FireSight OT · alternatives
A Secomea alternative for machine remote access
Looking for a Secomea alternative? Secomea is an established OT remote-access platform, and in many ways FireSight OT works the same way: a device at each site connects out to a central server, and people reach the machines they're allowed. This page sets out where the two differ, using only what Secomea describes in its public documentation.
Being fair
When Secomea is a good fit
Secomea is built from SiteManager devices at the sites, the GateManager server and the LinkManager client. Its public documentation covers a broad feature set.
- Outbound connections from the site, and per-device access.
- Its datasheet says conflicting IP subnets are no problem.
- Web HMIs and in-browser RDP, VNC and SSH through Secomea Prime (GateManager 11.9 and later), with session recording for in-browser protocols in its Professional and Premium tiers.
- A self-hosted option, GateManager Own, alongside the hosted service, and SiteManager Embedded for third-party hardware or Docker.
Side by side
Secomea and FireSight OT: where they differ
Only the points where the two differ, or where one side's public docs don't describe something.
| Point | Secomea (public docs) | FireSight OT |
|---|---|---|
| Where the server runs | Hosted, or self-hosted with the GateManager Own option. | Self-hosted only today: your own server, in your data centre or a cloud VM. A hosted option is planned. |
| Vendor end dates and working hours | Account expiry is described. Working hours: not described in their public docs. | Vendor accounts can have an end date and access hours (for example weekdays 07:00–18:00). Open sessions close when time is up. |
| Multi-factor sign-in | By SMS, or through single sign-on. | Authenticator apps (TOTP), which can be required for everyone and always are for vendors, or single sign-on (Entra ID, Google, Okta, OpenID Connect, SAML 2.0). |
| Session recording | In Professional and Premium tiers, for in-browser protocols. | Text transcripts of browser SSH, Telnet and serial sessions, kept 90 days. Video recording of RDP and VNC is planned for 0.4.0. |
| Serial | RS-232 on some SiteManager hardware. | New in 0.3.0: USB console cables or USB-to-RS232 adapters on any Cloud Connector, opened in a browser terminal or through the client, with a Send break button. |
| Alerts | Email or SMS when a SiteManager disconnects or a PLC (agent) goes down. | Email when a Cloud Connector is offline or a machine is unreachable for N minutes. One line when a whole site drops, combined emails, and maintenance mode to hold alerts. |
| Files | FTP and shared-folder agents. | Upload-only file drop on the Cloud Connector over SFTP or FTP, copies on the Hub, and collection by your backup software over SFTP or S3. |
FireSight OT
What's different with FireSight OT as a Secomea alternative
Your Hub, your data
The Cloud Hub always runs on a server you control, so users, access rules and the audit log stay with you. It installs with one command on Debian, gets its own HTTPS certificate, and needs only TCP 443 open inbound. The sites need nothing open.
Working hours as well as end dates
Machine builders and integrators get vendor accounts limited to their own machines, with two-factor sign-in, access hours and an end date. They never get whole networks unless you allow it.
Identical lines with 1:1 mapping
Each site's machine network maps 1:1 to its own range on the Hub. People can use the real address or the Hub address, and machines see connections from the Cloud Connector, so nothing changes on the PLCs.
Alerts without the flood
When a site drops, you get one line, not one email per machine. New in 0.3.0, maintenance mode holds a site's alerts for 1 hour to 1 week while people work on it, and still tells you if something is down afterwards.
Ready-made or your own
Buy Cloud Connectors from us (CC-3, CC-4, CC-5, or the industrial CC-4i and CC-5i), or build one from Raspberry Pi parts at a local store. New in 0.3.0, 4G/5G modems work too, with a standby mode that uses about 15 MB of data a month.
Per Cloud Connector
A Hub licence per company or a device licence per connector, and a 30-day evaluation for up to three. If a licence lapses, it keeps working in a restricted mode and security updates continue.
Running both
Trying FireSight OT next to Secomea
A Cloud Connector is a separate small box on the machine network, so it can sit alongside an existing SiteManager without changing it.
- Start with one site, or one line where vendors need access.
- Publish the same machines and let one team use both for a few weeks.
- Compare the audit log, alerts and vendor controls on real work, then decide site by site.
Questions to ask both: our eleven questions for any OT remote-access product work for this comparison too.
Related: remote access with duplicate IP addresses, remote serial console access, and the FireSight OT overview.
Product names are trademarks of their owners. Facts checked against public documentation on 25 October 2026; tell us at hello@firesightsystems.com if anything has changed.
FAQ
Questions people ask
How is FireSight OT different from Secomea?
Both connect out from the site to a central server. FireSight OT always runs on your own server, adds vendor working hours to end dates, holds alerts with maintenance mode, and is licensed per Cloud Connector.
Can FireSight OT run alongside Secomea?
Yes. A Cloud Connector is a separate small box on the machine network, so you can try it at one site next to an existing SiteManager.
Does FireSight OT work with duplicate IP addresses?
Yes. Each site's machine network is mapped 1:1 to its own range on the Cloud Hub, so identical lines need no renumbering.
Does FireSight OT record sessions?
Browser SSH, Telnet and serial sessions are kept as text transcripts for 90 days and linked from the audit log. Video recording of remote desktop sessions is planned for version 0.4.0.
See it on a test line
Tell us about your sites and who needs to reach them. We'll show you FireSight OT in a live demo Hub, with real machines behind a Cloud Connector.
