TXOne Networks is an operational technology (OT) security company that protects factories, utilities and other industrial sites without interrupting the processes they run. Its products guard industrial networks, legacy and modern endpoints, and the USB drives and laptops that move between sites, and they are built for the plant floor, where IT security tools often fail.
Its buyers are OT security leaders and plant engineers who need to stop malware and unauthorised changes on systems that cannot be patched, rebooted or taken offline, and who answer to industrial security regulations.
At A Glance
| Vendor | TXOne Networks |
|---|---|
| Category | OT/IoT Security |
| Deployment | Inline appliances, endpoint agents, virtual appliances, on-premises or cloud consoles |
| Agentic AI | MCP connector and AI alert engine in EdgeOne |
| Scale | 3,600+ industrial organisations across 50+ countries (reported) |
| Market classification | OT/IoT Security |
What TXOne Networks Does
Industrial environments cannot be patched on a whim or taken offline for a scan, and many still run Windows versions decades old. TXOne Networks builds its defence-in-depth model around that reality, from the enterprise network down to the process level, covering Levels 0 to 3 of the Purdue model. Each layer gets a control suited to it: what enters a site is checked first, endpoints are locked to known-good behaviour, industrial traffic is inspected inline, and operators get one view of assets, risk and policy across sites. Protection is designed to keep running in air-gapped plants and on decades-old Windows machines, and supports compliance with ISA/IEC 62443, NIS2, NERC CIP and TSA security requirements.
Products
TXOne Edge
Edge secures industrial networks by understanding the commands that pass over them, not only the ports and protocols, across 180+ industrial protocols. Legacy systems that cannot be patched get virtual patching, backed by 1,500+ OT-native threat signatures from Zero Day Initiative research.
| EdgeIPS | An intent-based industrial IPS that learns asset rules automatically, with fail-safe bypass and up to 40 Gbps of threat prevention, as physical models or the vEdgeIPS Pro virtual appliance. |
|---|---|
| EdgeFire | An industrial next-generation firewall with micro-segmentation across L1 to L3, Monitor and Prevention modes, and IPSec VPN. |
| EdgeOne | The management console, with network-based Asset Vulnerability Management. |
TXOne Stellar
Stellar brings zero trust to OT and ICS endpoints, including machines too old for conventional antivirus.
| Stellar Protect | A prevention agent, licensed as ICS or Kiosk, with application allowlisting, automatic per-device baselines, USB device control and configuration lockdown. |
|---|---|
| Stellar Discover | A detection-only sensor that runs in user space with no drivers, kernel access or reboot. |
| StellarOne | The console for both agents. |
| CPSDR | Cyber-Physical Systems Detection and Response, which blocks unauthorised changes before they run. |
TXOne Element
Element inspects removable media and visiting devices with portable and kiosk-based scanners, so malware is caught before a USB drive or contractor laptop reaches the line. A Virtual Portable Inspector extends agentless inspection across OT environments.
TXOne Sennin
Sennin helps OT security leaders assess risk and govern the rest of the portfolio.
| SenninOne | A console that unifies Edge, Stellar and Element deployments, maps events to MITRE ATT&CK for ICS and requires role-based approval before any policy is deployed. |
|---|---|
| SenninRecon | An assessment appliance that discovers assets passively, scores vulnerabilities with VSAR and supports IEC 62443-3-3 gap analysis. |
How It Works
Products sit at different Purdue layers, from the Industrial DMZ at the IT/OT boundary down to basic control and the process itself.
| Component | What it does |
|---|---|
| Network layer | Edge devices install transparently inline, on hardware or virtual appliances, without IP address changes or network redesign. EdgeOne runs on premises or in a public cloud. |
| Endpoint layer | Stellar Protect installs and updates without a reboot, needs no internet connection and works in air-gapped sites, taking pattern updates by USB. StellarOne runs as a virtual appliance or in the cloud, with a recommended ceiling of 30,000 endpoints per instance. |
| Assessment and governance | SenninRecon needs no agents and listens on SPAN or mirror ports. SenninOne scales from a single node to multi-node clusters. |
Agentic AI Capabilities
The AI features sit in the EdgeOne console and the Edge line:
| MCP connector | A built-in connector lets external AI agents query EdgeOne in natural language. |
|---|---|
| AI alert engine | Groups related events and assembles them into attack chains, alongside network-based detection of OT vulnerabilities from asset traffic. |
| Closed-loop automation | AI automation takes on policy deployment, with a reported cut of more than 90 percent in the effort involved. |
Integrations
| Area | Integrations |
|---|---|
| SIEM | Splunk, Microsoft Sentinel, IBM QRadar, Syslog/CEF forwarding |
| Virtualisation | VMware ESXi, Microsoft Hyper-V, KVM, Nutanix |
Company Background
| Origin | Formed as a joint venture of Trend Micro and the industrial networking company Moxa, and led from the start by Dr Terence Liu. |
|---|---|
| Headquarters | Taipei, Taiwan, home to the global headquarters and R&D centre. |
| Other offices | Dallas (North American headquarters), Eindhoven, Singapore, Dubai and Tokyo. |
| Leadership | Terence Liu (Chief Executive Officer). |
| Recognition | Cybersecurity Breakthrough Awards (2023, 2024) and Global InfoSec Awards (2023, 2024, 2025). |
Note: This overview is compiled from TXOne Networks’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.