Xage Fabric Platform

Brokers remote access for third-party vendors, OEM technicians, contractors and internal engineers with just-in-time provisioning, time-limited credentials, per-asset and per-session least privilege and approval workflows, replacing always-on VPN and jump-host access to OT networks.

Monitors remote sessions in real time so that supervisors can watch, join or terminate them, and records every session with full protocol-level capture for forensic review and regulatory compliance, without introducing latency that would affect OT system operation.

Provides secure remote access to OT environments with no internet connectivity using a data diode-compatible or hardware broker architecture, without requiring an internet-connected OT network.

Secure storage, automated rotation, and auditing of privileged account credentials in a vault.

Time-bound, on-demand granting of privileged access that removes standing privilege.

Automated discovery and onboarding of privileged accounts across on-premises and cloud environments.

Writes segmentation rules that reference user and group identity, device posture and workload identity rather than IP addresses or subnets, so access to a segmented resource can be conditioned on who is connecting and the state of their device, and privileged Layer 3 and 4 access such as RDP, SSH and WinRM can be gated by MFA. Topology-independent, label-based policy is table stakes for the niche; this row is for identity and posture conditions layered on top of it. Products differ in identity sources (directory, identity provider, ZTNA or EDR posture signals) and in whether MFA gating is native.

Discovers the actual north-south and east-west communication flows between workloads and devices by observing live traffic, producing the dependency data that allow-list policy is built from instead of hand-documented application maps. Products differ in flow sources (host agent, network sensors or switch telemetry, cloud flow logs, virtual switch) and therefore in how completely agentless assets are covered.

Classifies discovered assets and traffic flows into Purdue Model levels (Level 0-4), supporting IEC 62443 zone and conduit documentation and compliance assessment.

Turns observed OT traffic and Purdue zone assignments into least-privilege zone and conduit policies, simulates their effect before rollout so that legitimate control traffic is not blocked, and enforces them either through the vendor's own firewalls and switches or by pushing rules to integrated third-party firewalls, switches and NAC. Native enforcement versus integration-only enforcement is the main difference between products.

Establishes and manages per-device identity and access over the device lifecycle, including certificate and credential provisioning and rotation.