Your security model assumes the endpoint helps. It runs an agent, reports its posture, holds a certificate, and refuses a connection that fails policy. Now look at the devices on your industrial estate. A gas meter with 64KB of RAM. A camera running firmware from 2019. A charge point controller with no update path. None of them will ever run an agent. None of them will report anything about their own state.
That gap is the whole subject of this article. Zero Trust as written for corporate IT depends on software sitting on the thing being protected. Most IoT and OT hardware cannot host that software and never will. The answer is not a lighter agent. It is moving enforcement off the device and into the network.
Zero Trust removes the assumption that anything inside your network is safe. No implicit trust from being on the corporate LAN, behind the firewall, or inside the VPN. Every session is verified against identity and policy before a connection opens, and the access granted is the minimum that session needs.
Three ideas do the work:
None of that is controversial. The argument is entirely about where the checks run.
Corporate Zero Trust puts the check on the endpoint. That works because laptops and phones have an operating system, storage, processing headroom, and a management channel. IoT hardware has none of those, by design.
Three consequences follow.
No agent, no posture. If enforcement depends on software running on the device, an estate of headless devices is invisible to your policy engine. It falls back to network location, which is exactly the implicit trust Zero Trust was built to remove.
The VPN substitute makes it worse. Where an agent is impossible, teams reach for a VPN tunnel from the site or the device gateway. A VPN authenticates once and then grants network reach. One compromised vendor laptop with a valid tunnel sees the flat network behind it. For an OT environment, that is the whole estate.
A private APN hides traffic but does not defend it. Keeping devices off the public internet is worth doing and it is not access control. Inside the APN, the network is still flat. Any device reaches any other. There is no record of which system a device talked to, which is the record an assessor asks for.
Enforcement moves to infrastructure the device already depends on but does not have to run. Four layers, deliberately kept separate.
Every cellular device authenticates to the network through its SIM before anything else happens. That exchange is cryptographic, it happens on hardware the device already has, and it requires no firmware change. For a headless device this is the one durable identity available, so it becomes the anchor that policy is written against. Lock a SIM to an IMEI and the identity binds to specific hardware rather than a removable card.
A private APN or network slice keeps device traffic inside private infrastructure and delivers it to your data centre or cloud environment over IPSec or a direct cloud interconnect. No public IP. No exposed port. Nothing on the internet to scan. This is the layer IXT SecureNet provides, and it is the architectural precondition for the next one rather than a security control in its own right.
Policy enforcement sits in the network and cloud, not on the SIM and not on the device. Each session is brokered: the request is checked against identity and policy before any connection opens, and traffic is device-initiated, so there is no inbound path to the device at all. Access is granted to a named application, not to the network segment it lives on. Policy-based segmentation keeps devices from reaching each other, so a compromised unit has nowhere to move laterally.
IXT delivers this as Zscaler ZTNA extended over cellular, paired withIXT Zero Trust Visualisation built on Illumio for real-time traffic mapping and anomaly detection across headless endpoints. The two components are always sold together. IXT has been a named Zscaler partner for Zscaler Cellular since July 2025.
Most breaches in OT environments arrive through a supplier. Privileged Remote Access replaces the vendor VPN with a browser session: no client install on the vendor's machine, access scoped to one device, time-limited to an agreed window, recorded, and co-viewable by your own engineer while it runs. A European EV charging operator with eight hardware vendors used this to give each vendor access to their own chargers without VPN conflicts and without granting network-wide reach.
NIS2 places accountability at board and C-suite level, with personal liability attached. Article 21(2) sets out the technical measures, and IXT Zero Trust addresses several directly: access control, network segmentation, incident detection, supply chain access, audit trail, and continuous authentication.
The audit trail is the part with the most practical value. You get a record of every device, every user, every third-party contractor that accessed a device, and what actions they took during the session. That record is difficult to reconstruct after the fact from a VPN estate, and straightforward to produce when every session was brokered.
Two boundaries are worth stating plainly. IXT Zero Trust does not make you NIS2-compliant on its own. It addresses a set of technical controls. Risk documentation, incident response planning, staff training, and supplier governance remain your responsibility, and any claim that a specific deployment meets Article 21 should go past your own legal and compliance team's reading of the national transposition in your jurisdiction.
The threshold IXT works to is around 500 devices, or any fleet where a regulated sector, a compliance deadline, or third-party maintenance access is in play. Below that, with no compliance pressure, global connectivity and real-time fleet visibility are the sensible starting point, and the security conversation follows when the estate grows or an audit lands.
The test to apply now, whatever the size of your estate: name the systems one specific meter in the field is permitted to talk to, and produce the record of every engineer who connected to it in the last 90 days. If both answers are available in minutes, your enforcement is in the right place. If neither is, the devices are defending themselves, and they were never built to.
Ask us how it works for your deployment.
This guidance is based on real IoT and OT deployments in regulated industries including energy, utilities, and industrial environments.
IXT designs and operates secure connectivity architectures where:
The patterns described here reflect how these environments are secured in practice, not theoretical models.
This article was written by the IXT Connectivity and Security team.
IXT operates a full MVNO core network and delivers secure IoT connectivity across 190+ countries and 600+ mobile networks. The team works directly with industrial, utilities, and infrastructure operators to design and secure large-scale IoT and OT deployments.
Their focus is on network-level Zero Trust architecture, SIM-based identity, and secure device communication without relying on VPNs or endpoint agents.