Secure Edge Protection Solution
Every command your PLC accepts is verified first. Secure Edge Protection puts enforcement at the control layer, on the PLCs and workstations you already run, so unauthorised changes are stopped before they reach production.
Three questions every plant should be able to answer
In many plants the honest answer is "anyone who can reach the network". Secure Edge Protection turns each answer into a written policy that is enforced, not assumed.
Who can edit or download a program to a PLC?
On many control networks, any engineering workstation that can reach the controller can change its logic while the line is running.
Who can change a setpoint?
A single altered value can push dosing, heating or speed out of range, and put equipment, product and people at risk.
Who decides whether a contractor may connect their own laptop?
An unvetted device on the OT network can carry malware nobody has checked.
Why the control layer needs its own protection
Many industrial control networks were designed for reliability and uptime, with security added later or not at all. NIST Special Publication 800-82 Rev. 3 recognises that operational technology has performance, reliability and safety requirements of its own, which is why protection has to be designed around the plant floor and not copied from the office network.
Unvetted devices
A contractor’s laptop joins the network carrying malware nobody checked.
Unauthorised program changes
A program or firmware change is sent to a PLC while the line is running.
Tampered setpoints
A single value is altered, dosing or heating runs out of range, and equipment, product and people are at risk.
Teams also often cannot see who changed controller code, when, or what changed, which makes it hard to tell a hardware fault from an attack.
One rule: anything not explicitly authorised is stopped
Secure Edge Protection follows a zero-trust principle. It learns how your assets normally behave, lets you write policies that allow only the users, hosts, commands and actions your operation needs, and blocks the rest.
How it protects the edge
Two guards enforce the policy where it matters, and one controller gives your team the view.
PLC Guard: protection in front of each controller
Inspects industrial protocols packet by packet and passes only authorised users, hosts and commands. Unapproved program downloads, firmware updates and setpoint writes are blocked before they reach the PLC. It also discovers the devices on the network and records the vendor, model and firmware version of each controller.
Control Guard: lockdown for workstations
Runs on SCADA, HMI and engineering workstations. Only whitelisted software runs, so unknown code and ransomware do not execute. It reports USB connections, software installations and IP address changes, attributes activity to the user, and in Protected Mode stays in force even if administrator credentials are compromised.
Controller: one view for your team
Central management of policies, alarms and reports: every asset, every change, and an alert that shows who, what and when, with playbooks for responding. Alerts reach the person you choose by email or SMS. It can be deployed on-premises, in a virtual environment or in the cloud.
Protect the PLCs you already run
Secure Edge Protection is designed around your existing controllers and workstations, so you do not need to replace equipment to gain protection.
Start with visibility
Monitoring can start passively through a mirror port on your managed switch, which gives initial visibility without adding traffic.
Then enforce
Active protection follows once the network and the placement of each guard are understood.
Together with your network security
Edge protection and network security answer different questions: what may talk to the network, and what may talk to each PLC. For separating IT from OT and controlling who joins the plant network, see our Secure Networking solution.
What LKH Precicon does
We design, deploy and support the full solution on the PLCs you already run, backed by more than 40 years of industrial automation experience.
Who it is for
OT engineers, plant managers and automation leads at sites running legacy PLCs, and the IT engineers responsible for IT/OT convergence.
Frequently asked questions
Does it work with the PLCs we already have?
It is designed around your existing controllers and workstations, so you do not need to replace equipment to gain protection. We confirm your exact models when we assess your plant.
Will it interrupt production?
Initial monitoring is passive and does not generate traffic. Active protection is planned before anything is installed.
What if our workstations run an older version of Windows?
Control Guard is built for the Windows machines that run SCADA and engineering software, including legacy platforms. We confirm your versions when we assess your plant.
How is this different from a firewall?
A firewall controls what crosses a network boundary. Secure Edge Protection also inspects the commands sent to each PLC and controls what can run on the workstations that talk to them. The two work well together.
Who sees an alert when something is blocked?
The person you choose receives an email or SMS showing who, what and when.
Secure your control layer
Speak to our OT specialist to see how Secure Edge Protection fits your plant.
