--- title: "Segment a factory network without downtime | Edge SDN" description: "A global manufacturer segmented its production network on its existing switches, with no downtime, passed its cybersecurity assessments and gave maintenance autonomy." url: https://www.edge-sdn.com/success-cases/manufacturing/ last_updated: 2026-10-04 --- Manufacturing · Edge SDN # Segment a running factory on the switches it already has Global manufacturer with several production plants Cybersecurity assessments passed with top ratings In short A global manufacturer had a production network that grew for years without security in mind. Downtime was not an option. The Edge SDN platform mapped the real traffic, generated segmentation rules and pushed them to the existing Ethernet switches. There was no stop and no new hardware. The company passed its cybersecurity assessments and extended the solution to its other plants. ## The challenge - A network that grew for years, with no security in the design - New lines next to old machines, SCADA and MES on old computers - Staff and outside vendors need local and remote access - A stop costs thousands of euros per minute ## What did not work, and what did What they tried - Firewalls: many rules to write and keep current - New VLANs: a disruptive reconfiguration - New IP addresses: unacceptable downtime - Network access control: too rigid for a factory What worked - Rules generated from the real traffic - Rules pushed to the switches already in place - Continuous monitoring, changes without stops - Maintenance makes changes without waiting for IT ## How we did it 1. **Map the traffic**Record who talks to whom: machines, PLCs, SCADA, file servers and loggers. 2. **Generate the rules**Turn the communication patterns into segmentation rules. 3. **Push them to the switches**Use the existing Ethernet switches. No new hardware. 4. **Watch and adjust**Monitor all the time and adapt without stopping production. ## The results - **Assessments passed**With top ratings, so it can bid where security is required. - **Maintenance works alone**Local and remote work without waiting for IT. - **IT keeps visibility**IT sees the security status and steps in when needed. - **From pilot to group**The rollout to all the group's plants followed the pilot. ### Read the full story ## The situation The manufacturer runs several plants. New digital lines sit next to old equipment. SCADA and MES run on a mix of new and outdated computers. The network grew over the years for convenience, not for security. Internal maintenance staff and outside vendors need access, on site and remote, to keep production going. Any solution had to work with that. ## IT and OT pulled in different directions The IT manager, responsible for the SCADA servers, worried about a growing attack surface and weak segmentation. The OT manager knew the risk too, but feared that more security would slow down maintenance and remove flexibility. The usual answers had already failed: firewalls with endless rules, VLAN redesigns, new IP addresses and network access control. ## What we did The Edge SDN platform started with a **discovery phase**. It analysed the traffic between all devices and built a map of who talks to whom. From that map it found the **communication patterns** and generated the **segmentation rules**. The rules went to the existing switches. They let each machine reach only the hosts it needs in normal operation. The platform keeps watching the traffic, so the rules can change without stopping production. The method for mapping and writing rules is built into the software. IT and OT teams can both use it without being security specialists. ## What changed The company passed its cybersecurity assessments with top ratings. It can now take part in tenders that ask for high security standards. IT and OT now work together better, because each side got what it needed. Maintenance staff handle network changes for local and remote work on their own. IT keeps the overview and stops being the bottleneck. Product used ### Edge SDN [Explore Edge SDN](https://www.edge-sdn.com/products/edge-sdn/) Related use case ### Reduce the attack surface of an old machine: protect what you cannot patch [Read](https://www.edge-sdn.com/use-cases/protect-a-machine-you-cannot-patch/) The customer is not named on this page. Results describe this project and depend on each network. ## See a critical CVE hit a machine We show you the moment that matters: a new vulnerability lands. One machine is exposed and the other is not. The customer notice is ready to send. Meet us at 35.BI-MU, fieramilano Rho, 13–16 October 2026