Most engineers think…
Most people picture OT sensor deployment as 'one box anywhere on the network'. In a Purdue-model OT environment, placement is everything — and getting it wrong means blind spots in the zones that matter most.
A Nozomi Networks deployment is a layered topology: Guardian sensors at the right Purdue-level aggregation switches (not everywhere — not on every device), each fed by a SPAN port or a TAP, all feeding up to a CMC or Vantage. Knowing which Purdue level gets a sensor, when to upgrade from SPAN to TAP, and how to roll out without alarming OT operators — that is what the next 16 minutes covers.
① The Purdue model — which levels get a Guardian sensor
The Purdue Reference Model (Levels 0–5 plus the IT/OT DMZ at Level 3.5) defines the zones of an industrial network. Guardian sensors are not placed on every device — they sit at aggregation switches where traffic from an entire zone crosses one point.
The primary Guardian placement zones are: Level 2 (HMIs, SCADA servers, historians, engineering workstations — the richest traffic for asset discovery and anomaly detection); Level 3 (MES, operations servers, site historians — north–south traffic between control and business zones); and Level 3.5, the IT/OT DMZ (firewalls, jump servers, OPC proxies — critical for detecting cross-boundary anomalies and firewall-bypass). Levels 0–1 (PLCs, RTUs, field instruments) are usually covered by the Level 2 SPAN, since field-bus traffic converges at the Level 2 switch anyway.
Levels 4–5 and beyond
The enterprise LAN (Levels 4–5) is normally covered by IT security tooling. A Guardian at the Level 4 switch can catch OT-to-corporate lateral movement, but is optional in most deployments. Guardian Air (the wireless variant) is added wherever Wi-Fi, Bluetooth, or cellular OT devices operate — often outside the standard Purdue wired hierarchy.
In most Nozomi deployments, the primary Guardian placement zone is…
② SPAN vs TAP — how Guardian gets its traffic feed
Guardian is completely passive: it never injects packets into the OT network. Traffic reaches it one of two ways. A SPAN port (mirror port) is a feature built into most managed switches — the switch copies selected port traffic to a monitoring port. SPAN is free and easy to configure, but many switch models allow only one SPAN destination at a time, and under heavy load the switch may drop mirrored frames before Guardian sees them.
A network TAP (Test Access Point) is a dedicated hardware device placed inline on a link. It copies 100% of frames to Guardian with no packet loss, regardless of link utilisation — the physical copy is passive and cannot be saturated by the live traffic. TAPs are recommended for high-value chokepoints: the IT/OT DMZ uplink, the historian server connection, or any link where a packet-dropping SPAN would create blind spots in asset inventory or forensics.
Sizing per zone
Guardian sizing (appliance model or virtual spec) scales with link bandwidth and asset density per zone. The guiding principle is one Guardian per discrete network zone or VLAN. A typical mid-size substation might deploy two Guardians: one for the Level 2 control zone and one for the Level 3/DMZ zone. Virtual Guardians (VMware, Hyper-V, container) are common in sites where rack space is limited.
Nozomi's core passive network sensor — passive DPI, asset discovery, anomaly and threat detection. Deploys as appliance, VM, or container; never touches OT traffic.
Central Management Console — on-prem or virtual aggregator for multiple Guardians. Ideal for air-gapped, sovereign, and regulated sites that cannot send data to the cloud.
Cloud-native SaaS management platform. Aggregates Guardians and Arc across many global sites with no management hardware — adds Vantage IQ (AI analytics) for faster triage.
Lightweight host sensor adding user, process, USB, and session context — fills coverage gaps in zones that have no SPAN port and cannot be seen by passive Guardian monitoring.
The classic over-deployment mistake is trying to put a sensor on every switch. The right model is one Guardian per discrete network zone or VLAN — placed at the aggregation point where all zone traffic converges. This minimises sensor count while maximising coverage.
The IT/OT DMZ uplink switch is heavily loaded at peak. Which collection method should you use for the Guardian feed?
③ CMC & Vantage — the management topology above Guardian
Individual Guardians are powerful, but multi-site OT programmes need a central management layer. Nozomi offers two paths. The Central Management Console (CMC) is an on-prem or virtual appliance that aggregates data from many Guardians across one or more sites — ideal for air-gapped, sovereign, or heavily regulated environments (power utilities, defence, water) where OT metadata cannot leave the site perimeter. CMC provides centralised policy, cross-site alerts, and consolidated reporting without any cloud dependency.
Vantage is Nozomi's cloud-native SaaS alternative: Guardians (or a CMC) send data to Vantage over encrypted HTTPS. Vantage scales effortlessly across dozens of global sites, adds Vantage IQ (AI-assisted triage and correlation), and requires no management-layer hardware. For hybrid estates — some sites air-gapped, some cloud-connected — CMC aggregates air-gapped Guardians and forwards summary/alert data on to Vantage, giving a single pane of glass globally.
Arc fills the coverage gaps
Arc, Nozomi's lightweight host sensor, complements Guardian by reaching segments that have no SPAN port — micro-segmented zones, isolated workstations, or point-to-point serial links visible only from the host. Arc adds user, process, USB, and session context that passive network monitoring cannot see.
Vantage SaaS is ideal for cloud-connected sites, but air-gapped OT environments (power substations, nuclear, water treatment, defence) cannot send traffic metadata to the cloud. CMC is the correct on-prem aggregation layer for those sites. Always confirm cloud-connectivity policy before choosing Vantage.
▶ Watch a rogue device get discovered passively by Guardian
How a new unauthorised PLC is discovered through the Level 2 SPAN, identified by Guardian, and surfaced in Vantage. Press Play for the healthy path, then Break it to see the classic SPAN failure.
A power utility operates three substations that are fully air-gapped — no internet or cloud access. Which management topology fits?
④ Multi-site & phased rollout — deploying without alarming OT
A successful Nozomi rollout follows four phases. Phase 1 — Passive discovery: deploy Guardian in monitor-only mode; let it build a complete asset inventory and learn the network baseline over 2–4 weeks. Zero alerts, zero OT impact — operators do not notice it. Phase 2 — Baselining & tuning: review the discovered asset list, map assets to Purdue levels and zones in CMC/Vantage, tune detection thresholds, suppress known-good behaviour, and reduce false positives before any alerting is enabled.
Phase 3 — Operational alerting: enable active alert policies. Integrate with SIEM/SOAR (Splunk, Microsoft Sentinel, IBM QRadar) and ticketing (ServiceNow, Jira). At this point the SOC begins receiving OT alerts in the same console as IT alerts. Phase 4 — Site expansion: replicate the pattern to additional sites and zones, onboard new Guardians to the existing CMC or Vantage instance, and add Arc for host-visibility gaps. Each new site repeats Phases 1–3 before going live with alerting.
Integration hooks
Nozomi integrates with firewalls (Palo Alto, Fortinet), identity platforms, and vulnerability scanners via syslog, REST APIs, and certified connectors — the SOC correlation layer gets richer OT asset context without re-architecting the security stack.
Priya Nair, OT security architect at PowerGrid India Pvt. Ltd. in Nagpur, faces this
After Phase 1 Guardian deployment at a substation, Vantage shows 40% of Level 2 assets as 'unknown' — vendor and firmware cannot be identified.
The SPAN port on the heavily loaded Level 2 switch is dropping mirrored frames during peak SCADA polling cycles; Guardian misses the initial broadcast packets that carry device identity.
In Vantage, filter assets by site and sort by 'Classification confidence' — the unknown assets all appear in the same VLAN. Check Guardian packet-drop counters; they show significant loss during peak windows. SPAN oversubscription is the root cause.
Vantage ▸ Assets ▸ Filter by site ▸ Classification + Guardian ▸ Diagnostics ▸ Packet countersReplace the SPAN connection with a hardware TAP on the two most critical uplinks to Guardian. No switch config change needed after the TAP is installed — Guardian begins receiving every frame.
Within hours of the TAP install, Vantage asset inventory drops to under 5% unknown. The previously 'unknown' PLCs are now fully identified with vendor, model, and firmware version.
After Phase 1, open the Vantage or CMC asset inventory and check the 'Classification confidence' column. High unknown-asset rates (above 10–15%) are a strong signal of SPAN packet loss — not a Guardian limitation. Switch to a TAP on the affected link and re-run the discovery phase.
An OT team is nervous about enabling Nozomi alerts because past tool deployments triggered nuisance alerts during shift changes. What is the correct first phase?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does a Nozomi deployment place Guardian at Level 2 rather than on every switch in the plant? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Guardian
- Nozomi's core passive network sensor — passive DPI, asset discovery, anomaly and threat detection, vulnerability assessment. Deploys as appliance, VM, or container.
- CMC (Central Management Console)
- On-prem or virtual aggregator that consolidates multiple Guardian sensors across one or more sites without cloud dependency — the choice for air-gapped and sovereign environments.
- Vantage
- Nozomi's cloud-native SaaS management platform — aggregates Guardians and Arc, single pane of glass, scales across many sites, adds Vantage IQ (AI analytics).
- Arc
- Lightweight Nozomi host sensor adding user, process, USB, and session context — fills passive network monitoring blind spots in zones without a SPAN port.
- SPAN port
- Switch mirror port that copies selected port traffic to a monitoring port; free and easy but can drop mirrored frames under heavy switch load.
- Network TAP
- Dedicated hardware device that passively copies 100% of frames on a link to Guardian with zero packet loss — recommended for high-value chokepoints.
- Purdue Model
- Reference architecture for industrial control systems, Levels 0–5: field devices (0–1), supervisory (2), site operations (3), IT/OT DMZ (3.5), enterprise (4–5).
- Guardian Air
- Wireless Guardian variant for Wi-Fi, Bluetooth, cellular, and drone-spectrum OT visibility — complements wired Guardian in sites with wireless OT devices.
📚 Sources
- Nozomi Networks — Guardian sensor product page & data sheet. nozominetworks.com/products/guardian
- Nozomi Networks — Vantage SaaS platform overview & Vantage IQ. nozominetworks.com/products/vantage
- Nozomi Networks — Central Management Console (CMC) overview. nozominetworks.com/products/central-management-console
- Nozomi Networks — Arc endpoint sensor. nozominetworks.com/products/arc
- NIST SP 800-82 Rev 3 — Guide to Operational Technology (OT) Security: Purdue Reference Model for ICS. nist.gov
- ISA/IEC 62443 — Industrial Automation & Control Systems (IACS) security standards: zone and conduit model. isa.org
What's next?
Got the deployment topology? Next, go deep on how Guardian's hybrid detection engine builds its behaviour baseline, fires anomaly alerts, and how Nozomi Labs Threat Intelligence feeds enrich detection in real time.