from a general-purpose Windows endpoint while preserving Windows applications where required.
Faster plant standardization	Creates reusable templates for endpoint, identity, network admission, and application access across sites.
Improved third-party control	Provides a governed endpoint and scoped remote-access pattern for OEMs, contractors, and administrators.
Reduced shadow IT / AI	Gives users and engineering teams approved ways to run browsers, agents, containers, and advanced workloads without unmanaged endpoints.
Framework reuse	Maps a common set of technical controls to multiple governance frameworks rather than creating separate architectures.
Future-ready edge	Provides a path from RDP and browser access to containers, open edge orchestration and AI-enabled workloads without abandoning legacy systems prematurely.

Conclusion

Extending the secure digital workspace into OT is no longer only about giving an operator a thin-client session to a data-center application. The more important opportunity is to establish a common, trusted execution and policy foundation across the factory floor. That foundation can support legacy and modern access methods, integrate endpoint state into network admission, control remote access, reduce shadow IT and AI, and provide a reusable technical control set for multi-framework governance.

The IGEL Adaptive Secure Endpoint Platform™ enables organizations to modernize the endpoint edge while preserving the production systems that must remain. By standardizing the access and execution boundary rather than forcing a single OEM stack, industrial organizations can move toward a more resilient, secure and open operating model at the pace their plants can safely absorb.