AppGate Session Governance Expands Zero Trust OT Controls for Critical Infrastructure

On October 20, 2026, AppGate announced the expansion of its Zero Trust Network Access for OT offering with new Session Governance capabilities aimed at critical infrastructure operators. The update adds controls over actions that occur during remote sessions, building on the initial ZTNA for OT release from March 2026.

AppGate Session Governance Features Target OT Session Risks

The new capabilities include tamper-evident session recording that defaults to fail-closed, live session monitoring, and the ability for supervisors to terminate sessions with automatic reason capture. Credential vaulting and injection ensure that users never receive or hold credentials directly.

Asset context from existing OT inventory platforms now feeds access policy decisions. This allows entitlements based on asset groupings instead of static IP addresses. The architecture stays on-premises and direct-routed with no cloud backhaul, and it supports isolated networks using NIAP Common Criteria and FIPS-validated components.

These controls address risks tied to third-party and vendor access. Time-bound, scoped sessions replace standing VPN accounts, reducing the chance of credential compromise leading to lateral movement or process disruption while operators maintain human oversight of safety and uptime.

Compliance Support and Deployment Context for Industrial Systems

AppGate positions the release to simplify evidence collection for IEC 62443, NERC CIP-005, NIST SP 800-82, and CMMC frameworks. The solution cloaks assets until explicit authorization occurs and integrates with existing OT monitoring and engineering tools rather than replacing them.

AppGate CEO Leo Taddeo stated that every remote OT session represents a business decision that requires governance. The platform supplies control over access, session activity, and supervisor responses to out-of-scope actions while preserving operational uptime, safety, and human judgment.

Deployment occurs in or near the OT DMZ. The offering remains available as an expansion of the prior ZTNA for OT product and will be promoted at GridSecCon 2026 in Orlando from October 20 to 23.

Market Drivers Behind Zero Trust OT Adoption

Industrial environments face rising demands for remote and third-party access to plants, grids, and facilities. Traditional VPN approaches create persistent entry points that can enable unauthorized changes or downtime. Session Governance adds a layer that records activity, enforces supervisory approval, and limits credential exposure without altering existing OT workflows.

The March 2026 launch focused on defining who could reach critical systems. The October update shifts attention to governing what occurs once access is granted. This progression aligns with standards that require both access control and evidence of ongoing oversight in operational technology settings.

Operators can now apply policy at the asset-group level and maintain direct-routed connections that avoid external routing. The design supports environments where connectivity must remain local and where automated actions are intentionally withheld in favor of human review.