Two German mid-sized security vendors combine attack detection, segmentation and secure remote access on a single hardware platform – a response to mounting regulatory pressure on critical infrastructure, according to the companies.
Operators of critical facilities are legally required to detect attacks, yet a separate monitoring appliance at every site is costly. consistec Engineering & Consulting GmbH and ads-tec Industrial IT GmbH want to remove that burden: their joint solution runs the caplon© detection software as a Docker container directly on ads-tec’s industrial router firewall.
The partnership, announced in mid-September, was explained at it-sa 2026 in Nuremberg by consistec founder Thomas Sinnwell and ads-tec CFO Stefan Greiner as well as Simon Göggel of ads-tec product management. According to the companies, the caplon© NDR/IDS probe runs on the IRF series of Industrial Router Firewalls. The appliance links the site to a central caplon© instance via LTE and VPN, filters locally at layer 3 and divides the network into up to eight segments. A separate monitoring device is no longer needed, which, Sinnwell says, lowers follow-on costs. Detecting and fixing anomalies, segmenting and rolling out updates centrally are the functions the partners combine.
For consistec, the project builds on a long history. The company is 26 years old and grew out of an engineering office that built tools for customers. The Snowden revelations of 2013 prompted it to develop monitoring systems that can detect data exfiltration, says Sinnwell; the caplon© platform emerged from that work. Monitoring, including VoIP monitoring, is now the core business. Cybersecurity is driven largely by regulation today, he notes, with AI and machine learning playing a growing role.
Göggel points out that Docker is widespread in machine building, which makes the container approach a natural fit. Firewall integration at the edge uses rootless Docker and also covers secure remote maintenance. Remote service runs via the Big-LinX® platform: instead of a technician’s laptop connecting to the plant network, work takes place in isolated virtual service environments with fine-grained rights management and local release by key switch, according to ads-tec. The partners say they can support customers from concept to operation.
On the product side, consistec is adding anomaly detection with explainable alerts for critical infrastructure, a new network view that correlates events and an optional SIEM connection. Explainable AI matters because operators need technical metrics they can verify, Sinnwell says. A waste incineration plant serves as a reference in the KRITIS sector. The roadmap includes AI for resilient systems, tools to keep several thousand devices manageable through an API-first approach, central update control and a self-learning firewall for brownfield sites. The latter is meant to generate filter rules automatically, enable microsegmentation and relieve IT administrators, says Göggel.
The regulatory pressure is considerable. Section 31(2) of the German law BSIG obliges operators of critical facilities to use attack detection systems, the NIS2 Implementation Act has applied since December 2025, and reporting duties under the Cyber Resilience Act apply from 11 September 2026. Greiner adds the Machinery Regulation: segmentation inside the machine gets production running again faster after an incident, and logging creates visibility. OT updates must be possible without interrupting operations; his formula is no open doors. Docker also helps in brownfield environments, he says, by moving old machines from insecure to secure systems.
ads-tec has built industrial PCs for 45 years, according to Greiner, and developed its own firewall, router and cloud offering about 15 years ago. Development is in-house, with around 70 employees in Nürtingen and 40 in Dresden, where hardware and development are based. References include turbines and hospitals; Siemens is named as a competitor, while ads-tec stresses its focus on the Mittelstand. Two German mid-sized security companies on one piece of hardware: for Greiner, that is the core of the partnership. Security begins with trust, he says, and the partners meet at eye level.
consistec initially sold directly and now works with resellers and technology partners; ads-tec also sells through partners and system integrators. Sinnwell calls ads-tec the partner consistec had wished for: the shared aim is a digitally sovereign solution down to the circuit board, with the power supply as added value. Both are expanding: activity in Austria is at an early stage, Poland is next, and ads-tec reports talks across Eastern Europe. Geopolitics has made sovereignty a very clear purchasing argument, says Sinnwell. consistec describes its digitally sovereign solution as unique among OT competitors.
Sinnwell draws a lesson from an attack on a customer who, in his words, was simply unlucky: protecting the perimeter is not enough, monitoring is needed. Greiner warns against imposing IT thinking on OT. The two worlds see things differently and differences remain, but both sides increasingly understand that they must cooperate. The yardstick is availability: machines must run. The offering targets operators of industrial plants, energy and utility networks, water management and telecoms infrastructure, as well as resellers and security consultants.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de