"I won't say Purdue is obsolete. It still works as a useful framework and reference architecture for understanding the industrial layers. The problem arises when it is mistaken for a physical boundary."
— Filipe Beato, Manager, Technology and Innovation, World Economic Forum (WEF) Centre for Cybersecurity, in an interview with Industrial Cyber
PERA (the Purdue Enterprise Reference Architecture), formalized in the early 1990s by Professor Theodore Williams and his research team at Purdue University, has been the de facto constitution of industrial control system design for more than three decades. From sensors and actuators at Level 0, to PLCs at Level 1, SCADA/HMI at Level 2, MES at Level 3, through the IDMZ at Level 3.5, up to ERP at Levels 4 and 5. Before it was ever a network diagram, this hierarchy was a boundary of organizational responsibility and of budgets — and above all, the basis for the belief that "OT is physically separated from IT." The fact that CISA, NIST, and the U.S. Department of Defense still cite Purdue as a reference model shows just how much inertia it carries.
On the factory floor of 2026, however, that belief no longer matches reality. IIoT sensors push data straight to the cloud over cellular modems, equipment vendors make remote maintenance a contractual condition, and quality teams query Level 1 tags in Snowflake. Data paths that cut across the layers have become the norm, not the exception. Jimber's 2026 analysis sums it up bluntly: "The two premises that made Purdue work — hierarchical separation and a true air gap — no longer hold at most production sites."
This article takes up three questions. Where does Purdue actually break down? How are the threat data and the standards camps (IEC 62443, NAMUR, OPAF) responding? And what practical patterns can you adopt right now? To give away the conclusion: Purdue is not dead. But its role has shifted from a physical layer model to a logical, policy-level reference model. The organizations that missed that transition are filling most of the 2026 ransomware statistics.
Architectures premised on hierarchical separation are rapidly flattening under the pressure of IIoT, cloud, and remote maintenance.
1. What the Purdue Model Promised, and Where It Breaks
Purdue's core promise was clear: keep a compromise in the upper layers from reaching the physical process in the lower layers. The IDMZ (Industrial DMZ) at Level 3.5 was the gateway. Traffic entering OT from IT terminates in the IDMZ, and OT assets never establish direct sessions with IT. For a long time, this design actually worked.
The collapse came from three directions at once. First, the reversal of data gravity. OT data used to climb slowly upward through the MES; now, raw Level 1 and Level 2 tags are needed in the cloud at second-level intervals for AI model training, predictive maintenance, and energy optimization. ETL that steps up the layers one at a time cannot meet that demand. Second, vendor remote access becoming permanent. Robot, CNC, and utility suppliers demand always-on tunnels on the strength of preventive maintenance SLAs, and those tunnels mostly ignore the Purdue layers. Third, the growing intelligence of Level 0. Once smart sensors and IO-Link masters gained their own IP stacks and web servers, the premise that "Level 0 is simple and harmless" evaporated.
Some practitioners, Brad Hegrat among them, argue the model should be retired. Others — WEF's Filipe Beato, Palo Alto Networks, Fortinet — propose redefining Purdue as a "conceptual segmentation guide." In practice, the latter view is right. Purdue's level numbers remain useful as a shared language for classifying asset inventories and communicating risk. The problem arises when those numbers are equated with the physical location of network cables.
2. What the 2026 Threat Data Says — the Dragos Year in Review
What drags the abstract debate down to reality is data. Dragos's 2026 OT Cybersecurity Year in Review reported that the number of ransomware groups targeting industrial organizations jumped from 80 in 2024 to 119 in 2025, and that they affected a total of 3,300 organizations. More than two-thirds of the victims were manufacturers. Manufacturing is no longer collateral damage of OT ransomware; it is the primary target.
The more painful figures concern visibility. Of the OT environments Dragos assessed, only 46% had adequate network monitoring. And that gap converts directly into damage. The industry-wide average dwell time for OT ransomware was 42 days, yet organizations with visibility in place went from detection to containment in about 5 days — a difference of more than eightfold. Forty-two days is plenty of time for an attacker to map control loops, destroy backups, and even establish the presence of safety instrumented systems (SIS).
And decisively, roughly 75% of OT attacks begin with an IT compromise. That means the segmentation Purdue promised is already failing. IBM's incident response statistics likewise show 44% of breaches starting from internet-facing public applications. In its 2026 report, Dragos identified three new threat groups — AZURITE, PYROXENE, and SYLVANITE — and SYLVANITE in particular displayed a division-of-labor pattern, handing off its footholds to VOLTZITE to drive deeper OT penetration. Attackers already treat IT and OT as one continuous terrain. Only defenders still view them through two separate org charts.
42 days without visibility versus 5 days with it — the monitoring gap is the damage gap. (Source: Dragos 2026 YiR)
3. The Flattened Network — How UNS and MQTT Brought Down the Layers
Here is an interesting paradox: the force that most aggressively brought down the Purdue layers was not attackers but the evolution of data architecture. The Unified Namespace (UNS), formalized by Walker Reynolds in his first project in 2005 and popularized through 4.0 Solutions, proposes a hub-and-spoke structure in which every asset publishes to a central broker and consumers subscribe. There is no staircase where Level 2 climbs through Level 3 to reach Level 4. Every node has equal access to a single namespace.
The right answer is to decouple the flattening of the data plane from the segmentation of the security plane. The pattern that Proxus's UNS implementation guide and HiveMQ's IDMZ reference architecture both put forward looks like this:
- Place the broker in the IDMZ (Level 3.5) — OT publishes outbound only, and IT and cloud subscribe from the IDMZ. OT assets accept no inbound sessions.
- Broker bridging — connect the internal OT broker to the IDMZ broker over a one-way bridge, exposing only approved topics.
- Sparkplug B state management — make asset state explicit with Birth/Death certificates so session interruptions do not erode data trustworthiness.
- Topic-level ACLs — grant publish and subscribe rights per path, based on client certificates. An implementation where "you're on the broker, so you can see everything" invites incidents.
- Hardware unidirectional gateways (data diodes) for SL3/SL4 segments — software diodes are vulnerable to misconfiguration. The highest-assurance segments need physical one-way enforcement.
- Store-and-forward — buffer at the edge during outages so that availability requirements never become pressure to bypass security boundaries.
The 2026 Industrial Data & AI Readiness Survey, published jointly by Inductive Automation, HighByte, and HiveMQ, pinpoints exactly this: the primary bottleneck holding back AI adoption is neither models nor talent, but the absence of an architecture that can deliver data reliably across security boundaries.
4. Zero Trust and IEC 62443 — Zones and Conduits, Reinterpreted
Let's clear up a common misconception first. Zero Trust is not a new layer model that replaces Purdue. It is a one-sentence principle — "network location is not trust" — and, ironically, that principle points to almost exactly the same place as the zones and conduits that IEC 62443 has required since 2009. A 62443 zone is not a physical subnet but a logical grouping of assets that share the same security requirements, and a conduit is a controlled communication path between zones. From the start, 62443 spoke of segmentation by function, never segmentation by cable.
The practical shift is identity-based microsegmentation. Policy is assigned not by which VLAN an asset sits on, but by what it is, who uses it, and what it must communicate with, over which protocols. The decisive advantage is that it can handle assets that cannot be patched. A 20-year-old PLC, a CNC controller whose OS updates are contractually forbidden, an instrument whose firmware source has vanished — that is OT reality. The conclusion Elisity reached after comparing six compliance frameworks is unambiguous: the essential compensating control for unpatchable assets is identity-aware, agentless network segmentation.
Claroty, in its blog post "Mastering Zero Trust Segmentation to Secure ICS," ties this directly to 62443 compliance evidence: implement Zero Trust segmentation and you can satisfy and demonstrate the requirements of 62443 at the same time. CISA's 2025 guidance and the U.S. Department of Defense's Zero Trust document for OT likewise position it not as a replacement for Purdue but as a hardening layer applied at Level 3.5 and above. Regulators and standards bodies have already converged on the compromise: keep Purdue, change the trust model.
Zones and conduits are boundaries of function, not subnets — what IEC 62443 has been saying since 2009.
5. CPS Protection Platforms — the Vendor Landscape Redrawn
The market already reflects this shift. In 2026, Gartner published the Magic Quadrant for CPS Protection Platforms, redefining the old "OT security" category as cyber-physical systems (CPS) protection platforms. The evaluation covered 17 vendors, including Armis, Cisco, Claroty, Darktrace, Dragos, Forescout, Fortinet, Honeywell, Microsoft, Nozomi Networks, OPSWAT, OTORIO, Palo Alto Networks, Radiflow, Tenable, and TXOne. The roster itself is the message. Pure-play OT specialists and IT security giants competing in the same quadrant means the market no longer supports separate IT and OT tooling.
Gartner's separate 2026 Market Guide for CPS Secure Remote Access reveals another axis: remote access is moving from "connectivity granted over a VPN" to "operational control in which each session is approved, recorded, and isolated." The heart of it is the shift from secure connectivity to secure operations. When a vendor engineer connects to a robot cell, if the commands he issued are not captured through session recording and command-level approval, that is not control — it is delegation.
6. NOA and O-PAS — the Standards Camp's Answer
If the security camp answered with Zero Trust, the automation standards camp answered another way. NOA (NAMUR Open Architecture), proposed by NAMUR — the user association of the German chemical and process industries — adds a second channel instead of smashing the Purdue pyramid. While the existing DCS keeps the Level 0-3 control path intact, NOA lays a separate, parallel data path for monitoring and optimization (M+O), and that path is designed to be one-way so it cannot intervene in control. In other words, it hard-wires the principle "data flows freely, control stays strict" into the architecture itself.
O-PAS (the Open Process Automation Standard), by contrast, is far more radical. Developed by OPAF under The Open Group with ExxonMobil in the lead, this standard aims to replace the proprietary DCS itself with a standards-based, multi-vendor interoperable system. Standard controllers called Distributed Control Nodes (DCNs) decouple field I/O, and applications become portable, like containers. Since the early prototype led by Don Bartusiak, it has gone through several interoperability testbeds, and a paper published on ScienceDirect describes it as "a standards-based, open, secure, interoperable process control architecture." The consensus in the standards camp is that NOA, O-PAS, and MTP are not competitors but should be harmonized as complements. For brownfield plants, NOA's parallel channel is the realistic route; new greenfield lines are worth evaluating against O-PAS's open controllers.
NOA adds a read-only channel without touching the DCS — the realistic answer for brownfield.
7. Case 1 — Manufacturing Ransomware and the Economics of Visibility
Dragos's Q1 2026 industrial ransomware analysis shows the mechanism by which IT/OT convergence amplifies damage. In many incidents, the breach occurred in enterprise IT, but the actual production outage came from the loss of OT visibility. When engineering workstations, production planning systems, and historians are encrypted, the plant stops even if the PLCs are untouched — because operators can no longer see what is happening. Indeed, many manufacturers reported that "the PLCs were fine, but we shut the line down as a precaution."
This is where the economics of visibility becomes visible. Convert the 42-day versus 5-day gap into revenue. If we conservatively put the hourly production value of a tier-1 automotive parts plant at KRW 30 million, that is KRW 720 million per day on a 24-hour operating basis. A 37-day difference in detection delay translates into exposure on the order of tens of billions of won. The cost of deploying OT network monitoring, by contrast, typically runs at 1-2% of that amount. That 54% of the organizations Dragos assessed still lack adequate monitoring suggests this is not a budget problem but a governance problem — OT simply never makes it onto the IT risk register.
8. Case 2 — An Experiment in Using the Digital Twin as a Policy Decision Point
Academia is proposing architectures that go a step further. The QZT-ICS framework, published in Frontiers in Computer Science and AI, presents a unified Zero Trust architecture for IT-OT convergence, and its core idea is intriguing: use a digital twin, synchronized in real time, as the Policy Decision Point.
Conventional Zero Trust decides "may this user access this asset?" from identity and device posture. QZT-ICS adds process-aware trust scoring: evaluating in real time whether the requested command, when simulated on the digital twin, would leave the physically safe state space. Even if a command to open a valve to 80% passes authentication and authorization, it is rejected if the twin judges it to be a path toward reactor runaway. Policy enforcement points (PEPs) are embedded in the 5G slice and TSN bridge layers, and key exchange uses post-quantum cryptography based on the NIST standards ML-KEM and ML-DSA.
This is not a technology every plant can adopt today. It requires three prerequisites in full: a high-quality digital twin, a TSN-capable network, and a private 5G network. But the direction is clear. Access control in the future will ask not only "who," but also "what does this command do to the physical world." Answering that question requires OT data to flow in real time, with context, across security boundaries. Ironically, the future of security hinges on the maturity of data integration. The arXiv study on the evolution of Zero Trust architecture (2504.11984) and the literature review of Zero Trust in the IoT context (2604.06272) reach the same conclusion.
9. How KOPENS PlantPulse Addresses This Problem
PlantPulse from KOPENS (Korea Open Solution Co., Ltd.) takes the dilemma this article has laid out — the data plane must be flat while the security plane must be segmented — as the starting point of its design. More than 200 industrial protocol connectors absorb heterogeneous assets at Levels 0-2, while the collected tags are mapped onto an ISA-95-based asset model that preserves their hierarchical meaning. Rather than erasing the layers from the network, the approach moves them into the data model. As a result, you gain the flat accessibility of a UNS while always being able to answer "which line, which equipment, which security zone does this tag belong to?"
The edge-cloud hybrid structure adopts the IDMZ pattern wholesale. Edge nodes perform collection, normalization, and buffering inside the OT zone and do outbound publishing only to the IDMZ broker. Cloud and IT applications never establish direct sessions with OT assets. Store-and-forward prevents data loss during outages, so the familiar compromise of "punching a hole in the firewall for availability's sake" never comes up. IEC 62443 compliance was assumed at the design stage, and topic- and tag-level access control and audit logging are built in from day one. The decisive difference is that governance is not a follow-on project. Many organizations lay the pipeline first and fail when they try to bolt on security, lineage, and quality a year or two later.
A flat data plane and a segmented security plane — satisfying both demands at once is the challenge of modern industrial architecture.
10. Frequently Asked Questions (FAQ)
Q1. So should we throw out the Purdue model? No. What must be thrown out is the equation "layer = physical network boundary = trust boundary." Purdue's level numbers remain valid as a shared language for asset classification, risk communication, and safety-grade assignment, and CISA, NIST, and the DoD still maintain it as a reference model. The practical recommendation is to keep Purdue as a conceptual segmentation guide and layer IEC 62443 zones and conduits, plus Zero Trust policy, on top of it.
Q2. Doesn't applying Zero Trust to OT hurt availability? It does if you implement it badly. OT's highest values are safety and availability, and a design in which an authentication failure translates into a process stoppage is unacceptable. That is why the orthodox approach to Zero Trust for OT starts with segmentation, monitoring, and session control rather than inline blocking. Industrial Cyber's 2026 analysis likewise reports that industrial operators prioritize visibility, segmentation, and operational resilience over identity alone. Introduce policies that intervene directly in control loops last, and pair them with fail-open designs.
Q3. What do we do about legacy PLCs that cannot be patched? The common conclusion reached by six or more major compliance frameworks is that the essential compensating control for unpatchable assets is identity-aware, agentless microsegmentation — enforcing, at the network layer and without installing agents on the asset, a policy such as "this PLC communicates only with this HMI, over this protocol only." Combine that with passive protocol inspection (Claroty, Nozomi, Dragos) and much of the detection gap can be closed.
Q4. Does adopting a UNS make security worse? The UNS itself is neutral; the risk comes from the implementation. Put the broker in the middle of the OT zone and hand every client wildcard subscribe permissions, and you have donated a perfect asset map to attackers. Conversely, place the broker in the IDMZ, allow outbound publishing only, and apply topic-level ACLs and client certificates, and the UNS instead becomes a controlled single pathway — safer than scattered point-to-point connections.
11. Conclusion — Don't Erase the Layers; Move the Trust
The Purdue model's thirty years are not a history of failure. It was an excellent design built on clear premises — the premises simply changed. The air gap is gone, data flows across layers, and attackers treat IT and OT as one terrain. In this reality, continuing to believe the hierarchy is a physical rampart is dangerous — and discarding the layer concept altogether and flattening everything is more dangerous still.
The practical prescription fits in three sentences. First, flatten the data plane while segmenting the security plane more finely. The UNS and the IDMZ broker pattern are compatible, and they are most powerful used together. Second, move the basis of trust from network location to identity and context. IEC 62443's zones and conduits were saying this from the beginning. Third, invest in visibility first. The difference between 42 days and 5 days is not a technology gap; it is the difference between observing and not observing.
There is no need to start with a grand architectural redesign. Three things you can do this quarter: (1) Add an "OT impact assessment" step to your IT incident response playbook — it costs nothing and the effect is immediate. (2) Measure the network visibility of your OT zones. Start by finding out whether you are in the 46% or the 54% by Dragos's yardstick. (3) Inventory every path by which OT data crosses into IT. Most organizations discover tunnels they never knew about while compiling this list. That is the real starting point.
Related Resources
- Dragos, 2026 OT Cybersecurity Year in Review and Industrial Ransomware Analysis, Q1 2026 — 119 ransomware groups, 3,300 affected organizations, more than 2/3 in manufacturing, dwell time of 42 days versus 5 days
- Gartner, Magic Quadrant for CPS Protection Platforms (2026) and Market Guide for CPS Secure Remote Access (2026)
- Filipe Beato (WEF Centre for Cybersecurity) interview, Industrial Cyber, "How AI is quietly rewiring the Purdue Model"
- Jimber, The Purdue Model in 2026: Why Flat IT-OT Networks Fail
- Claroty, Mastering Zero Trust Segmentation to Secure ICS / Elisity, Microsegmentation Compliance Requirements: A Six-Framework Guide
- HiveMQ, MQTT-Based Manufacturing Reference Architectures / Inductive Automation, HighByte, and HiveMQ, 2026 Industrial Data & AI Readiness Survey / Proxus, The Architect's Guide to Unified Namespace
- NAMUR Open Architecture (NOA) — PROFIBUS & PROFINET International / Bartusiak et al., "Open Process Automation: A standards-based, open, secure, interoperable process control architecture", Control Engineering Practice
- arXiv:2504.11984 The Evolution of Zero Trust Architecture / arXiv:2604.06272 Zero Trust in the Context of IoT / QZT-ICS, Crypto-Agile Zero Trust Architecture for IT-OT Convergence, Frontiers in CS & AI
© KOPENS — Industrial DataOps & PlantPulse Platform