Seclab Xcore Platform,
for Defense in Depth in OT

The distinction is twofold. First, Seclab integrates a layer of physical protection through patented Electronic Air Gap: where competitors detect attacks, Seclab structurally blocks them by removing network connectivity to critical assets. Second, the platform follows a graduated philosophy via the OT Maturity Response Model—8 progressive milestones that guide each organization from its actual maturity level, concentrating maximum protection on the MVDI perimeter (the truly vital assets).

Applying maximum protection across the entire OT estate creates unmanageable complexity, uncontrolled costs, and operational constraints that can themselves threaten availability. Seclab’s approach takes the opposite path: during the DISCOVER phase, assets whose failure would be critical are identified, and physical protection via Electronic Air Gap is concentrated on this focused perimeter.

• Maximum efficiency: protection resources are focused on real risk, not scattered across secondary assets.
• Controlled cost and complexity: the protected perimeter is limited, reducing the number of devices to deploy and maintain.
• Structural guarantee: MVDI assets cannot be compromised via the network, by physical design—not by statistical probability. It is deterministic, not probabilistic protection.

Since 2011, Seclab has been developing its solutions in the most constrained industrial sectors—civil nuclear, rail transport, and space—where even the slightest interruption is unacceptable and certifications are extremely strict. This heritage is reflected in every product of the XCore platform.

Xplore’s Purdue view instantly checks compliance with ISA-95 inter-level segmentation. The flow matrix ensures that only authorized business flows pass between zones, in accordance with the principle of least privilege. Deviations between theoretical and observed segmentation are identified, and corrective actions are prioritized based on impact.

IT and OT teams have radically different priorities, tools, vocabularies, and technology lifecycles (3–5 years in IT vs. 15–25 years in OT). IT security policies cannot be directly applied to industrial environments, and IT solutions generate alerts that OT operators may struggle to interpret.

• Multi-view mapping: network, Purdue, logical, business, geographic—each role (IT network engineer, OT automation engineer, CISO, plant manager) works in their familiar view on shared data.
• Zero-Trust administration in Xchange: dual IT/OT access control formalizes co-responsibility. OT teams retain control overflows entering their perimeter.
• Intelligent alert routing: each signal is directed to the right person; in a language they understand.
• Native interoperability: integration with existing firewalls, SIEM, SOC, bastions, and CMDB—no additional silo.

IT cybersecurity tools (antivirus, EDR, next-gen firewalls) are not suited to industrial constraints: frequent updates incompatible with maintenance cycles, false positives that can trigger production shutdowns, and an unmanageable volume of alerts for often limited teams. Against an OT ransomware attack or a targeted attack on a PLC, the delay between detection and response can be enough to cause production stoppages or industrial accidents.

You can only protect what you know. Seclab Xplore passively maps connected assets, network flows, and vulnerabilities without ever interacting with the equipment. This continuously updated inventory forms the foundation of any OT cybersecurity strategy.

Once critical assets are identified (the MVDI), network physical isolation via Xchange removes any direct connectivity between critical assets and risky zones. USB isolation via Xport closes the second major attack vector in OT environments. This step is decisive: it structurally blocks attack propagation even before detection occurs.

In OT, network changes are less frequent than in IT. The most effective approach is to detect deviations—new flows, new devices, behavior changes—rather than identifying each threat individually. This method produces fewer false positives and is suited to OT teams. Pre-isolating critical assets reduces the monitoring surface and the volume of alerts to manage.