FireSight OT · for machine builders (OEM)
Remote support for machine builders, built into every machine
FireSight OT gives machine builders OEM remote access that plant IT teams will approve. Fit a Cloud Connector in every machine you ship, run one Cloud Hub for your whole installed base, and give your service engineers access to the machines they look after, during the hours each customer agrees to.
How it fits
Remote support for machine builders, from the first machine to the last
Your machines end up in plants you don't control, on networks you can't change. FireSight OT is built around that.
A Cloud Connector in every machine
A small DIN-rail-friendly box in the cabinet, cabled to the machine network and to the plant's uplink. It only dials out, so the plant opens nothing.
One Hub for your installed base
Run a Cloud Hub on your own server or a cloud VM. Each customer is a separate company on it, so plants never see each other's machines.
A device licence per machine
Each Cloud Connector gets its own device licence, bound to its serial. The licence travels with the machine, on any Hub.
Every machine can be 192.168.1.x
Ship the same addresses in every machine. Each one is mapped 1:1 to its own range on the Hub, so there's no renumbering for duplicate IP addresses.
One image for every machine
Flash the same card image for every machine. On site, a one-time code ties each Cloud Connector to the right customer and site, then is wiped.
Manage the fleet remotely
Diagnostics, ping and port tests from the site, logs, restarts and one-click signed software updates, all from the Hub.
Two ways to connect
Your Hub, or the customer's Hub
Some customers are happy for the machine to connect to the builder. Others want it on their own Hub. FireSight OT supports both, and the device licence works either way.
| Machine builder's Hub | Customer's own Hub | |
|---|---|---|
| Where the machine connects | Your Cloud Hub, with the customer as its own company. | The customer's Cloud Hub, next to their other sites. |
| Your service engineers | Accounts on your Hub with two-factor sign-in, granted per customer, with hours and end dates where a customer asks for them. | Vendor accounts at the customer's Hub, with two-factor sign-in, access hours and an end date the customer sets. |
| Plant staff | Accounts for their own machines only. | Their own accounts, as for any other site. |
| Who sees the audit log | You, and the customer can see sessions on their machines. | The customer, with your engineers marked as a vendor on every entry. |
| Licence | A device licence per Cloud Connector, bound to its serial, travels with the machine. | |
Plant IT review
OEM remote access a plant's IT team will sign off
The hardest part of remote support is often getting it approved. These are the answers IT and security teams look for before they let a machine builder in.
- No inbound firewall rules. The Cloud Connector dials out on 443 or through the site's HTTP proxy.
- Only the machine, never the plant network. An allowlist on the Cloud Connector, set at the site, caps what the Hub may ever reach.
- A named person for every session, with two-factor sign-in. No shared accounts.
- A full audit log of who reached which machine, when, for how long and how much data.
- Mutual TLS with a certificate per device, and signed software updates the device checks before installing.
For service engineers
What your engineers can do on a support call
HMIs, remote desktop and terminals
Open web HMIs in the browser. New in 0.3.0, RDP and VNC to the machine's panel or PC, and SSH or Telnet, open in the browser too, with nothing to install.
Your engineering tools
The FireSight OT client for Windows, macOS and Linux gives TIA Portal, Studio 5000, Modbus and OPC UA tools a local port to the PLC. See PLC remote access.
Logs, recipes and backups
The machine can upload files to its Cloud Connector over SFTP or FTP, kept 1 to 10 days, and they can be copied to the Hub.
Know when a machine drops off
Email alerts when a Cloud Connector goes offline or a machine stops answering, with no alert floods. New in 0.3.0, maintenance mode holds alerts while people work on a machine.
EU Machinery Regulation
Remote support and the Machinery Regulation
From 20 January 2027, machinery placed on the EU market must meet Regulation (EU) 2023/1230. Its essential requirements include protection against corruption through connected and remote devices. How your remote support works becomes part of the machine's risk assessment.
An outbound-only, per-person, audited way in is easier to describe and defend than a shared VPN account or a remote-desktop tool left running. Read more on FireSight OT and the EU Machinery Regulation.
Conformity is assessed for the whole machine and stays with the machine builder. This is general information, not legal advice.
Hardware without lock-in. Cloud Connectors are based on Raspberry Pi. Buy ready-made ones from us (CC-3, CC-4, CC-5, or the industrial CC-4i and CC-5i), or build your own from parts you can buy locally.
Our partner programme for machine builders includes help setting up a test machine in your workshop. Talk to us about your next machine.
FAQ
Questions people ask
How is FireSight OT licensed for machine builders?
With a device licence per Cloud Connector, bound to its serial. The licence travels with the machine, whether it connects to your Hub or to the customer's own Hub.
Does the customer have to open firewall ports for OEM remote access?
No. The Cloud Connector in the machine only makes outbound connections, on port 443 or through the site's HTTP proxy, so the plant opens nothing inbound.
Can every machine we ship use the same IP addresses?
Yes. Each machine's network is mapped 1:1 to its own range on the Hub, so every machine can keep the same addresses, such as 192.168.1.x.
What if the customer wants the machine on their own Hub?
That works too. The machine connects to the customer's Hub, and your service engineers get vendor accounts there with two-factor sign-in, access hours and an end date the customer sets.
Does FireSight OT make a machine comply with the Machinery Regulation?
No product does that on its own; conformity is assessed for the whole machine. FireSight OT gives you an outbound-only, per-person and audited remote-access path that you can describe in your risk assessment.
See it on a test line
Tell us about your sites and who needs to reach them. We'll show you FireSight OT in a live demo Hub, with real machines behind a Cloud Connector.
