AppGate Adds Session Governance to OT Zero Trust Platform

AppGate has expanded its zero trust network access offering for operational technology by adding Session Governance capabilities. According to Help Net Security, this update allows critical infrastructure operators to monitor remote sessions in real time and terminate them if necessary. The release aims to reduce third-party access risks while simplifying compliance audits for facilities that rely on external contractors and vendors.

The new features build upon the initial AppGate ZTNA for OT platform, which the vendor introduced in March 2026. While that earlier release focused on controlling which users could access critical systems, this expansion governs user behavior during active sessions. It provides supervisors with the authority to intervene when activity moves outside the approved scope, ensuring that human judgment remains central to operational decisions.

Context and Background

Critical infrastructure operators depend on a mix of employees, contractors, vendors, and original equipment manufacturers to maintain plants, grids, and facilities. Much of this work occurs remotely, creating significant business risk. A compromised vendor credential can provide a pathway to physical processes, potentially halting production or disrupting essential services like power, water, or patient care.

Regulators and auditors require operators to demonstrate not only who accessed critical systems but also what actions were taken once connected. Many existing OT security tools can detect anomalous activity but lack governed response mechanisms. Fully automated remediation poses its own risks, as an incorrect automated action could interrupt physical processes. AppGate’s update seeks to close this gap by giving operators control over every phase of remote access.

Who Is Affected

The update targets organizations managing operational technology environments where remote access is common. Operators can now use asset context from existing OT asset inventory platforms to drive access policies. This integration allows the security solution to work alongside current monitoring and engineering tools, strengthening governance without requiring the replacement of existing investments.

Leo Taddeo, CEO at AppGate, stated that every remote session into an OT environment is a business decision that requires governance. He noted that the platform allows organizations to control who reaches critical systems and how supervisors respond to out-of-scope activity. This approach aims to reduce third-party risk and prove compliance while preserving uptime, safety, and necessary human oversight.

What should you do?

Organizations using AppGate ZTNA for OT should review their current access policies to incorporate the new Session Governance features. Security teams should ensure that asset context from inventory platforms is correctly integrated to drive accurate access decisions. Supervisors need to be trained on using the live monitoring and termination controls effectively.

What to do and how to stay safe: AppGate

• Review existing remote access policies for OT environments to identify gaps in session monitoring and control.
• Ensure that OT asset inventory data is accurately fed into security platforms to drive context-aware access decisions.
• Train supervisors on the procedures for monitoring live sessions and terminating access when activity exceeds approved scopes.
• Verify that compliance audits can capture detailed logs of user actions during remote sessions to meet regulatory requirements.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When did AppGate first launch its ZTNA for OT offering?

AppGate introduced its initial ZTNA for OT offering in March 2026, which focused on controlling user access to critical systems.

What new capabilities does the Session Governance update provide?

The update adds live monitoring and session termination controls, allowing supervisors to intervene when activity moves outside the approved scope.

How does this solution handle automated remediation risks?

The solution keeps a person in the decision loop, avoiding the risks associated with fully automated remediation that could interrupt physical processes.