Cybersecurity Architecture
Where each Yellow Cube product sits on the network — from the OT bus and PLCs, through the air gap, into enterprise IT, cloud and internet. Pairs with our Product Matrix, which weighs the same portfolio by contribution to your security posture. Click any product below for what it is and why it sits there. Dashed boxes are third-party platforms already common in the estate (identity providers, etc.) — not part of the Yellow Cube portfolio.
Purdue Model — What Goes Where
Product placement across the whole stack, read bottom-up: OT buses and PLCs at the base, through the air gap, into enterprise IT, out to the internet and cloud. Each network is drawn as one L2 segment; the spine on the left is how they interconnect. Click any product for what it is and why it sits there — and to highlight it everywhere it appears.
Where the agents actually sit
The same host stack twice — a virtualised server and a user workstation — opened up. Highlighted rows are where a Yellow Cube component is installed or where telemetry is taken. The workstation carries the full agent; the server carries it per guest, never on the hypervisor fabric.
{{ sel.what }}
From the PLC to the cloud — Yellow Cube secures every level of the Purdue model with one specialist vendor per domain, so your network architecture decides where the controls belong, not a vendor’s product catalogue.
FAQ
Where does each Yellow Cube product sit in the Purdue model?
Yellow Cube places its portfolio across the whole stack, read bottom-up: Purdue L1–L0 is the OT bus, carrying PLCs, RTUs, drives and sensors; L3–L2 is the OT control network with SCADA, historians, HMIs and engineering workstations; L3.5 is the air gap; L4 covers the office network and the IT DMZ; L5 is cloud, SaaS and the mobile fleet. Firewall boundaries sit between them — internet perimeter, internal segmentation and cell segmentation. Every network is drawn as a single L2 segment with its hosts hanging off it, so what you are reading is a network position, not a product category.
Nothing can be installed on a PLC — so how does Yellow Cube protect Purdue L0–L1?
It does not try to put software there. PLCs, RTUs, drives and sensors take no agent, by design, so everything protecting them is in-line, transparent and upstream. In practice that means an industrial firewall in front of the cell, the machine or the individual PLC: OPSWAT's Industrial Firewall, which learns the normal traffic pattern and then enforces it with protocol-specific inspection for Modbus TCP, S7, DNP3, EtherNet/IP and BACnet, or Stormshield's ruggedised SNi range on DIN rail with hardware bypass. That is exactly why the firewall in front of the cell carries so much of the weight at this level.
How does telemetry cross the air gap without opening a route back into OT?
At Purdue L3.5 the path is deliberately one-way. The primary option is OPSWAT's NetWall Unidirectional Gateway, a paired-appliance gateway with protocol emulation so historians, OPC servers and file shares replicate northbound as if the link were bidirectional — telemetry leaves OT, and nothing routes back in. Waterfall Security's Unidirectional Security Gateway appears as an equivalent where a regulator already expects it, though that is the customer's own platform rather than part of the Yellow Cube portfolio. Removable media and contractor laptops take a different route entirely: a MetaDefender Kiosk acts as the airlock door, scanning and sanitising every USB stick and file before it is released into the OT side.
Do we have to replace the customer's existing identity provider or firewalls?
No. The dashed boxes in this architecture are third-party platforms most estates already run — Microsoft Entra ID or Google Workspace as the identity provider, for example — and they are explicitly not supplied by Yellow Cube. Yellow Cube's identity products layer on top of the provider the customer already has rather than replacing it, because that platform issues the tokens everything else trusts. Where two products are joined by “or”, they are equivalent options for the same position: choose one, do not stack both.
What in the portfolio covers the whole stack rather than one Purdue level?
Three things are cross-cutting rather than tied to a single level. Yellow Cube's own 24×7 Managed SOC watches IT and OT out of hours, working from the telemetry that the agents and sensors in this architecture produce. Cymulate Exposure Validation safely attacks the deployed controls to prove each zone blocks what it claims, including the OT boundary. CYBER RANGES adds live-fire exercises on realistic IT and OT scenarios, so a blue team learns this architecture under pressure rather than during an incident.
Let’s Build Smarter Cyber Defenses Together
Partnerships are the foundation of everything we do — built on trust, expertise, and shared success. Whether you’re looking to grow your business, strengthen your cybersecurity offerings, or bring innovative solutions to new markets, Yellow Cube is ready to be your committed, long-term ally.