← Back

ENGINEERING NOTES · Jul 2026

Purdue vs. Zero Trust: they're not opposites

One is a segmentation map. The other is an access philosophy. Confusing them leads to poorly designed architectures.

Every so often someone asks me if Zero Trust 'replaces' the Purdue model in OT. Short answer: they don't compete, they operate at different layers.

Purdue answers 'where does everything live, and what can talk to which zone?' — it's architecture, it's the map. Zero Trust answers 'why do I trust this specific connection, right now, coming from this identity?' — it's a philosophy of continuous verification, not a network diagram.

In practice, the combination that works is: use Purdue (or 62443's zones and conduits) to define the coarse boundaries, and apply Zero Trust principles within each zone and across the conduits that cross it — especially remote maintenance access, which today is the most common entry point in OT incidents.

What doesn't work is trying to apply 'pure' IT-style Zero Trust directly onto a 15-year-old PLC that doesn't support modern authentication. There, the realistic solution is to put identity control at the conduit (jump host, access broker), not at the device.