Sectors
Seven sectors where networks, plants and services stay in operation for decades. For each one: the risk, what changes with Crystallis, and where it applies.
What they have in common
Plants that last decades
Many devices installed today will still be online after 2030.
Data that must stay confidential
What travels today can be copied and opened later, with a quantum computer.
Local safety stays as it is
Every link leaving the plant has its own agent. Interlocks and local protections stay as they are and work on their own.
Infrastructure and transport
Railways, roads, ports and tunnels: assets spread across the territory that stay in service for decades.
The risk
A fake ground system can try to send commands to on-board equipment. Links copied today can be opened tomorrow. And on assets in service, work happens only in short windows.
With Crystallis
On-board and ground systems, field assets and control centres recognise each other before every link, which opens only for the permitted services. The agent sits next to existing systems, with no interruption to service.
Where it applies
- On board and on the ground On-board equipment talks to ground systems over protected links, each with its own identity.
- Assets across the network Substations, tunnels and trackside equipment talk to control centres only for the agreed services.
- Remote maintenance The external technician connects from a registered workstation, to the agreed system only, for the agreed time.
Energy
Grids and plants are run remotely every day, and they are not replaced all at once.
The risk
Measurements and commands travel every day between plants and control centres, many of them automatically. The service holds only if every command comes from someone entitled to give it.
With Crystallis
Every plant has its own identity, with separate permissions to read measurements and to send commands. Protection is added one link at a time, without replacing plants.
Where it applies
- Substations The link between a substation and the grid control centre opens only between two recognised agents. Each new substation joins with its own identity, approved by a second person.
- Valves and field assets Every remotely controlled valve has its own identity and permission. Every link stays in the signed log.
- Remote suppliers Every intervention starts from an expiring permission. When it expires, the link closes and the trace of what happened remains.
OT and robotics
In 2025 Italy installed about 7,800 industrial robots, the second largest market in the European Union (IFR). Lines, cells and robots are connected to production systems, to headquarters and to the vendors who service them remotely.
The risk
With IT/OT convergence, attacks that start on the office network reach the factory floor. According to Italy’s ACN, in 2025 ransomware in Italy hit mostly small manufacturers. Attackers often got in with stolen credentials and through poorly protected remote access. From 20 January 2027 the EU Machinery Regulation asks machine makers to protect safety software and data from tampering as well.
With Crystallis
Agents run on the line PC or gateway next to the controllers, without touching machines and robots, which stay in service for years. Every link opens only between recognised devices and for the permitted service, and vendor access has an expiring permission.
Where it applies
- Vendor remote maintenance The vendor’s service centre reaches only the controller of its own machine, for the agreed service. Every session leaves a signed trace.
- Cells and lines to MES and SCADA The cell PC and the MES or SCADA server recognise each other. Only the permitted flows pass: orders, recipes, production data.
- Mobile robot fleets Each mobile robot holds its identity on its on-board computer and talks to the fleet manager over a channel both ends recognise. A robot taken out of service is excluded centrally.
Aerospace
Between 2021 and 2024 Italy’s space supply chain grew from €1.9 billion to €3.1 billion in turnover (MIMIT). Ground stations, control centres, labs and suppliers exchange data that stays sensitive for years.
The risk
According to ENISA, many attacks on satellites start on the ground: from an employee’s mailbox to mission control software, up to the station that sends the commands. In 2022 an attack on a satellite network knocked out tens of thousands of modems across Europe. The European standard ECSS-E-ST-80C calls for cryptographic authentication and integrity on every link, including those on the ground.
With Crystallis
Agents protect the ground links between stations, mission control, labs and suppliers, with quantum-safe hybrid encryption. Every site has its own identity and a permission for each service.
Where it applies
- From ground station to mission control The ground leg carrying telemetry and commands opens only between the two recognised sites, with keys derived from X25519 and ML-KEM-768.
- Test benches and labs Results move from the test bench to the engineering office for that service only. Every event leaves a signed trace that helps reconstruct a test campaign.
- Design data with suppliers Each supplier reaches only its permitted service, such as drawings or production data. When the contract ends, its device is excluded by a two-person decision.
Telecommunications
Networks carry the services of every other sector.
The risk
Traffic crossing the networks today can be copied and stored, to be opened once a quantum computer can do it.
With Crystallis
Links between sites and management links to network equipment travel encrypted between two agents, with a permission for each service.
Where it applies
- Between sites and data centres Replication and exchanges between sites pass through a protected channel between two agents, with no change to applications.
- Equipment management Network equipment accepts management connections only from recognised systems and for the permitted services.
- Supplier access The external technician reaches only the agreed device, for the agreed time. A trace of what happened remains.
Finance
Payments, transactions and documents must stay confidential and intact for years.
The risk
Transactions and documents exchanged today must stay confidential for years: whoever copies the links now can open them on Q-Day. DORA already requires encryption rules for data in transit and key management.
With Crystallis
Links open only between recognised devices and for the permitted services. The signed log shows who connected to what and when, for audits and supervisors.
Where it applies
- Large stores The link between the store server and the authorisation centre travels protected between two agents.
- Branches Branches connect to central systems only after mutual recognition.
- ICT third parties Every external access has an expiring permission, to a single system. Excluding a supplier takes two people.
Public administration
Citizens’ data and communications between public bodies must stay confidential for many years.
The risk
Health and registry data stay confidential for decades: whoever copies the links today can open them later.
With Crystallis
Offices, data centres and services connect over protected channels between agents, with a permission for each service and a signed access log.
Where it applies
- Public offices and data centres Each office connects to central services with its own identity and only for the agreed services.
- Local healthcare Clinics and healthcare facilities send data to central services over protected links.
- Cameras, gates and sensors Data reaches the control rooms protected from the collection points, each with its own identity. A lost or replaced point is excluded by a two-signature decision.
Contact us
A few lines on your context are enough: we will get back to you for a first meeting.
Thank you.
We have received your request.
We will get back to you to arrange a first meeting.
The form uses JavaScript. You can write to us directly at info@crystallis.eu