Manufacturers run IT and OT side by side. OT, or operational technology, is the equipment and software that runs physical processes on the plant floor. ERP, MES and engineering workstations sit next to plant-floor systems, and the OEM and integrator engineers who supplied the equipment need remote access to maintain it. Manufacturing is now among the sectors most targeted by ransomware, and unsupervised, always-on vendor access is the usual way in.
Customer security audits and IEC 62443, the series of standards for industrial automation and control system security, increasingly ask manufacturers to prove who can reach production systems and what they did there. In Tanflow PAM, OEM and integrator engineers reach plant and engineering systems through a recorded gateway with command control, in place of standing VPNs, and each job runs inside an approved window.
Before the session: a work order and an approval
Remote maintenance happens inside approved, time-boxed windows tied to work orders. The engineer's request gives the business reason, the target connections and the time needed. Before deciding, the approver sees who is asking, for what, why, and what the requester has done recently, and can approve from any device. A breakdown at midnight can be approved by the shift engineer from a phone. Planned maintenance that recurs can be set up once as a scheduled window and is enforced each time it comes round.
Connecting through one gateway, scoped by plant and line
The engineer opens the session in a browser. There is no VPN client to install and no agent on the target. The gateway brokers SSH, RDP, VNC and Telnet, so servers, engineering workstations and network devices are reached the same way, and it injects the vaulted credential without the engineer seeing it. Login to the gateway requires multi-factor authentication.
Connection groups separate sites, lines and cells, so an integrator who supports one packaging line sees only that line's systems. Access, policy and reporting are managed per group. Concurrent session limits cap how many sessions run at once per user, target or account. File-transfer policy decides for each connection group whether SFTP and clipboard transfers are allowed, blocked or logged.
During the session: commands checked before they run
Every command is checked against policy before it runs. BLOCK + TERMINATE policies stop dangerous operations on production databases, servers and engineering systems and end the session. On switches, routers and firewalls reached over SSH or Telnet, rules block configuration wipes and other disruptive commands. Policies are written once and applied across connection groups, so OT and IT, or vendor and employee sessions, can carry different rules. A sensitive command that is allowed can still wait for the engineer to type a reason, which is stored next to it in the audit trail.
The plant's own team can watch a session live and pause, join or end it. A read-only share link lets a plant engineer follow the OEM's work without being able to send any input, and shared sessions are recorded like any other.
When the work order is closed
The grant ends on schedule, the session closes and the credential rotates. Policy decides what happens to a session still open at expiry. It can end immediately, or get a grace period for cleanup during which new commands are blocked, and the event is logged either way. Vendor access ends without anyone having to remember to switch it off.
Catching logins that never reach the gateway
A gateway records only the sessions that pass through it. A local console login, a forgotten direct route or a shared password used outside the platform leaves nothing there. Tanflow's External Access Monitor is an optional lightweight agent, switched on per connection, that reports server logins happening outside PAM. Its view shows monitored targets, active agents and stale agents, along with each target's events and last check-in, and the data can be exported as CSV. The result shows whether the gateway is the only way in to a given system, or exactly where it is not.
Evidence for IEC 62443 programmes and customer audits
Session replays and command logs show controlled access for customer security audits and OT security programmes, including work under IEC 62443. Recordings and logs are append-only with integrity checks. The same evidence maps to other frameworks a manufacturer may report against, such as supplier access that is time-boxed, approved and recorded under ISO/IEC 27001:2022 control A.5.19, or least-privilege permissions with just-in-time elevation under NIST CSF 2.0 PR.AA-05. A customer's auditor can be given a scoped read-only role to search logs and watch replays for the period of the engagement.
Consider a packaging-line OEM that has to connect at midnight to diagnose a stalled machine. The shift engineer approves a scoped JIT session, and the OEM connects through the browser gateway with vaulted credentials and sees only that line's systems. Risky commands are blocked, the whole session is recorded, and access ends when the line is running again. At the next customer security audit the plant can show that recording together with its approval and the time access ended.