Full Prevention for Every OT Endpoint. Two Editions, One Product.

Stellar Protect delivers prevention-first security across Windows 2000 through Windows 11. ICS Edition for the full prevention suite; Kiosk Edition for the most constrained legacy endpoints.

Stellar Protect blocks threats before execution with automated per-device baselines, 40,000+ OT applications recognized automatically, application lockdown, USB device control, and Cyber-Physical Systems Detection and Response (CPSDR). Deploy ICS Edition wherever the endpoint can run the full agent; choose Kiosk Edition for single-purpose systems that need the lightest possible footprint.

Schedule an Endpoint Assessment Download Datasheet

Your OT endpoints need prevention, not just detection. Stellar Protect delivers both ICS and Kiosk editions on the same platform.

IT-adapted EDR tools crash legacy systems, generate false positives on legitimate OT processes, and demand resources constrained endpoints cannot provide. Stellar Protect was built for the reality of OT. The ICS Edition is the full prevention suite: automated per-device baselines, the 40,000+ OT application recognition repository, full CPSDR behavioral anomaly detection, application lockdown, USB device control, network access control, and script-based plus fileless attack prevention. The Kiosk Edition is the lite counterpart: the same agent footprint scaled down for single-purpose endpoints, HMIs, and the oldest legacy systems that cannot run the full ICS agent. Both editions are managed through StellarOne. Both run in air-gapped environments. Both cover Windows 2000 SP4 through Windows 11 (ICS adds Linux malware scanning). If you have already invested in IT endpoint security, Stellar Protect adds the OT coverage it cannot provide.

Prevention Built for the Reality of OT Endpoints

Your production depends on systems IT security has abandoned. Windows XP runs batch processes. Windows 7 controls packaging lines. Server 2008 manages SCADA communications. These systems generate revenue every day, and IT EDR tools either cannot install on them or destabilize them when they do. Stellar Protect was built from the ground up for this reality. The ICS Edition is the flagship: full CPSDR, 40,000+ OT applications, automated baselines, network access control, and every prevention capability in the Stellar platform. The Kiosk Edition is the lite counterpart for the endpoints that cannot run ICS: the same proven agent architecture, with multi-engine malware scanning, USB control, operation lockdown, and script-based attack prevention in the lightest footprint Stellar offers. Pick ICS wherever the endpoint supports it. Pick Kiosk for everything else. Both editions are managed by StellarOne, both operate air-gapped, and both extend asset life 7-10 years without forced replacement.

Prevention-First, Not Detection-First

Application lockdown plus baseline enforcement blocks threats before execution, including fileless.

Windows 2000 Through Windows 11

Legacy OS support committed through 2031 across both ICS and Kiosk editions.

OT-Native, Not IT-Adapted

40,000+ OT applications recognized (ICS); multi-engine malware scanning on both editions.

Full Air-Gap Operation

USB-based pattern updates on both editions for strict network isolation.

+

OT applications recognized

+

Years of Windows coverage

%

Less resource consumption

Mandatory reboots required

Challenges

OT Security Challenges

Critical challenges that Stellar Protect is purpose-built to solve

01 / 04

50.9% have endpoint protection in place; the other 49% run unprotected legacy Windows

IT Security Vendors Abandoned Your Legacy Windows Systems

Windows XP, Windows 7, and Server 2008 remain essential to production, yet IT security vendors dropped support years ago. Your most critical systems run without protection because the alternative is replacing millions in functional equipment.

50.9% have endpoint protection in place; the other 49% run unprotected legacy Windows

IT Security Vendors Abandoned Your Legacy Windows Systems

Windows XP, Windows 7, and Server 2008 remain essential to production, yet IT security vendors dropped support years ago. Your most critical systems run without protection because the alternative is replacing millions in functional equipment.

Key Features

Discover how Stellar Protect protects your OT environment

01 / 06

CPSDR Behavioral Anomaly Detection

Cyber-Physical Systems Detection and Response analyzes machine operating behavior rather than user behavior. ICS Edition includes full CPSDR that detects deviations from established OT operational baselines, blocking fileless and living-off-the-land techniques such as Volt Typhoon class attacks before execution. Kiosk Edition provides script-based detection subset.

Key Capabilities

Full CPSDR in ICS Edition; script-based subset in Kiosk

Detects fileless and living-off-the-land techniques

Blocks behavior outside approved operational baseline

OT-native, not IT user-behavior analytics

40,000+ OT Application Recognition (ICS Edition)

ICS Edition ships with the 40,000+ OT application recognition repository built through partnerships with leading industrial device manufacturers. Legitimate industrial operations are recognized automatically without manual allowlist creation. Engineering software, SCADA communications, and PLC programming tools are trusted by default.

Key Capabilities

40,000+ recognized OT applications and certificates

Partnership-validated manufacturer certificates

Eliminates weeks of manual allowlist maintenance

Zero false positives on critical OT processes

A

Automated Per-Device Baseline Generation (ICS Edition)

ICS Edition generates a unique operational baseline for every protected endpoint, capturing the authorized state of configurations, files, and processes. Any deviation triggers immediate prevention. Baseline-locked prevention blocks anything outside approved behavior, including novel attack techniques, because anything not on the baseline is denied by application lockdown.

Key Capabilities

Automated baseline capture per endpoint

Real-time change detection and prevention

Protection for configurations, files, and processes

Prevention before execution, not after detection

Application Lockdown and Operation Lockdown

Trusted application baseline blocks unauthorized execution. Operation lockdown prevents changes to critical system configurations. USB device control stops unauthorized peripherals at the port. 81.9% of USB suspicious activity in OT environments involves file transfers (Nozomi Networks 2025 1H OT/IoT Security Report), and application lockdown with USB control closes that vector.

Key Capabilities

Trusted application baseline enforcement

Operation lockdown for critical system changes

Granular USB device control policies

Prevents unauthorized execution, both ICS and Kiosk

Multi-Engine Malware Scanning

Signature, behavioral, and heuristic engines combine for layered detection. ICS and Kiosk editions both include multi-engine scanning. Combined with baseline enforcement and application lockdown, layered prevention efficacy blocks even novel fileless and living-off-the-land techniques before execution (TXOne product testing and deployment data).

Key Capabilities

Signature plus behavioral plus heuristic engines

ICS and Kiosk both include multi-engine scanning

Script-based and fileless attack prevention

Works alongside application lockdown for layered defense

F

Full Air-Gap Operation

Stellar Protect operates with full prevention capability in air-gapped networks. No mandatory internet connection, no cloud dependency. Pattern and signature updates distributed via USB through StellarOne. 41% of organizations report no detection coverage at remote sites (SANS 2025), and Stellar Protect closes that gap without forcing connectivity.

Key Capabilities

No mandatory internet or cloud connectivity

USB pattern and signature update support

Full prevention capability offline

Designed for isolated OT networks

CPSDR Behavioral Anomaly Detection

Cyber-Physical Systems Detection and Response analyzes machine operating behavior rather than user behavior. ICS Edition includes full CPSDR that detects deviations from established OT operational baselines, blocking fileless and living-off-the-land techniques such as Volt Typhoon class attacks before execution. Kiosk Edition provides script-based detection subset.

Key Capabilities

Full CPSDR in ICS Edition; script-based subset in Kiosk

Detects fileless and living-off-the-land techniques

Blocks behavior outside approved operational baseline

OT-native, not IT user-behavior analytics

Use Cases

Real-World Applications

See how organizations deploy Stellar Protect in production environments

01 / 05

Protect Legacy Windows Systems Still Running Production

Windows XP, Windows 7, and Server 2008 remain essential to production. IT security vendors dropped support years ago. 83% cite replacement cost as primary barrier (iVOX 2025, N=550). Stellar ICS extends secure operational life by 7-10 years without replacing functional equipment, avoiding $2-5M in replacement costs per system (TXOne customer deployment analysis).

Protect Legacy Windows Systems Still Running Production

Windows XP, Windows 7, and Server 2008 remain essential to production. IT security vendors dropped support years ago. 83% cite replacement cost as primary barrier (iVOX 2025, N=550). Stellar ICS extends secure operational life by 7-10 years without replacing functional equipment, avoiding $2-5M in replacement costs per system (TXOne customer deployment analysis).

Choose Your Edition

Full Prevention Suite

Stellar ICS Edition

The flagship edition. Everything Stellar Protect offers.

Best For

OT endpoints that can run the full agent
Critical ICS/SCADA systems, engineering workstations, and process control hosts
Windows 2000 SP4 through Windows 11 and Linux
Environments requiring full CPSDR behavioral anomaly detection

Contact Sales for ICS Edition

Lite for Constrained Endpoints

Stellar Kiosk Edition

The same agent, lighter footprint. For systems that cannot run the full ICS agent.

Best For

Single-purpose kiosk systems and HMIs
The oldest legacy endpoints with the tightest resource constraints
Windows 2000 SP4 through Windows 11 (no Linux)
Environments needing multi-engine malware scanning, USB control, and operation lockdown without the full ICS footprint

Contact Sales for Kiosk Edition

Technology

Technologies powering Stellar Protect

CPSDR: Cyber-Physical Systems Detection and Response

Machine-Behavior Analytics for OT

CPSDR analyzes how each OT machine actually operates, not how users interact with it. The agent establishes a behavioral baseline for every endpoint and blocks any deviation. Because anything outside the baseline is denied by application lockdown, CPSDR blocks even novel fileless and living-off-the-land techniques before execution. This is the ICS Edition capability. Kiosk provides a script-based detection subset only.

Per-endpoint operational baseline for machine behavior
Blocks fileless and living-off-the-land techniques
Detects Volt Typhoon class attacks before execution
Full CPSDR in ICS Edition; script-based subset in Kiosk

The only endpoint detection engine designed around OT machine behavior rather than IT user behavior.

Deploy Stellar Protect in 5 Steps

A streamlined implementation process designed for OT environments with zero disruption to operations.

01

Week 1: Endpoint inventory and edition selection (ICS where possible, Kiosk for constrained endpoints)

02

Week 2: Pilot deployment on non-critical endpoints; verify baseline generation and application recognition

03

Week 3-4: Expand deployment across production endpoints with operations-mode awareness configured

04

Month 2: Full production deployment; StellarOne policy standardization across sites

05

Ongoing: Air-gap pattern update workflow and SenninOne integration for enterprise risk prioritization

Operational & Protected

Technical Specifications

Windows 2000 SP4ICS and Kiosk

Windows XP SP1+ICS and Kiosk

Windows Vista through Windows 10ICS and Kiosk

Windows 11ICS and Kiosk

Seamless Integration with Stellar Protect

Designed to integrate into existing OT infrastructure without disrupting operations.

Managed through StellarOne alongside Stellar Discover sensors

Full air-gap operation with USB-based pattern updates

SIEM integration via Splunk, Microsoft Sentinel, and QRadar through StellarOne

Sennin handoff for cross-product unified governance

Zero-reboot installation and updates on legacy Windows systems

Customer Success

Chris Thompson
Director of Brewery OT Security at Carlsberg Group, Carlsberg Group

Giampaolo Tacchini
Group CISO & Quality Manager, Edison, Edison Group

Related Resources

Explore resources related to Stellar Protect

data sheet

Stellar datasheet

Stellar is a comprehensive OT/CPS security solution providing continuous detection and response aligned to the specific requirements of the OT domain. With successful deployments in a wide range of industries, including electric power, oil and gas, manufacturing, pharmaceutical, semiconductor, and retail, Stellar is proven to boost operations’ reliability, efficiency, and stability throughout the entire asset… Read more

Download

webinar

[On-Demand Webinar] Securing Legacy Systems in the Industrial Setting

This webinar has already been live. You can view it as on-demand by filling in the form. IIoT World Cybersecurity Day, Debbie Lay, Principal Sales Engineer at TXOne Networks, participated in an esteemed panel discussion. Many industrial environments are still dependent on legacy systems that weren’t designed with current security threats in mind. Debbie, TXOne’s… Read more

Annual OT/ICS Cybersecurity Report 2024

As the line between IT and OT continues to blur, new efficiencies are unlocked in tandem with new risks—namely, supply chain vulnerabilities, aging infrastructure, patching difficulties, and gaps in incident response. These challenges are the main focus of our Annual OT/ICS Cybersecurity Report, which is grounded in a large-scale survey conducted jointly by TXOne Networks… Read more

See All Resources

Browse all resources related to stellar protect

View All

Related Products

StellarOne

Unified management for Stellar Discover sensors and Stellar Protect agents across your entire endpoint estate.

Stellar Discover

User-space visibility sensor. One-minute install. No drivers. No kernel access. No reboot.

SenninOne

Unified governance for Edge, Stellar, and Element with VSAR risk scoring and approval workflows.

Ready to Protect Every OT Endpoint?

See Stellar Protect ICS and Kiosk editions in your environment with 95% less resource consumption than IT EDR and zero-reboot deployment on systems from Windows 2000 through Windows 11.

Schedule an Endpoint Assessment Download Datasheet