M A N U F A C T U R I N G O T C A S E S T U D I E S

OT Security Built for Live Production. Five manufacturing deployments across live plants,

legacy systems, and complex operations.

THE CUSTOMER NAMES ARE REMOVED. THE TECHNICAL DETAILS ARE NOT.

I N S I D E   T H E   D E P L O Y M E N T S

Five OT Problems That Could Not Wait Each story starts with a real production constraint - and ends with the

architecture and proof behind the result.

Can you turn protection on without putting the line at risk?

29 gateways remediated in one session

01

03

Can you secure legacy OT without touching the machines?

Seven production sites secured with zero downtime

02

04

Can segmentation scale without multiplying hardware?

One redundant OT cluster per plant across 15 plants

03

05

Can one security model work across multiple factories?

30+ factories, 100 firewalls, no full network redesign

04

06

Can global policy scale without taking control away from the plants?

500+ firewalls in one domain across 700+ sites

05

07

The control principles behind every architecture

06

08

What kept all five deployments from disrupting production?

OT SECURITY CASE STUDIES | 2

Mapped the real OT environment: Claroty CTD identified the assets and communication paths behind each plant gateway. Matched IPS protections to exposed assets: Check Point Exposure Management showed which protections applied to the vulnerabilities found on those assets. Enabled protection centrally: The team reviewed and activated the right protections from one management interface, while each plant retained its own policy package. Enforced at the network layer: Existing Check Point Security Gateways applied the controls at Layer 3, with no changes inside production systems.

01

W H A T   C H A N G E D

✓

✓

✓

✓

PIPE & FITTINGS MANUFACTURER  |    9 PLANTS

T H E   C H A L L E N G E

A R C H I T E C T U R E I N P R O D U C T I O N

Protection Turned On.  Production Kept Running.

29 gateways remediated in one session.

Detect-only IPS replaced by active prevention based on real OT exposure.

No reported false positives or production disruption.

A formal IT/OT boundary at the newest plant.

9 PLANTS

29 GATEWAYS

1 REMEDIATION

SESSION

0 PRODUCTION

SYSTEMS TOUCHED

IPS was already deployed across nine plants, but most protections stayed in detect mode. Known vulnerabilities remained open because one wrong activation could interrupt production - and the team could not safely validate every protection by hand.

H O W W E S O L V E D I T

Inbound attack surfaces removed across all nine plants.

Proactive remediation with the same team - no added headcount or production-system changes.

✓

✓

OT Asset Discovery

Claroty CTD · assets & communication paths

OT SECURITY CASE STUDIES | 3

02

Default-deny IT/OT POLICY

Session- based

VENDOR ACCESS

W H A T   C H A N G E D

✓

✓

✓

✓

TEXTILE MANUFACTURER  |    7 PRODUCTION SITES

H O W   W E   S O L V E D   I T

Seven Plants Secured Without Changing the Machines.

One security architecture across seven sites with zero production downtime.

Every IT-to-OT crossing explicit, logged, and governed by allowlist policy.

Vendor access limited to approved systems and approved sessions.

Centralized OT traffic monitoring across all sites.

7 PRODUCTION SITES

0 PRODUCTION

DOWNTIME

T H E   C H A L L E N G E

Unpatched legacy machines, flat OT networks, and open vendor access spanned seven production sites. There was no safe downtime window, limited in-house expertise, and no tolerance for machine changes or risk to the line.

Purdue-aligned boundaries: Security Gateways, Maestro, and ruggedized appliances separated corporate IT, the industrial DMZ, and production. No direct IT-to-OT paths: Every connection crossed the controlled DMZ. Default-deny rules blocked anything not explicitly approved. Controlled vendor access: Check Point SASE replaced open, persistent connections with session- based, least-privilege access to approved systems. Staged rollout: Exposure Management and Email Security added context on the IT side. No OT asset was patched, reconfigured, or stopped.

A R C H I T E C T U R E I N P R O D U C T I O N

Audit-ready policy evidence aligned with IEC 62443.

Network-layer enforcement with no patching or machine changes.

✓

✓

OT SECURITY CASE STUDIES | 4

03

1 HA Cluster PER PLANT

Layer 3 ZONE SEGMENTATION

W H A T   C H A N G E D

✓

✓

✓

✓

PAPER MANUFACTURER  |    15 PLANTS

T H E   C H A L L E N G E

A R C H I T E C T U R E I N P R O D U C T I O N

Stronger Segmentation.  Far Less Hardware.

One repeatable segmentation architecture across all 15 plants.

Less hardware, policy, and maintenance sprawl.

No cell-level single points of failure; zone isolation preserved.

SCADA protocol visibility and IPS virtual patching for legacy assets.

15 PRODUCTION PLANTS

0 PRODUCTION

REDESIGN

Firewalls at every production cell delivered isolation, but became an operational burden across 15 plants. Each new cell added hardware, policy, maintenance, and another failure point on a live line. Zone separation still had to be preserved - without site redesigns or production downtime.

H O W   W E   S O L V E D   I T

Consolidated plant enforcement: The firewall-per-cell model was replaced with one high-availability OT gateway cluster in each plant. Preserved zone separation: All inter-zone traffic crossed the cluster and was controlled through Layer 3 VLAN-based policy. Standardized management: One central policy model governed the estate, while each plant retained dedicated packages for its own OT VLANs. Protected industrial traffic: Application Control inspected SCADA communications, while IPS virtual patching blocked known exploits at the network layer.

No agents, endpoint changes, production redesign, or line shutdown.✓

Plant OT HA Cluster Redundant Gateway Pair

✓ One HA OT cluster per plant instead of multiple cell-level firewalls.

OT SECURITY CASE STUDIES | 5

04

✓

✓

✓

✓

METAL MANUFACTURER  |    30+ INDEPENDENT FACTORIES

One OT Security Model Across 30+ Different Factories.

One enforcement model across 30+ different factories - without a full network redesign.

A consistent IT/OT boundary across the factory estate.

Explicit allow rules in place of permissive VLAN traffic.

Required industrial traffic kept operational under active threat prevention.

30+ INDEPENDENT

FACTORIES

~100 SECURITY GATEWAYS

1 MANAGEMENT PLANE

0 FULL NETWORK

REDESIGN

Mapped before enforcing: Claroty CTD identified OT assets, communication paths, and zone boundaries, providing the context for explicit policy. Established a common enforcement layer: ~100 Check Point Security Gateways were deployed at Purdue Level 3.5. Kept protection active: IPS, Anti-Bot, Antivirus, Application Control, and URL Filtering remained enabled while approved Modbus TCP/502 traffic continued to pass. Centralized governance, preserved local tuning: Each factory retained its own policy, with identity- aware, audit-ready controls for vendors and contractors.

H O W   W E   S O L V E D   I T

30+ factories left with different network designs after acquisitions, flat OT environments, permissive VLAN traffic, and no consistent IT/OT boundary. Redesigning every site was unrealistic; managing each factory as a separate security project would never scale.

T H E   C H A L L E N G E

✓

✓

No downtime for enforcement changes.

No dedicated security team required at every factory.

W H A T   C H A N G E D

A R C H I T E C T U R E I N P R O D U C T I O N

OT Asset Discovery

Claroty CTD · assets, paths & zones

OT SECURITY CASE STUDIES | 6

~100 gateways · 30+ factories

05

700+ SITE FOOTPRINT

500+ FIREWALLS IN ONE

DOMAIN

Shared GLOBAL POLICY

Per-site INLINE LAYERS

W H A T   C H A N G E D

✓

✓

✓

✓

GLOBAL EQUIPMENT MANUFACTURER  |    700+ SITE FOOTPRINT

T H E   C H A L L E N G E

A R C H I T E C T U R E I N P R O D U C T I O N

One Global Policy.  Each Site Kept Control.

One policy framework across 700+ sites.

Common rules shared globally; local access requirements kept local.

Less firewall and policy sprawl - without equivalent headcount growth.

Greater operational stability without sacrificing plant-level flexibility.

Hundreds of sites needed one security standard - but not one rigid rulebase. OT/IT segmentation had to stay consistent without taking away local control, creating policy sprawl, or forcing security headcount to grow with the footprint.

H O W   W E   S O L V E D   I T

Centralized management: One Multi-Domain Security Management domain - one CMA - manages 500+ firewalls. Shared global policy: Common rules inherited across the environment, not recreated site by site. Contained local requirements: Per-site inline layers hold plant-specific access rules and exceptions without weakening the shared standard. Preserved local enforcement: Each facility retains its own enforcement point, with Security Gateways, Maestro, and cloud firewalls managed centrally through Smart-1.

✓ More than 500 firewalls under one management domain.

One Mgmt Domain

500+ firewalls

OT SECURITY CASE STUDIES | 7

700+ Site Footprint Local enforcement per site

Control the Paths. Keep Production Running.

Enforcement - Not Visibility Alone

Map the right controls for your production environment

Talk to a Check Point OT Security Expert

Protection Without Changing Production Assets

Consistent Policy. Local Control.

W H A T W O R K S A C R O S S D I F F E R E N T P L A N T S

Network-layer controls and virtual patching protected legacy systems without agents, patches, or machine changes.

Central policy stayed consistent while local packages and inline layers kept site-specific rules local.

Get In Touch

Asset and traffic context drove IPS activation, explicit allow

rules, segmentation, and industrial application control.

Different plants. Different architectures. The same three priorities: enforce control, protect production, preserve local flexibility.

OT SECURITY CASE STUDIES | 8

https://pages.checkpoint.com/manufacturing-vertical-demo-request.html

Built for Live Production. OT SECURITY CASE STUDIES | 2 Can you turn protection on without putting the line at risk? Can you secure legacy OT without touching the machines? Can segmentation scale without multiplying hardware? Can one security model work across multiple factories? Can global policy scale without taking control away from the plants? What kept all five deployments from disrupting production? OT SECURITY CASE STUDIES | 3 PIPE & FITTINGS MANUFACTURER  |  9 PLANTS

Protection Turned On.  Production Kept Running. THE CHALLENGE IPS was already deployed across nine plants, but most protections stayed in detect mode. Known vulnerabilities remained open because one wrong activation could interrupt production - and the team could not safely validate every protection by hand.

HOW WE SOLVED IT Mapped the real OT environment: Claroty CTD identified the assets and communication paths behind each plant gateway. Matched IPS protections to exposed assets: Check Point Exposure Management showed which protections applied to the vulnerabilities found on those assets. Enabled protection centrally: The team reviewed and activated the right protections from one management interface, while each plant retained its own policy package. Enforced at the network layer: Existing Check Point Security Gateways applied the controls at Layer 3, with no changes inside production systems.

ARCHITECTURE IN PRODUCTION OT Asset Discovery

WHAT CHANGED 29 gateways remediated in one session. Detect-only IPS replaced by active prevention based on real OT exposure. No reported false positives or production disruption. A formal IT/OT boundary at the newest plant. Inbound attack surfaces removed across all nine plants. Proactive remediation with the same team - no added headcount or production-system changes.

9 PLANTS 29 GATEWAYS 1 REMEDIATION SESSION 0 PRODUCTION SYSTEMS TOUCHED OT SECURITY CASE STUDIES | 4

Seven Plants Secured Without Changing the Machines. THE CHALLENGE Unpatched legacy machines, flat OT networks, and open vendor access spanned seven production sites. There was no safe downtime window, limited in-house expertise, and no tolerance for machine changes or risk to the line.

HOW WE SOLVED IT Purdue-aligned boundaries: Security Gateways, Maestro, and ruggedized appliances separated corporate IT, the industrial DMZ, and production. No direct IT-to-OT paths: Every connection crossed the controlled DMZ. Default-deny rules blocked anything not explicitly approved. Controlled vendor access: Check Point SASE replaced open, persistent connections with session-based, least-privilege access to approved systems. Staged rollout: Exposure Management and Email Security added context on the IT side. No OT asset was patched, reconfigured, or stopped.

ARCHITECTURE IN PRODUCTION WHAT CHANGED One security architecture across seven sites with zero production downtime. Every IT-to-OT crossing explicit, logged, and governed by allowlist policy. Vendor access limited to approved systems and approved sessions. Centralized OT traffic monitoring across all sites. Audit-ready policy evidence aligned with IEC 62443. Network-layer enforcement with no patching or machine changes.

Default-deny IT/OT POLICY Session- based VENDOR ACCESS OT SECURITY CASE STUDIES | 5 PAPER MANUFACTURER  |  15 PLANTS

Stronger Segmentation.  Far Less Hardware. THE CHALLENGE Firewalls at every production cell delivered isolation, but became an operational burden across 15 plants. Each new cell added hardware, policy, maintenance, and another failure point on a live line. Zone separation still had to be preserved - without site redesigns or production downtime.

HOW WE SOLVED IT Consolidated plant enforcement: The firewall-per-cell model was replaced with one high-availability OT gateway cluster in each plant. Preserved zone separation: All inter-zone traffic crossed the cluster and was controlled through Layer 3 VLAN-based policy. Standardized management: One central policy model governed the estate, while each plant retained dedicated packages for its own OT VLANs. Protected industrial traffic: Application Control inspected SCADA communications, while IPS virtual patching blocked known exploits at the network layer.

ARCHITECTURE IN PRODUCTION WHAT CHANGED One repeatable segmentation architecture across all 15 plants. One HA OT cluster per plant instead of multiple cell-level firewalls. Less hardware, policy, and maintenance sprawl. No cell-level single points of failure; zone isolation preserved. SCADA protocol visibility and IPS virtual patching for legacy assets. No agents, endpoint changes, production redesign, or line shutdown. 15 PRODUCTION PLANTS

1 HA Cluster PER PLANT 0 PRODUCTION REDESIGN

One OT Security Model Across 30+ Different Factories. OT SECURITY CASE STUDIES | 7 GLOBAL EQUIPMENT MANUFACTURER  |  700+ SITE FOOTPRINT

One Global Policy.  Each Site Kept Control. THE CHALLENGE Hundreds of sites needed one security standard - but not one rigid rulebase. OT/IT segmentation had to stay consistent without taking away local control, creating policy sprawl, or forcing security headcount to grow with the footprint.

HOW WE SOLVED IT Centralized management: One Multi-Domain Security Management domain - one CMA - manages 500+ firewalls. Shared global policy: Common rules inherited across the environment, not recreated site by site. Contained local requirements: Per-site inline layers hold plant-specific access rules and exceptions without weakening the shared standard. Preserved local enforcement: Each facility retains its own enforcement point, with Security Gateways, Maestro, and cloud firewalls managed centrally through Smart-1.

ARCHITECTURE IN PRODUCTION One Mgmt Domain 700+ Site Footprint

WHAT CHANGED One policy framework across 700+ sites. More than 500 firewalls under one management domain. Common rules shared globally; local access requirements kept local. Less firewall and policy sprawl - without equivalent headcount growth. Greater operational stability without sacrificing plant-level flexibility. 700+ SITE FOOTPRINT 500+ FIREWALLS IN ONE DOMAIN

Control the Paths. Keep Production Running. Map the right controls for your production environment

Talk to a Check Point OT Security Expert Get In Touch