Updated July 2026 · 7 min read · Adente Vision Engineering Team
What does OT/IT segmentation mean for a vision cell?
OT/IT segmentation is the practice of separating the operational-technology network that runs the plant floor from the information-technology network that runs the business, so a problem on one side cannot cross into the other. The common reference is the Purdue model, which layers a plant from the physical process and controllers at the bottom (Levels 0-2), through site operations (Level 3), up to enterprise IT and the internet at the top (Levels 4-5). A vision cell that inspects parts and drives a reject belongs at the bottom, next to the PLC it signals.
The segmentation question for inspection is therefore concrete: does adding the vision cell require a new path across the OT/IT boundary, or does it stay inside the OT zone where the rest of the cell already lives. The answer depends entirely on where the inspection decision is computed.
Adente Vision is an edge-AI visual inspection unit built by ADENTE Advanced Engineering Technologies, part of the Aden Group, sold through automation system integrators, and it is designed to sit in the OT zone and talk only to the cell.
Why does cloud vision force a hole in the OT boundary?
Cloud vision forces a hole because the decision is made outside the plant. If the pass/fail comes from a model hosted on an external service, then every cell needs a route from the OT floor, up through the segmentation layers, out to the internet and back, which means an outbound firewall rule and a live dependency that crosses the boundary the segmentation exists to protect. That path is exactly what a plant security team is trying to minimise.
An outbound hole is not only a policy problem, it is an attack-surface problem. Each cell with a route to an external endpoint is one more thing to authenticate, patch, monitor and reason about when assessing what could reach the controllers. The more cells that need the boundary opened, the harder the network is to defend and the weaker the segmentation becomes in practice.
Where does an edge inspection unit sit in the Purdue model?
An edge inspection unit sits low, at the cell and controller levels, and never needs to reach past site operations. The unit captures the image, runs the model on-device and emits the result straight to the PLC, so the entire decision loop stays inside the OT zone at Levels 1-2. No leg of the decision travels up to Level 4 or 5, and so there is no outbound hole to open for inspection to work.
| Concern | Cloud or networked vision | Edge unit in the cell |
|---|---|---|
| Purdue placement | Needs a path from Levels 2-3 out to an external service | Lives at Levels 1-2, beside the PLC |
| Outbound firewall rule | Requires an outbound hole to a cloud endpoint | None; no outbound dependency for the decision |
| Protocols on the wire | Adds cloud APIs over IT networking | Fieldbus and 24V I/O only, on the OT network |
| Attack surface | New external exposure per cell | No cloud dependency to attack |
| Data leaving the plant | Raw frames cross the boundary | Images stay on the line; nothing crosses |
Read across the table and the segmentation story is one-sided: the edge unit adds an inspector to the cell without adding a boundary crossing. Because inference runs on a fanless Jetson-class board inside the enclosure and results go out over fieldbus or discrete I/O, the cell gains a full AI check while the network diagram gains nothing that crosses the OT/IT line.
Which protocols keep the vision cell on the plant network?
The unit talks to the cell over the same industrial protocols the rest of the floor already uses, so nothing has to leave the OT network. Adente Vision speaks PROFINET, EtherNet/IP, Modbus TCP, EtherCAT and OPC UA, and carries discrete signals over 4 inputs and 4 outputs at 24V. A pass/fail, a variant code or a reject command travels as a fieldbus tag or a hardwired signal to the PLC, all on the plant network, none of it routed to an external service.
That protocol set matters for segmentation because it makes the inspector a peer of the PLC, not a client of the cloud. Where a remote dashboard is wanted for monitoring, it can be fed metrics without moving raw frames, and on an air-gapped line model updates arrive by USB stick, so even the update path does not require opening the boundary.
What do you hand plant IT for sign-off?
What you hand plant IT is a short, closed list: an OT-side device that speaks fieldbus and 24V I/O, computes its decision on-device, and has no outbound cloud dependency for inspection. Raw part imagery, which is sensitive process IP, stays on the line, so there is no data-egress rule to write and no external region to risk. The unit's exposure is the same class as any other cell device, not a new internet-facing service.
That is the practical case for placing an edge inspector in the OT zone: it drops into the cell like a smart sensor, keeps the segmentation intact, and gives the integrator a clean answer when the customer's security team asks where the vision unit belongs and what it can reach. For how the unit fits an integrator programme, the broader edge-versus-cloud trade-off in the sibling post on edge vs cloud visual inspection, and the full method in the pillar guide on AI visual inspection.