Protect · Zones & Conduits Verifier
Your segmentation design, checked against every packet.
Most plants have a zone-and-conduit drawing. Few can show that the network still matches it. Synaptic OT records your zones and conduits, flags every flow that crosses them without permission, and signs each violation.
Why it matters
Prove segmentation works
Show auditors and insurers that zone boundaries hold, with signed violation records rather than a diagram.
Tighten without breaking production
Recommendations are additive and based on observed traffic, so you can close paths without guessing what depends on them.
Ignore planned work
Violations during registered maintenance windows are marked as such instead of raising alarms.
violation CV-0077 signed Ed25519 flow Zone IT-Office → Zone Control-L1 tcp/44818 (EtherNet/IP) declared no conduit window outside maintenance status open · recommended: deny on FW-OT-01
Illustrative values
Capabilities
What's included
Zones & Conduits Verifier is part of the full Synaptic OT suite. One licence covers every capability on this site.
Zone and conduit model
Declare zones and the conduits allowed between them, or derive them from engineering project files.
Continuous verification
Observed flows are checked against declared conduits as traffic arrives.
Signed violations
Each cross-zone violation is signed with Ed25519 and can be included in an auditor pack.
Vendor ACL recommendations
Additive allow and deny suggestions per vendor format, for your network team to review.
Micro-segmentation export
Proposed zone changes exported for Fortinet, Cisco, Palo Alto or CSV.
Maintenance-aware
Violations inside approved windows are suppressed with a recorded reason.
Questions
Asked by OT and security teams
Do we need IEC 62443 certification to use this?
No. The verifier is useful for any zone design. If you are working towards IEC 62443-3-2 or 3-3, the evidence maps directly to those controls.
Works with
See it on your own traffic.
Request an evaluation licence and run Synaptic OT on a mirror port or a PCAP from your plant. Fully offline if you need it to be.