Always-on vendor VPNs
Support accounts stay active long after a service call, and the original reason for access becomes unclear.
Vendor access for OT support
Give vendors and service partners target-scoped, revocable access with optional expiry instead of broad plant-network access.
Partner access without broad VPN habits
Many factories need outside help for machines, PLCs, SCADA, local apps, and commissioning. An authorized organization user selects one resource, creates a scoped link, chooses an optional expiry when appropriate, and revokes the link when access is no longer needed.
Narrow scope: Access can point to one app, service, device, or machine instead of an entire network.
Clear ownership: Internal teams decide who can reach what before support starts.
Controlled lifecycle: A partner link can have an optional expiry and remains revocable by the organization.
What breaks in the usual model
Too much reach
A partner often receives network-level access when they only need one HMI, PLC support tool, web app, or box-local service.
Shared credentials
Shared accounts make it hard to know who connected, why they connected, and whether access was cleaned up.
Recommended workflow
Keep the organization’s approval decision close to the operation, then use the product controls to create a target-scoped link instead of handing out broad credentials. The approval process remains an organizational responsibility.
- Pick the exact resource the partner needs to reach.
- Complete the organization’s required approval process.
- Have an authorized user create the partner link and choose an optional expiry.
- Let the partner connect only to the selected resource.
- Revoke the link, or let its configured expiry pass, when access is no longer needed.
Where teams use it
Vendor access is useful whenever an outside team needs to help without becoming part of the plant network.
PLC and automation support
Give an automation partner access to the exact tool or service needed for diagnosis.
SCADA and HMI service
Let a software partner support screens, alarms, or configuration without wide network exposure.
Machine builder support
Allow an OEM to inspect the delivered machine during commissioning, warranty, or service calls.
Local app support
Open target-scoped access to MES, reports, dashboards, or another operational app, with optional expiry.
What improves
Less access sprawl
Support paths are created for the job instead of becoming permanent background access.
More repeatable setup
Teams can reuse a target-scoped link workflow instead of designing a custom VPN exception for every job.
Cleaner reviews
It is easier to review who has access, what they can reach, and which links should be closed.
Clean up vendor access
Tell us which vendors, apps, devices, and support windows you need to manage. We will help map product controls into your organization’s approval process.
Talk to us about vendor access