A sensor in a substation talks to a gateway. The gateway talks to a cloud application. Somewhere along that path, something decides which device is allowed to reach which system. In most IoT deployments, nobody owns that decision.
Most descriptions of IoT connectivity architecture stop at four layers: perception, network, processing, and application. That model explains how data moves. It says nothing about how a session gets authorised, where traffic is isolated from the public internet, or what happens when one device starts behaving unlike the other 4,000 in the fleet.
The security layer answers those questions. It is not a fifth box stacked on top of the other four. It runs through all of them.
Four functions define it: identity, segmentation, private networking, and policy enforcement. Each one addresses a failure the standard four-layer model leaves open.
Every session starts with a claim about who is connecting. On a laptop, a certificate or an agent makes that claim. A headless meter has neither. The SIM does the work instead. It is the one credential the device carries from the factory to the field, tied to an IMSI and lockable to a specific IMEI.
Identity at this level answers a question your logs cannot otherwise answer: was that traffic from device 3,412, or from something that borrowed its IP address?
A flat network means one compromised device reaches every other device. In an IoT fleet, that is thousands of endpoints sharing a blast radius. Policy-based segmentation cuts the fleet into groups that reach only what their function requires. A charge point talks to the charging back end. It does not talk to the building management system, and it does not talk to the charge point next to it.
This is what contains an incident to one device rather than a region.
A device that reaches the internet is a device the internet reaches back. Private APN and DNN routing keeps traffic off public infrastructure entirely, moving it directly to your data centre or your cloud environment. IXT SecureNet does this with private IPs, two IPSec tunnels, and direct connections to AWS, Azure, GCP, and Alibaba.
Worth being precise here, because the two get conflated. A private APN hides traffic. It does not defend it. Behind that APN the network is still flat, and there is still no record of what any device talked to.
Identity and isolation set the conditions. Enforcement applies them per session, every session. In IXT's model that runs in the network and the cloud, not on the device: the Zero Trust Exchange validates each connection, and an App Connector inside your environment initiates the outbound path. No listening ports on the device. No client software to install.
Least privileged access is the rule being applied. Each device reaches the one application it needs, for as long as it needs it.
The IT security model assumes the endpoint participates. It runs an agent, reports telemetry, holds a certificate, receives a patch.
Most IoT hardware does none of this. A fall-detection sensor has kilobytes of memory. A smart meter shipped in 2019 has firmware nobody updates. A camera runs a stripped Linux build with no room for a VPN client. If your architecture depends on software running on the device, the security layer stops at the devices that accept software, which in a real fleet is a minority of them.
Moving enforcement to the network edge removes that dependency. The device does not need to defend itself, because it never receives an unsolicited connection in the first place.
Read as a stack, the security layer looks optional. Read as a set of controls applied at four points, it looks like the thing holding the architecture together.
Take an operator running 6,000 devices across nine countries with eight hardware vendors who each need remote access to their own units.
Without a security layer, that means eight VPN tunnels, overlapping IP ranges, credentials shared over email, and network-wide access granted to each vendor because scoping it per device was too much work. One compromised vendor laptop reaches everything.
With one, each vendor gets a browser session through Privileged Remote Access. Time-limited. Session-recorded. Scoped to their own devices. No client install, no IP conflicts, and an audit trail showing which contractor touched which device and what they did there.
Being clear about scope matters more than sounding complete.
It does not patch firmware. It does not replace a SIEM or an incident response function.Zero Trust Visualisation maps IXT-connected devices, so traffic outside that estate stays invisible to it. And it does not make you NIS2-compliant on its own. It addresses the Article 21(2) technical controls, which is a real contribution to a compliance case and a different claim from certification. Risk documentation, staff training, and supplier governance remain yours.
No. It applies controls at all four layers. Treating it as a separate tier at the top produces the perimeter model that IoT fleets outgrow.
Partly. It handles isolation and nothing else. Without segmentation, per-session enforcement, and traffic visibility, you have a hidden flat network rather than a defended one.
Enforce at the network. The SIM supplies identity, private routing removes public exposure, and session validation happens in the network and cloud. The device holds no security software at all.
Evidence. Access control, network segmentation, incident detection, supply chain access management, continuous authentication, and a per-session audit trail all map to Article 21(2) technical measures.
It extends them. Zscaler ZTNA reaches devices running an agent. Delivering it through the SIM reaches the cellular IoT and OT estate those deployments cannot see today.
Ask one question of your current architecture: if a device on your fleet started talking to something it has never talked to before, how long before anyone noticed?
If the answer is measured in days, or is a shrug, the security layer is the missing piece. Ask us how it works for your deployment.