The preferred deployment places Neeve Secure Edge or Link inline with, behind or as the controlled path into the OT network. Access uses centralized identity and policy, while the BAS remains on a protected network segment.
Role-based technicians, operators and approved service partners.
Central policy, authentication and audit context.
Controlled encrypted communications without broad inbound exposure.
Protected access point at the OT boundary.
Building supervision, controller networks and equipment remain operationally separate.
The edge placement matters. A device installed merely beside the controls network may not enforce the same security boundary as an inline or controlled-path design.
No platform is best at everything. We match the system to the building, the people who will support it, and the owner's long-term plan.
Neeve is most valuable where owners need remote service without treating every vendor laptop or VPN account as trusted inside the building network.
Owners who need governed access across buildings, users and outside partners.
Sites formalizing the boundary between enterprise IT, vendor access and building controls.
VPNs, firewalls and cloud services should be inventoried so the new path removes—not layers on—risk.
These links support the high-level architecture above. Final design depends on controller generation, software versions, licensing, cybersecurity standards and site conditions.
UCS can map the users, systems and trust boundaries before selecting the edge placement and support model.
