Nozomi Networks and Schweitzer Engineering Laboratories (SEL) have extended their industrial cybersecurity partnership, connecting information from SEL operational technology software-defined networks directly with the Nozomi monitoring platform. The partners have also made Guardian security sensors available for deployment on SEL-3355 industrial computers, adding a rugged hardware option for utilities and other critical infrastructure operators. The integration, announced on 20 October, extends the companies’ existing relationship rather than replacing their established network and security products.
SEL’s operational technology software-defined networking, known as OT SDN, is designed to maintain explicit paths for communication between authorised industrial devices. In a conventional Ethernet deployment, switches can learn addresses and forward traffic according to their configured networking functions. SEL’s managed approach instead allows engineers to define permitted communication flows, an important distinction when a protection relay should exchange messages with a designated controller but not with unrelated devices on the same network.
Nozomi receives intelligence from the SEL networking environment about connected equipment, network topology, traffic flows and configured policies. Combining that information with its own observations can help distinguish unexpected connections from normal activity. A traffic change during planned maintenance has a different operational context from an unsolicited connection between two devices with no permitted route. The integration supplies more of that context to the security monitoring process without treating every change as evidence of an attack.
SEL network controls and Nozomi monitoring perform different jobs. A configured switch policy can constrain where traffic is permitted to travel, whereas an anomaly detection system identifies patterns requiring investigation. The connection between them can make it easier to compare actual network behaviour with an engineer’s documented design, but detecting a suspicious exchange does not automatically isolate an asset or rewrite a switch configuration. Such actions would require approved operational procedures and appropriate controls.
Nozomi Guardian can now be deployed on the SEL-3355 computing platform, which SEL designs for utility and industrial environments where vibration, temperature and equipment life differ from office computing conditions. The manufacturer offers several operating environments for the hardware, including its Blueframe application platform. Deploying security monitoring on a familiar industrial computing platform could simplify site integration where operators already use SEL equipment, although the partners have not reported customer adoption numbers for this particular configuration.
Industrial estates and utility sites often contain equipment installed over several generations, including protection relays, remote terminal units, programmable controllers and engineering workstations. Some communicate through modern managed networks, while other devices have older protocols or tightly controlled maintenance windows. The monitoring arrangement therefore needs to reflect which interfaces and switches are visible, which assets cannot be queried directly, and whether additional collection points are needed. SEL Blueframe forms part of the partners’ stated software and hardware options, not a requirement for every deployment.
Electrical protection networks illustrate the constraint on cybersecurity integration. A relay may have to recognise a fault and issue a trip command within a prescribed protection interval. Monitoring traffic must not interfere with those protection messages, while changes to network policy need verification against the approved protection scheme. A security system can improve investigators’ view of the network without taking over the deterministic control functions performed by protection and automation equipment.
The companies also identify internal network security monitoring requirements under NERC CIP-015-1, alongside wider NERC Critical Infrastructure Protection obligations, IEC 62443 and guidance from the US National Institute of Standards and Technology. These frameworks address different aspects of security and apply in different circumstances. Device inventories, network boundaries, incident procedures, access management and testing records remain necessary even where monitoring software supplies additional technical evidence. Installation alone does not demonstrate that a regulated facility is compliant.
Network configuration records become more useful when they are maintained alongside engineering changes. Replacing a controller, enabling a new link or moving a device between segments may alter which flows are expected, and a monitoring system that sees the new traffic without the approved configuration can produce misleading alerts. SEL’s policy intelligence may help narrow that gap, provided engineers update the source configuration and the sensor has sufficient visibility. Neither company has disclosed a measured reduction in cyber incidents attributable to the new integration.
Nozomi and SEL have collaborated on industrial security since 2024. Their latest release makes the direct OT SDN integration available now and specifies the SEL-3355 option for Guardian deployment. Operators considering the arrangement can assess whether its network information, monitoring points and hardware design match their plant architecture, then validate the configuration against protection performance, maintenance procedures and any applicable security requirements.
