Every sensor you add to see the asset is another way into the plant.
Condition monitoring earns its place by connecting things that were never designed to be connected. That is the value and the exposure, and they are the same decision.
On this page6
A transformer that has run for thirty years without a network port does not have a remote attack surface. The moment you bolt on a gateway so it can tell you its dissolved gas trend, it has one.
Monitoring is worth it. But you are adding a network path to equipment whose safety case was written on the assumption that no such path exists. Every condition-monitoring deployment is also a security decision, and it is usually made by people evaluating diagnostics rather than exposure.
- Level 0–2
- where monitoring hardware physically sits
- Outbound only
- how 42Hz connects. No inbound path to the asset
- IEC 62443
- the zone-and-conduit model we design against
Where monitoring sits
The Purdue Enterprise Reference Architecture is the model most OT networks are still described with. It is imperfect and everyone knows it, but it remains the shared vocabulary, so being precise about which levels condition monitoring touches is the place to start.
The value and the exposure are the same decision. A vendor who says otherwise has not read their own architecture.
| Level | What lives there | What monitoring adds |
|---|---|---|
| 0 | The physical process: the transformer, the switchgear, the drive | Sensors: acoustic, thermal, partial discharge, vibration |
| 1 | Basic control: PLCs, protection relays, IEDs | Taps on existing relay and IED data |
| 2 | Area supervisory control: SCADA and HMI | The historian and alarm feed most platforms read from |
| 3 | Site operations: historians and engineering workstations | Where a monitoring gateway is usually installed |
| 3.5 | The DMZ | Where the conduit to anything external belongs |
| 4–5 | Enterprise IT and the internet | Where the dashboard, the model and the analyst are |
Monitoring moves information from Level 0 to Level 4, from a bearing to a person who can authorize a shutdown. That crosses every boundary the model defends.
The air gap is usually a story about the past
Most sites describe themselves as air-gapped. Very few still are. Most air gaps have been bridged by a modem, a historian link or a vendor laptop that nobody removed.
A design that assumes an air gap and a site that does not have one is the gap between the security case on paper and the one you operate. The right question is not whether the network is isolated. It is what happens when it is not.
How 42Hz connects
Our deployment model is built on one constraint, and everything else follows from it: nothing external initiates a connection to your plant.
- Outbound only.
- The site edge opens a connection out. There is no listening port on the plant side, no inbound firewall rule to maintain, and no route for anything on the internet to reach the asset network by addressing it.
- Read paths by default.
- 42Hz reads condition and case history. Writing setpoints, issuing commands or changing protection settings is not something the platform does. A compromised analytics layer cannot operate your plant, because the analytics layer was never able to operate your plant.
- The conduit terminates in the DMZ.
- The edge sits at Level 3.5 in IEC 62443 terms, not on the control network. It is a zone boundary with one conduit through it, which is the arrangement the standard is built around.
- Failure is loss of visibility, not loss of control.
- If the link drops, you stop receiving analysis. The asset keeps running on its own protection. If our link fails, your plant runs as it did before us.
This is standard practice. Plenty of monitoring products skip it. They ask for an inbound rule because it was easier to build.
Why we partnered with Fortinet
42Hz is a Fortinet partner. The reason is narrow.
Condition monitoring and OT network security are looking at the same asset through different instruments, and they are almost never joined up. The security team sees a gateway making outbound connections. The reliability team sees a bearing trending toward failure. Neither view alone tells you whether the anomaly you are looking at is a machine wearing out or a machine being interfered with.
Fortinet operates in the segmentation and OT network layer we deploy behind. Being a partner means our edge is designed to sit inside that architecture rather than to work around it. For a customer who has already invested in OT segmentation, that is the difference between a monitoring deployment that fits their security model and one that punches a hole in it.
It does not mean a joint product, and nothing in this piece should be read as a Fortinet claim. It means the deployment assumption is a segmented network, not a flat one.
What to ask any monitoring vendor
Independent of whether you ever talk to us, these are the questions that separate an architecture from a brochure. Ask them of every vendor, including this one.
- Does anything you install accept an inbound connection? If yes, from where, and who maintains that rule in three years?
- Can your platform write to the asset: setpoints, configuration, protection settings? If it can, what happens when your cloud account is compromised?
- Where does your hardware physically terminate: the control network, or a DMZ?
- When the link fails, does the asset keep running on its own protection?
- What do you do with the data, where does it live, and who at your company can read it?
- If your analytics were wrong for six months, how would I find out?
The last one is not a security question and it is the one most likely to be answered badly. A monitoring platform that cannot be audited is not safer for being locked down.
The position
You cannot get the value of condition monitoring without connecting something. Pretending otherwise produces the worst outcome available: an air gap on the drawing, a cellular modem in the cabinet, and nobody owning the difference.
Add the path deliberately, in one direction, terminating where your security model says it should, and failing back to the equipment's own protection. Then the exposure is a thing you designed rather than a thing you inherited.
Does this match what you see?
If your own stations tell a different story we want to hear it. Send us the data that disagrees with us.