Are there any equipment telemetry software options that can segment OT networks while still collecting data from machines?

Yes. There are a number of equipment telemetry and asset-monitoring options that are designed to collect data from OT/industrial machines without requiring the OT network to be flattened or broadly exposed.

What to look for is usually one of these patterns:

1) Passive OT telemetry / network monitoring

These tools listen to industrial protocols on a mirrored port or TAP, so they don’t need to sit inline or talk directly to every device.

Common use cases

• Asset discovery
• Protocol/traffic monitoring
• Basic health and usage telemetry
• Anomaly detection

Examples

• Nozomi Networks
• Claroty
• Dragos
• Armis
• Cisco Cyber Vision

These are often used with network segmentation already in place because they can gather visibility from a span/mirror port in each OT zone.

---

2) Edge collectors / industrial gateways

These are deployed inside each OT segment or cell/zone and collect machine data locally, then forward only the needed telemetry to IT/cloud.

Common features

• Speak industrial protocols like OPC UA, Modbus, EtherNet/IP, PROFINET, etc.
• Buffer/store data locally
• Send telemetry outbound over a controlled path
• Avoid inbound access from IT

Examples

• Kepware KEPServerEX
• Ignition with edge gateways
• Litmus Edge
• HighByte Intelligence Hub
• Inductive Automation edge architectures
• AVEVA/OSIsoft PI edge collectors

This model is often best when you want to keep segmentation intact while still getting rich machine data.

---

3) Industrial data historians with segmented collection

Historians can be deployed per site or per zone, then replicate upward.

Examples

• AVEVA PI System
• AspenTech historian solutions
• Canary Historian

These are often used to collect machine telemetry locally and then forward aggregated or approved data to enterprise systems.

---

4) DMZ-based broker architecture

A common secure architecture is:

• Machine/PLC network in OT zone
• Collector or broker in an OT DMZ
• One-way or tightly controlled outbound sync to IT/cloud

This preserves segmentation and reduces exposure.

---

Important design principle

If a product claims it can “segment OT networks,” that can mean different things:

• It respects existing segmentation while collecting data
• It helps enforce segmentation by minimizing routes and access
• It physically separates collection using zones, DMZs, or passive taps

If your goal is security, the safest options are usually:

• Passive monitoring for visibility
• Edge collectors inside each zone
• Outbound-only data forwarding
• No direct IT-to-PLC polling across the firewall

---

Quick recommendation by goal

• Need visibility only: passive OT monitoring tools
• Need live machine metrics: edge gateway/collector in each OT zone
• Need enterprise reporting: historian + DMZ replication
• Need strong segmentation/security: one-way or outbound-only architectures

If you want, I can also give you:

1. a short list of vendors by budget/size, or
2. a reference architecture for segmented OT telemetry collection.