Zero Trust Architecture

Zero Trust, all the way to the sensor.

Zero Trust is proven on the network. PSG embeds it in the devices below the network, where readers, sensors and cameras have always been trusted by default.

ZERO TRUST ARCHITECTURE

THE ARCHITECTURE

Where PSG works, and what it feeds

Every filled node is a PSG product. Click one to open its product page. Outlined nodes are the systems you already run.

Zero Trust Architecture

Authenticated and verified (A-V), edge to enterprise.

  • PSG product: hover or click for details and spec sheets.
  • Third-party product: shown for architecture context.
  • Zero Trust

Decisions made on data verified at every layer below.

Purdue 4 to 5 · Third party

Cloud
Command CONOPS

Deploy, response force

AI data mining
Modeling and simulations

Command and control, video and compliance, working from authenticated data.

Purdue 2 to 3 · PSG

Security operations center (SOC)

ZTA Data Lake

Security Command Center

ZTA unified PSE solution: C2, access, intrusion, video, cyber.

C2 GUIs

LINX™ IQ

3D graphical user interface

View product LINX™ IQ
VICADS® V100

Video management GUI

View product VICADS® V100

HPC cluster

LINX™ 10 Enterprise

Intrusion and access control

View product LINX™ 10 Enterprise
VICADS V100

Video management software

View product VICADS V100
CyberSecurity Solution

Local cyber compliance enforcement

View product CyberSecurity Solution

Panels, controllers and scene authentication give every signal an identity.

Purdue 1 · PSG

Scene Authentication™

Every pixel verified. Every incident captured.

View product Scene Authentication™
Universal Field Panel™

CybSEC + PhysSEC with edge dockers

Gateway and expansion modules

View product Universal Field Panel™
Emitter

PKI-encrypted light beyond the lens for scene-level authenticity

View product Emitter
DESI Controller

Analog to digital I/O conversion module

View product DESI Controller
UFP Gateway and Expansion Modules
Drones and handhelds

Extend perimeters for responding teams.

Scene Authentication and DESI embed in any camera, sensor, reader or door hardware.

Purdue 0 · PSG embedded

Scene Authentication can be embedded into any camera or encoder
DESI can be embedded into any sensor, reader or door hardware

Premise Control Unit, SCIF Configuration, Portable IDS.

PSG

The trust gap

Where trust has always been assumed

Zero Trust is a solved problem on the network. Identity, segmentation and monitoring authenticate every user and every request at the enterprise and operations layers. Below the switch, at the levels the Purdue Model calls 0 and 1, the picture is different. The devices that detect an intrusion or open a door still report over supervised loops designed decades ago.

A supervised loop can tell a panel that a wire is intact or that a circuit changed state. It cannot prove the signal came from the intended sensor. A door contact is a closed circuit. A motion sensor is a resistance value. Anyone who reaches the cable can imitate either.

trust

Embedded, not overlay

Complement the platforms you run. Do not replace them.

PSG does not compete with network security, PSIM, access control or building automation platforms. Those systems collect, manage and act on information from field devices; they are overlay technologies. PSG operates one layer below, inside the device and the signal path at Purdue Levels 0 and 1.

Every PSG device carries a cryptographic identity, authenticates its communications and verifies its data before anything above it acts. The platforms you already run receive information they can trust instead of information they have to assume. Your existing investment becomes more valuable, not less, and nothing is ripped out to get there.

embedded, not overlay

How it works

The architecture, one question at a time

What embedded actually means

Embedded Zero Trust is built into the device, not bolted onto the network around it. Each PSG controller and interface carries its own cryptographic identity and performs its own authentication and encryption at the point of detection. There is no gateway vouching for the sensor. The sensor speaks for itself, and it can prove who it is.

How a sensor gets an identity

On a legacy supervised loop, the DESI Controller replaces the end-of-line resistor. The wire, conduit, sensor and door hardware stay where they are. From that point the loop carries authenticated, encrypted signaling over the same pair, and the panel accepts a change of state only when the device on the other end proves it sent it. Modernization without rip-and-replace.

What stays and what changes

Cameras, readers, sensors, fence detection, wiring and conduit stay. Command and control, video management and building platforms stay. What changes is the trust model: devices are verified before they join the system, every event is authenticated before anyone acts on it, and stored data keeps its chain of custody. That is the Four Pillars of Trust, from the far edge to the enterprise.

Why trusted by default is the risk

Physical security systems were built to detect physical events, not to defend against cyber manipulation. As they converge with IT, OT, cloud and AI, every field device is part of the attack surface, and automation acts on whatever those devices report. A manipulated signal means a false alarm, a missed intrusion, or a decision made on bad data. Trust not established at the source cannot be assumed anywhere else.

HOW IT WORKS

PRODUCTS

The products at every layer of the architecture

Unified Security Platforms

Unified Security Platforms

Command and control for intrusion, access, and video in one operator view.

Learn more
Self-Contained Systems

Self-Contained Systems

Complete systems for a defined deployment, from a SCIF to a portable perimeter.

Learn more
Video Management

Video Management

Video verified live at the scene, from the camera to the operator and the archive.

Learn more
Intelligent Controllers

Intelligent Controllers

Zero Trust at the door and the fence line, on the wiring already installed.
Learn more
Cybersecurity

Cybersecurity

Compliance enforcement and a trusted data lake that keep every layer verified.

Learn more

See the architecture on your site

Bring us a drawing, or a description of what is installed. Visit with a PSG systems engineer who will map your site to the architecture and show where Zero Trust reaches.

Closing CTA · protected facility-1