Ask a plant for its network diagram and you will get a clean drawing: enterprise at the top, an industrial DMZ in the middle, site operations below it, then the cells, then the field. Levels 4 down to 0, with a boundary drawn between each one.
The diagram is a design document. Whether the network still matches it is a question about the network, and it is answered by a connection, not by a drawing.
What a segmentation finding actually is
A Purdue crossing is one of the few findings in security that needs no exploit at all. A TCP connection from an address in the enterprise range completes to an address on the safety network. Nothing is sent beyond the connection itself and it is closed immediately. That is the whole finding, and it is conclusive: the path exists.
It is also the finding an IEC 62443 assessment is built around. Zones and conduits are the standard's central idea, and a conduit that does not enforce is not a conduit. A drawing that shows one where the packets show none is the gap between a paper posture and a real one.
The three crossings that keep appearing
The engineering workstation. This is the machine that holds the project files and can download logic to a controller. It runs Windows, it is joined to a domain, it answers remote desktop, and it is very often reachable from level 3 with nothing in between. That single host is the shortest path in most plants from an office credential to a running process, because the credential that opens it and the software installed on it are both already there.
The DMZ that forwards instead of terminating. An industrial DMZ is supposed to break a protocol and republish it. What we find instead, regularly, is a relay that listens on the historian's own port and forwards inward. A client on level 4 speaks the same protocol to the same port and the relay carries it. That moves the boundary; it does not enforce one. The test for it is simple: if the service banner on both sides of the DMZ is the same service, the DMZ is a router with extra steps.
The safety network. A safety instrumented system is the last independent layer of protection a plant has, and its independence is the entire point. A route to it from a network where a phishing email lands removes that independence, whatever the SIL rating says. This is the one crossing we treat as a critical on its own, before anything is done with it, and it is also the one we then stop at: the connection is closed, and the aggressive classes close on that host for the rest of the engagement.
Why we report the level, not just the subnet
A finding that says "10.10.1.20 can reach 10.30.30.13 on 44818" is technically complete and organisationally useless. The person who has to act on it thinks in levels, and so does the standard they are audited against.
So every host in an industrial engagement carries its Purdue level, and every crossing finding names the levels it crosses. It is a small piece of vocabulary and it decides whether the report is read by the OT engineer or forwarded to somebody who will read it next quarter.
The measurement we published about ourselves
We ran this analysis on our own coverage before selling it. The answer was uncomfortable and worth stating: we could identify controllers and read them well, and we could not answer the segmentation question end to end, because nothing in the product assigned a host to a zone. There were three separate segmentation catalogues in the codebase with zero consumers between them.
The missing piece was never a clever consumer. It was zone assignment: the fact that says which side of a boundary a host sits on. Without it, a crossing is just two addresses, and the tool cannot tell an operator whether a path is a violation or the ordinary way their plant is meant to work.
That is the difference between reporting connectivity and validating segmentation, and it is worth being precise about which one a tool does. Connectivity is easy. Segmentation needs the model.
What a good result looks like
A segmentation section that is worth reading answers four things: which crossings exist, which of them are intended, which host is on which level, and what the shortest path from the outermost level to a controller actually is. The last one is a single sentence and it is usually the sentence the plant manager repeats in the meeting.
The re-test is the same connection from the same source range. That is what makes this class of finding satisfying to fix: unlike most of security, you can prove the fix as cleanly as you proved the problem.
Frequently asked questions
What is a Purdue crossing in OT security?
A Purdue crossing is a finding where a TCP connection completes from an address in one Purdue level, such as the enterprise range, to an address on a lower level, including a safety network. No exploit is needed, nothing beyond the connection is sent, and it is closed immediately, yet the path itself is conclusive proof.
Why is the engineering workstation such a common attack path in a plant?
The engineering workstation holds project files and can download logic to a controller. It typically runs Windows, is domain joined, answers remote desktop and is often reachable from level 3 with nothing in between, making it the shortest path in most plants from an office credential to a running process.
How do you tell if an industrial DMZ is really enforcing a boundary?
Check whether the service banner is the same on both sides. A proper industrial DMZ breaks a protocol and republishes it, but a relay that listens on the historian's own port and forwards the same protocol inward only moves the boundary. If both sides show the same service, the DMZ is a router with extra steps.
Why treat a route to the safety instrumented system as critical on its own?
A safety instrumented system is the last independent layer of protection a plant has, and its independence is the entire point. A route to it from a network reachable by something like a phishing email removes that independence regardless of the SIL rating, which is why this crossing is treated as critical on its own, before anything is done with it.
Why report the Purdue level instead of just IP addresses and ports?
A finding listing only two IP addresses and a port is technically complete but organisationally useless, because the person acting on it thinks in levels, as does the standard they are audited against. So every host carries its Purdue level, and every crossing finding names the levels it crosses.
What did the self-measurement of segmentation coverage find was missing?
A self-check of the company's own coverage found it could identify and read controllers well, but could not answer the segmentation question end to end, because nothing assigned a host to a zone. Three separate segmentation catalogues existed in the codebase with zero consumers between them, and the missing piece was zone assignment itself.