In the world of cybersecurity, passionate debates often emerge about the "right" approach to microsegment critical systems. For years, vendors have staked claims on either agent-based or agentless segmentation, advocating their chosen method as the superior solution. But what if the reality - especially for complex environments like electric utilities - requires a more nuanced perspective?
At Zentera, we've deliberately taken a different path. Rather than forcing customers to choose between agent-based or agentless security, we've built our platform to support both approaches. This wasn't a marketing decision - it was driven by understanding the true nature of modern utility infrastructure and the impossible choice utilities would face if limited to just one model.
Electric utilities operate some of the most complex and diverse technology environments in existence. In a single organization, you might find:
Given this complexity, why would we force utilities to choose a single security model?
Many security vendors advocate agent-based protection, which requires installing software on each protected system. This approach offers excellent visibility and control, but creates insurmountable challenges in utility environments:
For utilities, these aren't edge cases - they represent critical infrastructure components that simply cannot accommodate agent-based security.
There are a variety of approaches to agentless microsegmentation, and they are not all equal. Vendors who champion agentless approaches often gloss over the inherent limitations of their chosen architecture.
The first category of agentless microsegmentation solutions out there are essentially tools that manage the existing network on your behalf. Once installed, these tools take over the management of VLANs, ACLs, and firewalls to implement your policies in the network. But the downsides of this approach include:
The second category includes agentless approaches that effectively reroute application traffic to a defined inspection point in the network. This can be done, for example, by changing the default gateway of machines to point to a microsegmentation enforcement point. The downsides of this approach include:
These limitations can significantly reduce security effectiveness and carry the potential to create more problems than they solve.
When we designed our Zero Trust platform, we recognized that forcing utilities to choose between these models would inevitably leave critical systems unprotected. Instead, we designed an architecture where:
This wasn't the easy path - building both capabilities required significant investment - but it was the right approach for the operational realities of electric utilities.
For systems that can support agents, this approach offers significant advantages:
The agent approach provides deeper visibility into system behavior, more granular control over applications, and stronger enforcement at the workload level - all critical capabilities for systems that form the operational backbone of modern utilities.
For systems that cannot be modified, agentless protection becomes the only viable option:
For the reasons listed above, Zentera took a different approach to agentless protection. Our Microsegmentation Gatekeeper (MSG) acts as an inline filter for these systems, applying identity-based security policies through network enforcement rather than on-device agents. This creates a logical security boundary - essentially a virtual chamber - around critical OT assets, all without changing the path application packets take through the network.
The MSG deploys transparently, making a “bump in the wire” compatible with redundancy protocols like HSR and PRP, and supports configurable fail-open to preserve availability in the event of software or hardware failure.
For utilities implementing a hybrid security approach, we recommend:
This methodology allows utilities to implement Zero Trust architecture across their entire infrastructure without facing the impossible task of standardizing their technology stack.
Consider a medium-sized electric utility with generation, transmission, and distribution operations. Their environment includes:
With a hybrid security approach, this utility can:
By implementing both models under a unified policy framework, the utility achieves comprehensive protection without sacrificing operational reliability.
As utility infrastructure continues to evolve, the need for flexible security approaches will only increase. Digital transformation initiatives, grid modernization, and renewable integration are creating even more technological diversity.
The future belongs not to dogmatic security models but to flexible approaches that adapt to operational realities. For utilities facing sophisticated threats while maintaining critical infrastructure, the hybrid agent/agentless model offers the best path forward - comprehensive protection without operational compromise.
At Zentera, we remain committed to this reality-based approach. We believe that security must adapt to the infrastructure it protects, not the other way around. By embracing both agent-based and agentless models, we're ensuring that no critical system remains unprotected due to technological limitations.
Ready to implement a hybrid security approach for your utility infrastructure? Learn more about securing vendor access in our detailed guide on vendor access management for utility cybersecurity, and discover how Zero Trust architecture aligns with regulatory requirements in our comprehensive NERC CIP Zero Trust white paper. For a personalized consultation on protecting your grid infrastructure with Zentera's hybrid agent/agentless platform, contact our team today.