Siemens SINEC Secure Connect vs. NetFoundry OpenZiti: What's really under the bonnet?

What SINEC Secure Connect is

SINEC Secure Connect was presented by Siemens at it-sa 2025 in Nuremberg and positioned as the first Zero Trust security platform developed specifically for Operational Technology. The software virtualises network structures via overlay networks and uses these to establish machine-to-machine, machine-to-cloud and machine-to-datacentre connections as well as remote access to plant, explicitly without classic VPN tunnels. Shopfloor end devices remain invisible from outside; communication is no longer authorised via IP addresses and firewall rules, but via identities and policies. The solution is delivered via the Siemens Xcelerator marketplace, either on-premises, in the cloud or as a hybrid.

From a network architect's perspective, this is the classic ZTNA overlay approach: a controller manages identities, policies and the network state. Edge routers form an encrypted switching network. Endpoints only ever establish outbound connections, so no inbound ports need to be opened. For legacy devices that cannot host their own software, gateways or upstream network components handle the connection, in Siemens's case naturally the SCALANCE product line.

What OpenZiti is

OpenZiti is an open-source Zero Trust network platform under the Apache 2.0 licence, developed and maintained by NetFoundry. Every participant, whether user, device, service or workload, receives an X.509 certificate identity. Connections are authenticated before a network path is established and authorised according to attribute-based policies. Services do not listen on any inbound ports, endpoints connect exclusively outbound, and traffic is encrypted end to end.

The core components are a controller for identities, policies and network state, edge routers forming an encrypted mesh with intelligent routing and failover, as well as tunnellers for legacy applications and SDKs for direct embedding into custom software. OpenZiti can be operated entirely in-house; alternatively, NetFoundry offers the platform as a commercially operated managed service with a global fabric and enterprise support. NetFoundry has also publicly stated that its own technology is built into products by OEMs, including major automation manufacturers in the OT and ICS sector.

The evidence: Siemens uses OpenZiti / NetFoundry within the product

Siemens itself does not prominently mention NetFoundry in its product communications for SINEC Secure Connect. Nevertheless, the publicly available sources are unambiguous. Three findings are particularly telling.

1. NetFoundry explicitly names the partnership

On its own website, NetFoundry describes a partnership with Siemens and states that Siemens SCALANCE and Siemens SINEC Secure Connect contain NetFoundry's Zero Trust network software, meaning no additional software or hardware needs to be installed in Siemens OT environments (source: netfoundry.io/ot/ot-connectivity). In a podcast by the ARC Advisory Group, NetFoundry CEO Galeal Zino confirms the same statement: Siemens has built NetFoundry directly into the SCALANCE product lines and into SINEC Secure Connect (source: netfoundry.io/resources/rethinking-industrial-cybersecurity).

2. Siemens documentation refers directly to OpenZiti software

The official Getting Started guide for SINEC Secure Connect V1.0 (SIMATIC NET, as of 12/2025) describes, for installing the Edge Client on Windows, the download of the file "Ziti.Desktop.Edge.Client-x.x.x.x.exe" and refers directly, as the source, to the OpenZiti GitHub repository github.com/openziti/desktop-edge-win/releases. The client that SINEC Secure Connect users install on their machines is therefore the unmodified OpenZiti tunneller (source: Siemens Industry Online Support, document C79000-G8976-C759-01).

3. Operational and registration processes run via NetFoundry

The same handbook documents that at least one NetFoundry-hosted edge router must be present on the network, and that users receive their registration email from NetFoundry after purchase. The terminology of the management interface, too, identities, edge routers, router attributes, attribute-based access control (ABAC), matches the OpenZiti object model one to one. Taken together, these points allow for hardly any other conclusion: at its core, SINEC Secure Connect is a version of the NetFoundry platform built on OpenZiti, productised by Siemens and integrated into its own portfolio, a white-label or OEM model exactly as NetFoundry itself describes its business model.

What does this mean for the comparison?

If both products share the same technical core, the comparison shifts from the data layer to operations, integration and responsibilities. That is precisely where the relevant differences lie.

Integration and target audience

SINEC Secure Connect is tailored to the Siemens ecosystem: Zero Trust functions are already built into SCALANCE components, the platform fits into the SINEC tool landscape, and procurement, support and warranty are all handled by Siemens. For operators whose automation and network technology already comes from Siemens, this is the shortest path to an identity-based overlay, without additional agents on network components and with a single accountable vendor. OpenZiti, by contrast, is aimed at organisations that want to remain vendor-independent or need to connect heterogeneous environments: there are tunnellers for common operating systems, SDKs for seven languages, and no tie-in to any device family.

Operating model and data path

OpenZiti can be fully self-hosted, including the controller and all edge routers. For many OT operators and critical infrastructure environments, this is a significant argument, as the entire data path remains within their own area of responsibility. With SINEC Secure Connect V1.0, the documented architecture provides for at least one edge router hosted by NetFoundry, and identity onboarding also runs via NetFoundry infrastructure. Anyone introducing SINEC Secure Connect should therefore clarify precisely which connection metadata and which payload data paths run via the NetFoundry fabric, where these routers are located, and what happens to existing sessions if the cloud component becomes unreachable. These are not knock-out criteria, but they are essential questions for any protection needs and risk analysis.

Transparency and supply chain

Paradoxically, the open-source variant has the advantage here: the code that transports the traffic is fully visible and auditable in OpenZiti. The same applies to the underlying open-source components in the Siemens product, but the composition first has to be reconstructed from the open-source licence notices and documentation. For NIS2 and IEC 62443 contexts, where supply chain transparency is required, the dependency chain of Siemens, NetFoundry, OpenZiti belongs in the documentation, including the question of how quickly security fixes from the upstream project reach the Siemens product.

Competence and responsibility

With OpenZiti, you are not buying a product but taking on an operational task: controller hardening, PKI lifecycle, router placement, updates. This requires personnel with the corresponding depth of expertise, but grants full control. SINEC Secure Connect shifts these tasks to the vendor and reduces the organisation's own share to policy maintenance and identity management. Between these two poles sits NetFoundry's commercial offering, which delivers the same platform as a managed service without any tie to Siemens.

Practical assessment

The decision is less a technology comparison than a question of operating and procurement model. In heavily Siemens-oriented plants with SCALANCE infrastructure and a desire for a single point of contact, SINEC Secure Connect is the pragmatic route, provided the cloud components in the data path are compatible with the organisation's own protection requirements. In heterogeneous environments, where sovereignty requirements are high, or where the overlay also needs to cover non-Siemens components, data centres and cloud workloads, OpenZiti, whether self-operated or as a NetFoundry service, is the more flexible foundation. In both cases, the overlay does not replace network segmentation according to IEC 62443: zones, conduits and a clean cell structure remain the foundation; the identity-based overlay is the layer on top that resolves remote access and cross-site communication without open ports and without a sprawling, historically grown VPN landscape.

The key takeaway remains: anyone evaluating SINEC Secure Connect is, technically speaking, evaluating an OpenZiti/NetFoundry architecture in Siemens clothing. The publicly available knowledge about OpenZiti, documentation, source code, community experience, can therefore be used directly to assess the Siemens product. Ultimately, this is an advantage for operators: the platform is not proprietary uncharted territory, but a widely used, verifiable Zero Trust stack.