Lifecycle
We harden edge devices, place them in zones and conduits, ship SBOMs and signed updates, and handle vulnerabilities openly — designed in line with IEC 62443. Equipment makers also get practical help preparing for the EU Cyber Resilience Act.
The problem
Operational technology networks were built for availability, long before anyone expected a camera or a vibration sensor to run an operating system. Each inspection station, gateway and wireless node adds an endpoint, and security reviews rightly ask: what does it listen on, what does it talk to, who can update it, how are updates signed, and what open-source components does it contain?
Projects stall for months when a vendor cannot answer in writing. Worse, some get approved without anyone asking. We answer before the first device is unboxed, and design the system so the answers are short.
IEC 62443 concepts
IEC 62443 is the family of standards for industrial automation and control system security. These parts matter most for edge devices.
Assets with similar security needs are grouped into zones, and every connection between zones runs through a defined conduit with its own controls, following the partitioning approach of IEC 62443-3-2. Perflens devices sit in their own zone.
Security levels 1 to 4 describe resistance to increasingly capable attackers, from casual or accidental misuse up to sophisticated, well-resourced attacks. We help set a target level per zone and show what the design achieves.
The seven foundational requirements — identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability — mapped to the system design.
Lensnode, Pulsenode and Gatepoint are designed in line with component requirements for embedded and network devices — authentication, signed software, audit logging and secure configuration.
Perflens designs its devices and systems in line with IEC 62443-3-3 and IEC 62443-4-2. We do not hold, and do not claim, an IEC 62443 certification. What we provide is a written requirements mapping that your security team or assessor can review line by line.
Hardening and supply chain
No default passwords, unused services and ports disabled, least-privilege accounts, a host firewall and a documented baseline configuration.
Each Gatepoint boot stage is verified before it runs, with keys held in a TPM 2.0 module rather than on disk.
Only signed software installs. A failed update rolls back on its own, and you choose the maintenance window.
A machine-readable software bill of materials ships with every firmware release and is monitored against newly published vulnerabilities.
Report issues to security@perflens.com. We acknowledge, triage, fix, advise affected customers and credit reporters who want it.
Remote support uses an outbound, customer-controlled connection with no inbound ports. You enable it and can switch it off at any time.
Network footprint
For equipment makers
If you build machines or devices with digital elements and sell them in the EU, the Cyber Resilience Act (Regulation (EU) 2024/2847) applies to you. It entered into force on 10 December 2024 and takes effect in two stages:
We help with the engineering side: scoping affected products, product risk assessment, an SBOM pipeline, a vulnerability handling and reporting process, secure updates, and technical inputs for your documentation, often through our embedded engineering team. We are engineers, not lawyers — confirm your obligations with counsel.
Process
Architecture, data flows, port and protocol list, SBOMs and the IEC 62443 requirements mapping, sent to your security team before any device is installed.
Where Perflens devices sit, what crosses each conduit and which firewall rules enforce it, agreed and documented.
The baseline configuration is checked device by device during acceptance testing and recorded in the handover file.
New vulnerabilities are tracked against your SBOMs, and fixes ship as signed updates in your maintenance windows.
Honest fit
See it in context
Gatepoint XT devices at a critical-power site in a modeled scenario.
Read more
Sites where every new network device needs a clear answer before it goes live.
Read more
Our security practices, disclosure policy and the documents reviewers ask for.
Read more
Alicia Brandt's checklist for any edge device joining an OT network.
Read moreFAQ
No. They are designed in line with IEC 62443-4-2 component requirements, and our systems with IEC 62443-3-3 system requirements. We provide a requirements mapping for your review instead of claiming a certification we don't hold.
Email security@perflens.com with as much detail as you can share. We acknowledge it, keep you informed through triage and fix, and coordinate disclosure with you.
No. Everything runs on site. Remote support is optional, outbound-only and under your control. Our field note on air-gapped AI covers fully disconnected sites.
Yes. SBOMs are part of the security review pack we send before a Proof of Value, along with the port list, data flows and the IEC 62443 mapping.
It applies to products with digital elements placed on the EU market, so it depends on what you sell and where. We help scope products from an engineering view; your counsel should confirm the obligations.
We'll answer it in writing — ports, data flows, update signing and SBOMs — before a single device touches your network.