In short: Zero Networks OT and IoT segmentation protects devices that cannot run agents, such as industrial controllers, building systems and connected devices. It learns their real connections, enforces least-privilege rules through access control lists on your existing switches and puts just-in-time MFA in front of admin access. Forever Systems licenses it per device, billed monthly.
What Zero Networks OT and IoT segmentation is
Factories, warehouses, laboratories, hospitals and office buildings are full of devices that cannot protect themselves: programmable logic controllers, building management systems, CCTV, printers, medical and lab equipment. They often run old software, cannot be patched on a normal schedule and will never run an endpoint agent. On a flat network they are an easy entry point, and an attacker who reaches IT systems can often reach them too.
Zero Networks extends its segmentation to these devices without touching them. Nothing runs on the OT or IoT asset itself: the platform learns real connections, builds least-privilege rules and enforces them through access control lists on the switches and routers the devices already connect to, alongside host firewalls on the IT systems they talk to. Rules can be modelled against real traffic first, so you can see what a policy would block before it reaches a production network.
What is included
| Capability | What it does |
|---|---|
| Agentless protection | Nothing is installed on the OT or IoT device |
| Learned policy | Rules built from observed traffic rather than manual asset tagging |
| Switch-based enforcement | Access control lists on existing switches restrict device traffic |
| IT and OT separation | One policy engine and console across data centre, cloud and OT |
| Just-in-time MFA | Admin protocols such as RDP, SSH, RPC, WMI and SMB need MFA first, including when the target is OT network equipment |
| Central visibility | See which devices communicate with what |
Because the same platform protects your servers and workstations, you manage IT and OT segmentation in one place rather than buying a separate tool for the plant floor.
How it is licensed
OT and IoT segmentation is licensed per device segmented.
| Option | Licensing unit | Notes |
|---|---|---|
| Zero Networks Segmentation for OT/IoT | Per device | For devices that cannot run agents |
It is billed monthly on your Forever Systems invoice and is usually bought alongside Network Segmentation for the servers and workstations that interact with OT systems. We help you build a device inventory first, since many organisations find more connected devices than they expected. Ask us for a quote.
Requirements and deployment
Switch-based enforcement depends on your network equipment, so we start by reviewing how OT and IoT devices are connected and which switches they sit behind. We then confirm compatibility with Zero Networks' current requirements before you commit.
Deployment follows the platform's usual pattern: discover devices, learn real traffic, review the proposed rules with the people who run the equipment, and enforce in stages. Working with operations or facilities staff matters here, because some OT traffic happens rarely (for example, maintenance connections from a supplier) and needs to be accounted for before rules go live.
Who it suits and how we help
OT and IoT segmentation suits manufacturers, logistics and utilities businesses, healthcare and research organisations, schools and colleges with building systems, and any organisation with connected devices it cannot patch. It is also relevant where an insurer or customer is asking how IT and OT networks are separated.
We scope the device estate, coordinate with your operations team, deploy and review the rules and handle ongoing changes. For supplier maintenance access, pair it with Zero Networks Connect. Browse more in firewalls and network security, or go back to the Zero Networks overview.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can Zero Networks protect devices that cannot run an agent?
Yes. That is the purpose of OT and IoT segmentation: policy is enforced through access control lists on your switches, so nothing is installed on the device.
How is Zero Networks OT/IoT segmentation licensed?
Per device segmented, billed monthly through Forever Systems.
Do I need new network hardware?
Zero Networks enforces OT policy through the switches and routers already connecting your devices, so the approach is built around your existing network rather than new appliances. We check your switches against Zero Networks' current requirements before you order.
Can it separate our IT and OT networks?
Yes. The same policy engine covers IT and OT, so you can restrict which IT systems can reach OT devices and require MFA for admin access.