Bottling machine manufacturer replaces VPN sprawl with zero trust remote access

Background

Today’s automated manufacturing environments run on remote access. To ensure smooth production, they require access for service partners and external vendors like machine builders. This access becomes even more important when equipment issues arise.

But for one European bottling machine manufacturer, enabling remote access had become a growing security and compliance concern.

The company operates complex operational technology (OT) environments that support both internal production teams and external vendors. Over time, remote access had evolved into a patchwork of VPNs and custom-built solutions—tools that were originally deployed to keep operations moving but didn’t meet modern security expectations, NIS2 in particular.

With increased regulation and security risks, the company now needed to figure out how to grant access to vendors and meet compliance requirements without exposing their sensitive OT environments.

Challenge

The manufacturer relied on VPN-based solutions to grant external vendors access to its production environment. While this approach was functional, it came with clear limitations:

• VPNs provided broad network access, rather than precise, role-based permissions
• Access was difficult to standardize and audit across IT and OT systems
• Vendor connections increased the attack surface of the production environment
• Existing solutions did not meet emerging NIS2 compliance requirements

From a security perspective, the situation was becoming increasingly risky. From a compliance standpoint, it simply wasn’t sustainable.

Responsibility for addressing these risks sat with the IT security team. Their job was to strengthen the company’s security posture without disrupting plant operations or slowing down vendor support.

Goals

The company set out to rethink how external access was managed across its production environment. Rather than adding another point solution, the team defined a clear set of goals:

• Replace VPN-based and non-compliant access methods
• Introduce a zero-trust approach to remote access
• Enable secure access to both IT and OT assets, including PLCs
• Improve governance, auditability, and maintainability
• Ensure alignment with current cybersecurity regulations, including NIS2

Crucially, the solution had to work at scale, supporting hundreds of endpoints in live production environments. And it had to do all this without adding complexity for internal teams or external partners.

Solution

To meet these requirements, the manufacturer adopted TeamViewer Tensor for operational technology as a centralized, zero trust remote access platform.

Rather than extending network access via VPNs, Tensor enabled secure, session-based access to specific systems—only when needed, and only to authorized users.

Key aspects of the approach included:

• Unified zero trust access for IT assets (such as Windows XP systems) and OT assets (including Programmable Logic Controllers, or PLCs)
• Centralized access control managed by the cybersecurity team
• Strong enforcement of least-privilege access, reducing exposure of the OT network
• Support for large-scale environments, with 500+ production endpoints
• Clear separation between users, assets, and permissions

By consolidating remote access into a single platform, the organization eliminated tool sprawl and reduced reliance on custom or homegrown solutions.

Results

With TeamViewer Tensor in place, the manufacturer significantly improved how external access was governed across its production environment.