Executive Summary
A Fortune 500 diversified manufacturer operating 42 facilities with 850+ OT assets spent 18 months and $765,000 attempting to deploy an IT-centric PAM solution. After covering only 12 of 42 sites, accumulating 7 compliance findings, and achieving user satisfaction of 4.2 out of 10, the organization replaced the failed deployment with Xona Critical System Gateways.
The result is what Xona calls disconnected access: users interact with OT systems in real time, but their endpoints are never connected to the OT network. Deploying across all 42 facilities in just 14 days, with an 18-minute average per site and no network changes, the manufacturer achieved 100% asset coverage, passed its IEC 62443 audit on the first attempt, reduced security incidents by 87%, and cut projected 5-year TCO by 68% to $1.985 million.
The Challenge
This manufacturer produces chemicals, polymers, and building materials across 42 process manufacturing facilities. With 850+ OT assets connected via Modbus, OPC UA, EtherNet/IP, and Profinet, the organization required secure remote access for 275 internal OT engineers and 180+ third-party vendors and OEM contractors. Eighteen months earlier, the organization invested in an IT-centric PAM platform with deeply disappointing results:
-
Stalled deployment: After 18 months and $765,000 ($425,000 licensing plus $340,000 professional services, an 80% cost overrun), only 12 of 42 facilities were operational.
-
No OT protocol support: No native support for Modbus, OPC UA, EtherNet/IP, or Profinet, forcing OT teams to maintain parallel access methods.
-
7 compliance findings: Audit gaps in access governance, session monitoring, and evidence. The PAM tool lacked OT-specific session recording and protocol isolation required by IEC 62443.
-
3.2 security incidents per month: With only 35% asset coverage, unauthorized access attempts, credential sharing, and unmonitored vendor sessions persisted.
-
4.2-hour vendor access time: Provisioning required coordination across IT, OT, and the PAM vendor's support team.
-
$6.28M projected 5-year TCO: Extrapolating the deployment pace to all 42 sites, not including production downtime costs.
The Xona Solution
Xona was selected for its OT-native design including protocol isolation, industrial hardware, and OT protocol support; its deployment speed of 20 minutes per site as verified in a proof of concept; and its IEC 62443 alignment, third-party tested against ANSI/ISA-62443-2-1, 3-3, and 4-2.
OT protocols terminate inside the trusted plant network. Users connect through a browser over HTTPS port 443 and receive only encrypted pixel streams, never a direct connection to the OT asset. This architecture eliminates ransomware propagation, lateral movement, and malware injection vectors. Sessions to assets communicating via Modbus, OPC UA, EtherNet/IP, Profinet, DNP3, and serial interfaces are all handled through a single browser interface.
The production deployment was completed by a different two-person team than the POC team, demonstrating that Xona's simplicity does not depend on specialized expertise. 14 calendar days from authorization to full operational coverage across all 42 facilities. Average 18 minutes from hardware mounting to first authenticated session. Zero network changes required.
The Results: Before and After
Deployment completion improved from 12 of 42 sites after 18 months to 42 of 42 sites in 14 days, a 90% faster deployment. Projected 5-year TCO dropped from $6.28M to $1.985M, a 68% reduction. Security incidents per month fell from 3.2 to 0.4, an 87% reduction. OT asset coverage went from 35% to 100%. Vendor access time dropped from 4.2 hours to 8 minutes, 97% faster. Compliance findings went from 7 to zero. User satisfaction went from 4.2 out of 10 to 9.1 out of 10.
Beyond the TCO reduction, the organization recovered approximately $6.5 million per year in avoided production losses. The previous tool's access failures contributed to approximately 35 hours per month of unplanned downtime at $185,000 per hour. A single prevented access-related incident returns the entire 5-year platform cost.
"We spent 18 months and $765,000 getting to 12 sites with our previous solution. Xona covered all 42 in two weeks. When we passed IEC 62443 on the first attempt, the board asked what else we could deploy Xona on."
CISO, Fortune 500 Industrial Manufacturer
