The Purdue Model still holds up because it was never really a network diagram. It is a way of sorting industrial systems by how fast they have to respond and how much damage they can do, and that sorting logic survives cloud connectivity intact. What has changed is that the model now describes a set of trust boundaries to be enforced deliberately, rather than a physical hierarchy that enforced itself.
That distinction matters to anyone signing off on a plant modernization budget. A common argument in board presentations holds that cloud and edge computing have made the layered architecture obsolete, and that the money should go toward flattening it. The engineering evidence points somewhere less convenient: the layers are still the right way to think, and the work of maintaining them has become harder rather than unnecessary.
What the model actually organizes
The framework came out of Purdue University’s work on computer-integrated manufacturing and became the default reference for industrial control. A 2026 survey in the Journal of Cybersecurity and Privacy on encryption for industrial control systems puts the history plainly, noting that the model has been the foundational architecture for these systems since its introduction in 1992, and that before its adoption, deployments lacked standardization and often involved a variety of loosely connected devices.
The model stacks a plant’s technology into levels. At the bottom sit the sensors and actuators touching the physical process, responding in milliseconds. Above them are the controllers running logic, then supervisory systems where human operators watch a process area, then site operations with historians and production systems, then the business layer, then corporate infrastructure. Response time slows and business relevance rises as you move up.
The same survey identifies where the real boundary falls, describing the level that marks the transition between operational technology and information technology as the place that hosts remote access servers and security tools such as firewalls, proxies, intrusion detection systems, and data diodes. That is the seam every modernization program eventually has to cut through.
The air gap that mostly is not there anymore
For a long time the separation enforced itself. Plant networks had no physical connection to corporate networks or the internet, which made the boundary a fact of wiring rather than a policy decision. Almost nobody operates that way now. Remote diagnostics, cloud analytics, supplier access, and the ordinary desire to see live production numbers from a phone all require paths that a true air gap forbids.
The survey is direct about the tradeoff, observing that modern architectures enable seamless communication and continuous data exchange across previously siloed components, and that this increased connectivity significantly broadens the surface for cyber attacks well beyond traditional IT devices. The benefit and the exposure arrive together.
Detailed walkthroughs of the Purdue model tend to converge on the same limitation: the framework describes one plant. It explains how a single facility should organize its levels and where to place controls between them. It says nothing about how a company running twenty facilities, each with its own version of those levels, is supposed to govern them as a group.
| The boundary that matters most
A 2026 survey of industrial control system security identifies the level marking the transition between operational technology and information technology as the place that hosts remote access servers along with firewalls, proxies, intrusion detection systems, and data diodes. |
Segmentation is a design discipline, not a purchase
Federal guidance has settled on segmentation as the primary structural defense. A 2025 fact sheet on primary mitigations to reduce cyber threats to operational technology, issued jointly by CISA, the FBI, the EPA, and the Department of Energy, instructs operators to segment IT and OT networks and to introduce a demilitarized zone for passing control data to enterprise logistics, on the reasoning that this reduces the potential impact of cyber threats and the risk of disruption to essential operations.
The same guidance takes a harder line on direct exposure, advising operators to remove operational technology connections to the public internet outright, because these devices lack authentication and authorization methods resistant to modern threats. That advice is easy to endorse and difficult to implement in a plant where a vendor support contract depends on remote access.
Segmentation also carries an ongoing cost that rarely appears in the business case. The industrial control systems survey notes that designing, implementing, and maintaining a robust segmentation strategy requires significant expertise in networking and cybersecurity, and that misconfigured firewall rules or access control lists can inadvertently block critical operational traffic. A segmented network that stops production is not a security success.
The specialist capability required is itself substantial. Idaho National Laboratory’s national security and cybersecurity program maintains over 150,000 square feet of laboratory space dedicated to operational technology cybersecurity, grid and wireless security, and infrastructure resilience, including a supervisory control and data acquisition laboratory with remote access for industry and academic research.
The volume of incident activity behind these recommendations is not trivial. The ENISA Threat Landscape 2025, published by the European Union Agency for Cybersecurity, analyzed 4,875 incidents recorded between 1 July 2024 and 30 June 2025. Manufacturing and industrial operators do not face a hypothetical threat model, and boards evaluating segmentation spend should treat it as a recurring operating cost rather than a one-time hardening project.
Where the model runs out: one plant versus many
The gap in the framework becomes expensive at portfolio scale. A company with twenty plants does not operate one industrial control system. It operates twenty, each with its own controllers, its own historian, its own operator workstations, and its own accumulated integration decisions. Every one of those stacks may be internally coherent and correctly segmented. Collectively they are incomparable.
Leadership feels this as a reporting problem before it feels it as a security problem. Asking how a site is performing against another site requires a human translator, because the two facilities name the same measurement differently and define the same alarm differently. Asking which sites are exposed to a newly disclosed vulnerability requires the same translation, under time pressure.
The layered structure the model describes is exactly the right thing to preserve at each site. What no version of it supplies is the layer above all the sites, the one that makes twenty coherent stacks legible as a single governed system.
Extending rather than replacing
Most engineering teams have landed in the same place. They treat the levels as a reference for reasoning about trust and consequence, then adapt where cloud and edge realities break the vertical stack. A sensor that reports directly to a cloud service has skipped several levels, and the honest response is to define what security controls replace the ones it bypassed rather than to pretend the sensor is not there.
Zero trust thinking fits this well, verifying each request between zones rather than trusting a segment because of where it sits. That is a change in how the boundaries are enforced rather than a change in where the boundaries belong.
There is a governance consequence that follows from this and tends to arrive late in the discussion. Once the boundaries are enforced by policy rather than by wiring, somebody has to own the policy, and at most companies nobody does. Plant engineering owns the equipment. Corporate IT owns the network. The zone between them, which is precisely where the model says the tightest inspection belongs, sits in a gap between two budgets and two reporting lines. Incidents in that gap are usually described afterward as technical failures. They are more often organizational ones.
The same gap explains why segmentation decays. A firewall rule added to let a vendor troubleshoot a compressor over a weekend is rarely removed on Monday, because removing it requires knowing who added it and why, and neither fact was recorded. Multiply that across several years and several vendors and the segmented architecture on the drawing no longer describes the network in the building. Periodic verification against the design is unglamorous and is the only thing that keeps the two in agreement.
For a chief executive weighing a modernization proposal, the useful question is not whether the architecture is old. It is whether the proposal keeps the trust boundaries the architecture describes while adding the portfolio-level view the architecture never had. Proposals that flatten the plant to gain visibility are trading a control the operators depend on for a report the executives wanted. The two are not equivalent, and the trade is usually a bad one.
