URL Category Data for OT and Industrial Network Security
Controllers, HMIs and historians should talk to very few internet destinations. When one of them suddenly reaches a file host or a remote access service, someone needs to know quickly and understand what it means.
This guide is for product teams building OT security, industrial firewalls, secure remote access and OT monitoring tools. It covers where URL category data fits, which categories matter on the plant floor, and how to deliver data to sites with little or no connectivity.
Where URL category data plugs into OT security products
OT products already see the traffic leaving industrial zones. Category data turns each unfamiliar destination into a clear label that an engineer can act on without being a web security expert.
Zone egress policy
Industrial firewalls and boundary proxies block whole categories that have no place near production, while allowing named update and licence servers.
Unexpected destination alerts
Passive monitoring sensors label every outbound domain, and raise alerts when an OT asset reaches a risky or unusual category.
Remote access oversight
Secure remote access products spot unapproved remote access tools reached from inside the plant, a common route around official channels.
Engineering workstation browsing
Workstations that need some web access get a narrow category policy instead of a full ban or a full open door.
Incident investigation
When something goes wrong, categories in the connection history show which contacts were routine and which were not.
Compliance reporting
Reports by zone and category give auditors evidence that internet access from industrial zones is controlled.
Supplier access review
Categories on the destinations used by contractors and equipment suppliers show whether they connect through the approved path or their own tools.
Remote site gateways
Cellular gateways at pumping stations, substations and wind sites can enforce a small category list to keep bandwidth and attack surface low.
Category policy by network level
Many OT teams describe their networks in levels or zones, from field devices up to enterprise IT, in the spirit of reference models and zone and conduit concepts used in industrial security standards such as IEC 62443. The deeper the level, the narrower internet access should be.
None in most plants. Any internet contact is itself an incident.
Label the destination in the alert so responders know at once what was contacted.
None or a single named service. Strict allowlist.
Same as above: labels for alerts, never as the main control.
A few named update, time or licence services.
Allowlist plus alerts on any risky category, such as file hosting or remote access.
Vendor portals, documentation, some cloud services.
Narrow category policy: allow technology and vendor sites, block risky and leisure categories.
Patch downloads, remote access through approved tools.
Tight category policy with logging of every category hit.
Normal business browsing.
Full web filtering policy, covered in enterprise web security.
Categories that matter in industrial networks
Most of the 59 web filtering categories should simply never appear in industrial zones. A handful carry specific meaning, either as a strong risk sign or as a label for legitimate traffic; definitions are on the category list.
| Category | Typical action in OT zones | Why it matters |
|---|---|---|
| Remote Access Tools | Block and alert | Unapproved remote access is one of the most common ways into industrial networks. Only the approved access path should work. |
| VPN / Proxy / Anonymizers | Block and alert | Tunnels hide traffic from monitoring and bypass the boundary zone. |
| Malware / Phishing / Suspicious | Block and alert | Direct risk label. Any hit from an OT asset deserves an incident review. |
| Cryptomining | Block and alert | Mining on industrial computers points to compromise and can disturb timing-sensitive systems. |
| Cloud Storage / File Hosting | Block and alert | A route for project files and recipes to leave the plant, and for tools to arrive unchecked. |
| File Sharing/P2P, Freeware/Software | Block | Unofficial software downloads are a classic infection path on engineering machines. |
| AI / LLM Tools | Policy decision | Engineers may paste configuration or logic into AI tools. Allow only approved services, if any. |
| Streaming Media, Social Networking, Gaming | Block | No business need on operator stations, and a waste of limited bandwidth at remote sites. |
| Computers & Technology | Allow named sites | Vendor documentation and support portals. Allow named vendors rather than the whole category. |
| CDN / Hosting / Infrastructure | Label only | Update downloads often come through content delivery networks. Use the label to explain traffic, not to allow it. |
Allowlists and categories work together
In OT, strict allowlists remain the main control wherever they can be maintained. Category data fills the gaps allowlists leave and makes every violation easier to understand.
Where allowlists lead
- Controllers, safety systems and field devices
- HMIs and SCADA servers with a few named services
- Any asset where a change needs formal approval
- Sites with very stable communication patterns
Where categories help
- Engineering workstations that need some web access
- Jump hosts and patch servers in the boundary zone
- Labelling every allowlist violation in alerts
- Reports that summarise outbound traffic by type
Turning a category hit into the right alert level
A category alone does not say how serious a connection is in OT. Combining it with what your product already knows about the asset, the zone and the time gives operators alerts they can trust.
| Category hit | Asset and zone | Context | Suggested alert level |
|---|---|---|---|
| Any category | Controller or field device | Any internet contact at all | Critical |
| Remote Access Tools | HMI or SCADA server | No approved maintenance window | Critical |
| Malware / Phishing / Suspicious | Any OT zone | Any time | High |
| Cloud Storage / File Hosting | Engineering workstation | Upload larger than usual | High |
| Parked or uncategorized new domain | Supervisory or operations zone | First seen across the customer's sites | Medium |
| AI / LLM Tools | Engineering workstation | Not on the approved list | Medium |
| Computers & Technology | Patch server in boundary zone | Named vendor site, inside maintenance window | Log only |
Common pitfalls in industrial deployments
Bringing web category data close to production needs care. These are the problems OT vendors meet most often, with a simple way to avoid each.
Blocking update traffic
Content delivery and hosting categories carry legitimate patches. Allow named update servers explicitly before enforcing category blocks.
Enforcing too early
Run in monitor mode first and review a few weeks of labelled traffic with the operator before blocking anything.
Mixing data and plant changes
A data update should not need a production change approval. Keep data bundles separate from firmware and configuration changes.
One profile for all sites
A remote pumping station and a large factory need different defaults. Ship zone profiles that sites can adjust.
Stale offline copies
Air-gapped sites can fall months behind. Show the data age in the console and warn when it passes a threshold.
Unexplained alerts
Engineers are not web security experts. Explain each category in plain words inside the alert.
Delivery for plants: offline files, exports, API and real-time lookup
Industrial sites range from well-connected factories to remote stations with no outside link at all. The data comes in forms that suit each, and the same licence covers them; file formats are described on the web filtering database page.
Offline database
CSV, Parquet or JSON that runs inside your management server or sensor, including in fully air-gapped networks.
Category subsets
Small exports of only the blocked categories, as external dynamic lists, RPZ or hosts files, for devices with limited memory. See blocklist formats.
Real-time lookup
A local index in passive sensors or boundary proxies, so every connection is labelled with no outside call.
Lookup API
Included with licences, called from a central console in the IT side for domains a local copy lacks. See the API documentation.
Keeping the data fresh at industrial sites
New attack domains appear daily, but plants change slowly and carefully. A good product separates the data update from the change process for production systems, and lets each site choose its rhythm.
Daily deltas
About 300,000 newly registered domains are categorized every day. Connected management servers apply delta files automatically and push subsets to sensors and firewalls.
Scheduled push
Sites behind one-way gateways receive delta bundles on a fixed schedule from the IT side, with no return path needed.
Bundled updates
Fully isolated sites import a bundle of deltas through their approved media process, often weekly or with each maintenance window.
Examples from industrial security products
These scenarios show category data inside OT products. Each uses only the domain category plus what the product already observes on the network.
The weekend remote session
A passive sensor sees an HMI reach a site in Remote Access Tools on a Saturday night. The alert names the category, and the on-call engineer confirms no approved session was planned.
Recipes on a file host
An engineering workstation uploads a large file to a personal file host. The boundary proxy blocks it by category and the security team follows up with the engineer.
Tiny firewall, focused list
A small industrial firewall loads only a subset of risky categories as an external list. It keeps memory use low and still blocks anonymizers and mining pools.
AI tools at the line
Engineers start using AI chatbots to debug controller code. The product reports the trend by category, and the operator decides which AI tools, if any, are approved.
Labelled incident timeline
After an incident, investigators review a week of outbound connections. Categories split routine update traffic from three contacts with new, suspicious domains.
Audit evidence
A monthly report shows zero contacts from production zones to leisure or risky categories, which the site uses as evidence for its auditors.
Integration steps for OT products
These steps take category data from a licence into a working OT feature. Most vendors ship labelling and alerts first, then enforcement where they control the traffic path.
Load centrally
Import the database into your management server, keyed by host and registered domain.
Label connections
Add categories to every outbound connection your sensors or firewalls record.
Define zone profiles
Ship default category policies per zone that operators can tighten or relax.
Alert on the unexpected
Raise alerts when an asset in a deep zone reaches any category, or a risky one in an upper zone.
Export subsets
Generate small category lists for devices that enforce policy locally.
Plan updates per site
Support daily, scheduled and offline bundle updates with clear versioning.
Explain in the console
Show the category beside every alert and connection in plain words.
Report by zone
Summaries of outbound traffic by zone and category for operators and auditors.
What to check before licensing category data for OT
Industrial customers ask hard questions about anything that runs near production. These are the points to confirm with any data supplier; terms for embedding are on the OEM licensing page.
Runs offline
Files that work fully inside the customer's network, including air-gapped sites.
Small subsets
Exports of selected categories for devices with tight memory.
Security categories
Remote access, anonymizer, mining and phishing labels that match OT threats.
Daily new domains
About 300,000 new domains categorized each day, with rechecks.
Coverage
120 million categorized domains, with the 20 million most visited covering 99.99% of web traffic and usage.
Measured accuracy
Regular manual validations, with reports available to licence holders.
OT and industrial network FAQ
Why would an OT network need URL category data?
Industrial assets should reach very few internet destinations. Category data lets an OT product spot and block the rest, and gives engineers clear labels for every unexpected connection.
Is category filtering a replacement for allowlisting in OT?
No, strict allowlists stay the main control for controllers and field devices. Categories help where allowlists are hard to maintain and label anything that breaks the allowlist.
Can the data run in an air-gapped plant network?
Yes, the database is delivered as files that run inside your own systems, including air-gapped deployments. Isolated sites import delta bundles on a schedule that suits their change process.
Which categories matter most in industrial networks?
Remote Access Tools, VPN / Proxy / Anonymizers, Cloud Storage / File Hosting, Malware / Phishing / Suspicious, Cryptomining, File Sharing/P2P, Freeware/Software and AI / LLM Tools carry most of the risk meaning.
Our industrial firewalls have limited memory. Can we still use the data?
Yes. Licensed customers can export category subsets as external dynamic lists, RPZ or hosts files, so a device only loads the categories its policy needs.
How fresh is the data?
About 300,000 newly registered domains are categorized every day as daily delta files. Each is checked again after a week and after a month, and all other domains are refreshed monthly.
Does the data inspect industrial protocols?
No, category data labels internet domains only. Protocol inspection, asset inventory and anomaly detection remain the job of your OT product.
Which licence fits an OT security vendor?
An OEM licence, because the categories run inside a product sold to operators. Group-wide licences suit vendors with several product lines.
Should a new OT deployment start by blocking categories?
No, start in monitor mode, label all outbound traffic for a few weeks and review it with the operator. Named update and licence servers can then be allowed explicitly before any category is blocked.
How do we show which data version a site was running?
Version every delta bundle and record which bundle each site imported and when. That gives operators and auditors a clear answer about the data in use on any given day, which matters for incident reviews.
Clear labels for every connection that leaves the plant
Tell us which OT products you build, how your customers' sites are connected and where policy is enforced. We will suggest the data layout and licence that fit.
License the database OEM licensing