Industrial sites used to be safe because they were separate. Operational Technology (OT, the systems that run physical processes: programmable logic controllers, SCADA, sensors) sat behind an air gap, with no path to the corporate network or the internet. Industry 4.0 dissolved that gap. Predictive maintenance, real-time analytics and global supply chains all need the factory floor to talk to the cloud, and that exposes equipment that was never designed to be reachable.
The common reflex is to buy another OT tool. The more useful question is narrower: how do you secure the boundary where IT and OT now meet, without touching the equipment that runs production?
Brixio, an Authorized Cloudflare Service Delivery Partner (ASDP), secures the IT/OT boundary with five Cloudflare capabilities: Magic WAN for segmentation, Access for Zero Trust remote access, Gateway for DNS and traffic filtering, Tunnel to remove public exposure, and WAF for virtual patching. None of them replace OT monitoring platforms; they secure the network around the OT environment.
Each of the five sections below covers what one capability does and where it stops.
Why the IT/OT boundary is the real attack surface
The Purdue model, the reference architecture for industrial networks, was designed in the 1990s for a strictly hierarchical, predictable flow of data. Its perimeter sat at Level 3.5, a demilitarised zone enforced by a physical firewall between operations and IT.
That perimeter is now bypassed from both sides. Industrial IoT sensors and smart devices open direct, bidirectional connections to the cloud that bypass the Level 3.5 firewall entirely. A static, hardware-defined perimeter cannot see or govern those flows.
This plays out across critical industries. A multi-site car plant, a water treatment site, an oil and gas terminal, a hospital's biomedical network and a logistics hub all run converged IT and OT today, and each inherits the same exposed boundary. The stakes differ, from a halted production line to an interrupted public utility, but the failure point is identical.
The risk is documented. In May 2021, DarkSide ransomware hit the IT network of Colonial Pipeline, the largest fuel pipeline in the United States. The operational systems were not breached, but the operator disconnected them as a precaution, which halted all pipeline operations and disrupted fuel supply across the US East Coast, according to CISA. The lesson is the convergence itself: when IT and OT are not cleanly separated, an IT incident can take production offline even when the OT is never directly touched.
When the perimeter dissolves, security can no longer be a fortress at one chokepoint. It has to move to the network itself, verifying every connection regardless of where it originates. That is the shift from perimeter defence to a Zero Trust boundary.
Securing this boundary does not mean rebuilding the OT network. It means adding a control layer around it. The five capabilities below each address one specific failure of the old perimeter. For the wider strategy, see our IT/OT convergence security solution; for the foundations, the difference between IT and OT security.
A note on where these capabilities sit. Four of them are part of Cloudflare's SASE platform, Cloudflare One.
- SASE (Secure Access Service Edge) converges network connectivity and cloud-delivered security at the edge: Magic WAN provides the network layer, while Access (ZTNA), Gateway (secure web gateway) and Tunnel (private connectivity) provide the security layer, known as SSE (Security Service Edge).
- The fifth, WAF, is not SASE; it is application security that protects inbound traffic to exposed interfaces.
Together they cover the IT/OT boundary from both directions: outbound access on one side, inbound protection on the other. This is what a SASE deployment looks like applied to an industrial environment.
Feature 1: Cloudflare WAN (Magic WAN) to segment zones and conduits
The first job is segmentation: keeping a compromise in corporate IT from reaching the production floor. For a manufacturer running several plants, that means a phishing compromise in the head office cannot reach a robotised line. Cloudflare WAN (formerly Magic WAN) connects data centres, sites and cloud resources over Cloudflare's network using IPsec or GRE tunnels and direct interconnects. Its virtual networks provide routing isolation, keeping traffic separated between environments, and its Network Firewall filters traffic at layers 3 and 4 as a service.
In IEC 62443 terms (the reference standard for industrial cybersecurity), this lets you define zones (groups of assets with common security needs) and the conduits between them in software, instead of relying on physical cabling and appliances. You modernise the Purdue zone-and-conduit model without re-architecting the plant.
Expert tip: map each IEC 62443 conduit to a Cloudflare WAN virtual network early. It makes the later audit far simpler, because the segmentation is documented in policy rather than inferred from switch configurations.
Feature 2: Cloudflare Access to replace the VPN for OT access
Third-party and remote access is where most OT incidents begin. Consider a turbine vendor servicing a power plant, or a pump supplier maintaining a water treatment site: each connects over a VPN, and the VPN grants broad network trust. Once inside, a compromised laptop can move laterally toward production.
This is not hypothetical. In December 2015, attackers used legitimate credentials and VPN connections to remotely operate the breakers at three Ukrainian electricity distribution companies, cutting power to roughly 225,000 customers, according to CISA. The broad network trust granted through remote access was the enabling condition.
Cloudflare Access applies Zero Trust Network Access (ZTNA). It verifies identity and device posture on every request and grants access to a specific system rather than the network. It covers self-hosted applications, SSH, VNC and RDP, internal IPs and hostnames, and arbitrary L4 to L7 traffic, which is what OT-adjacent systems actually use. An engineer reaches the one machine they are authorised for, and nothing else. Lateral movement across the network is removed by design.
Where this fits against dedicated OT tooling is covered in our comparison of Cloudflare and OT-native vendors.
Feature 3: Cloudflare Gateway to filter DNS and traffic for OT-adjacent networks
Many OT-adjacent systems, such as the historians and engineering workstations at an oil and gas facility, need outbound internet access for updates or telemetry. That outbound path is also how malware calls home.
Cloudflare Gateway filters that traffic at three levels:
- DNS policies block a malicious domain from resolving at all.
- Network policies inspect TCP, UDP and GRE traffic by IP, port and protocol.
- HTTP policies inspect the full content of web requests, decrypting HTTPS to see what DNS and network rules cannot.
Egress policies send that traffic out through fixed IP addresses you own. For an OT-adjacent network, this blocks command-and-control and malware delivery before a connection is established.
Feature 4: Cloudflare Tunnel to make the factory invisible
Raw industrial protocols such as Modbus TCP, S7 and DNP3 were never built with authentication. Any inbound port left open to support remote access is an invitation to automated scanners that map exposed industrial systems. A remote water pumping station or an unmanned electrical substation is exactly the kind of site that ends up exposed this way.
Cloudflare Tunnel removes the inbound port entirely. A lightweight daemon, cloudflared, makes an outbound-only connection from inside the network to Cloudflare over port 7844, with no publicly routable IP address. You can then configure the firewall to allow only that outbound connection and block all inbound traffic. The services stay reachable for authorised users through Cloudflare, while the site itself becomes undetectable from the public internet.
Feature 5: Cloudflare WAF to virtually patch what you cannot reboot
OT systems often run operating systems that are years or decades out of support. On a manufacturing line, an HMI panel still running a long-unsupported Windows release is common, because patching means a reboot and a reboot means stopping production. Known vulnerabilities therefore stay open for months.
The Cloudflare Web Application Firewall (WAF) inspects HTTP and HTTPS requests at the edge and blocks malicious payloads, including OWASP Top 10 attacks such as SQL injection and cross-site scripting, before they reach the application. Through virtual patching, it blocks exploits targeting specific CVEs (catalogued vulnerabilities) at the network layer. The exposed web interface of an industrial system, an HMI or a manufacturing execution system portal, is protected immediately, without touching the device's code and without a maintenance window.
Beyond the access boundary, Cloudflare Magic Transit protects the wider convergence layer against volumetric DDoS attacks, absorbing them across a global network that exceeds 500 Tbps of capacity. That is a different problem and a different deployment, covered separately in our work on IT/OT convergence risks.
Not sure which of these capabilities your sites actually need? Brixio maps your IT/OT boundary and scopes the right controls before any deployment. → Book a free OT security assessment
What these five features do not do
This is the part most vendors leave out. These capabilities secure the network around OT. They do not look inside it.
| Capability | Cloudflare boundary | OT-native monitoring |
|---|---|---|
| Zero Trust remote access | Yes | No |
| Network segmentation and transport | Yes | No |
| DNS, network and HTTP filtering | Yes | No |
| Virtual patching at the edge | Yes | No |
| OT/ICS asset discovery and inventory | No | Yes |
| OT protocol deep inspection (Modbus, DNP3, S7) | No | Yes |
| ICS threat and process-anomaly detection | No | Yes |
Cloudflare secures the network boundary and the conduits between zones. OT-native platforms such as Claroty, Dragos or Nozomi provide asset discovery and threat detection inside the OT network. They are complementary layers, not competing tools, and both are necessary parts of a broader OT security programme.
The full side-by-side is in Cloudflare vs OT-native vendors.
How Brixio deploys this without downtime
The technology is only half the answer. Deploying it in a live industrial environment, where an unplanned restart is not an option, is the other half.
As a Cloudflare ASDP, Brixio deploys this control layer as an overlay: it sits around the existing equipment without modifying it and without interrupting production. The method runs in three phases:
- Audit and discovery: mapping shadow IT, unmanaged devices and real traffic flows.
- Architecture and deployment: integrating the relevant capabilities without disturbing the controllers.
- Continuous operation: the rules adapt as the environment and the regulations (such as NIS2) evolve.
This pairs with sector-specific work for manufacturing, energy and transport.
FIELD PROOF
What it looks like in production, at our clients.
Across two airports, access ran through scattered VPNs and remote paths. Replaced by Cloudflare Access: identity-based, per-application access.
Four entities to connect without rebuilding anything. An Access, Gateway and Tunnel overlay deployed on top of the existing stack.
Critical trade infrastructure exposed at the edge. Protected by WAF, bot management and DDoS mitigation, with no downtime.
Frequently asked questions
No. Cloudflare secures the network boundary around OT: access, segmentation, filtering and exposure. OT-native platforms provide visibility and threat detection inside the OT network. The two are complementary. See Cloudflare vs OT-native vendors.
Yes, indirectly. The WAF blocks known exploits at the edge through virtual patching, so an unpatched or out-of-support system is shielded without a reboot. This mitigates exposure; it does not fix the underlying vulnerability on the device.
No. The control layer is deployed as an overlay around existing equipment, with no modification to controllers and no production downtime.
The capabilities secure the conduits between zones and the access paths into them. They modernise the Level 3.5 boundary that physical firewalls no longer cover, without replacing the underlying OT architecture.
Secure your IT/OT boundary
Brixio assesses your current exposure and designs the control layer before any deployment.
Primary CTA: Book a free OT security assessment
Secondary CTA: See our IT/OT deployment methodology
