Secure legacy field equipment · NeoCore Edge Runtime

Keep your equipment. Secure the connection.

Many RTUs and controllers still send DNP3 or Modbus traffic without encryption. NeoCore sits in front of them, in the same panel, and carries their data over TLS-secured DNP3 and IEC 104 based on IEC 62351, without replacing the devices you already rely on.

Book a free assessment NeoCore specifications

Why are legacy RTU links a risk?

DNP3, Modbus and IEC 60870-5-104 were designed for closed networks. None of them encrypts traffic or checks who sent a command. On a shared or routed network, anyone with access to the path can read measurements, and a forged or altered command can look legitimate to the device that receives it.

The IEC 62351 series addresses this. IEC 62351-5 adds authentication of critical messages, and TLS encrypts the connection itself. Many RTUs and controllers in service today support neither, and their manufacturers offer no upgrade path.

The usual answer is to replace the RTUs and PLCs. That means new hardware, rewiring, re-commissioning every point, and an outage window that a small municipality or plant often cannot find in its budget or its calendar.

Keep the equipment you have. Add a secure layer in front of it.

How does NeoCore secure an existing device?

Schematic. Top: today, an existing RTU or controller sends DNP3 or Modbus in clear text across the network. Bottom: NeoCore sits in the same panel, takes the local connection, and carries the data over TLS-secured DNP3 or IEC 104 based on IEC 62351. The field device and its wiring stay as they are.

Same panel, same wiring

NeoCore runs on a small industrial controller next to the RTU and takes over its network connection locally.

Encrypted and authenticated

Towards the control system, NeoCore speaks DNP3 or IEC 104 over TLS, with IEC 62351-5 secure authentication.

The device stays in service

The RTU keeps its I/O, its logic and its field wiring. Nothing inside it is changed.

Replace everything, or add a secure layer?

Two ways to secure a legacy field link. Comparison by approach, not by brand.
	Replace the RTUs and PLCs	Add NeoCore in front
Field devices	Removed and replaced	Kept in service, unchanged
Field wiring and I/O	Rewired to the new device	Unchanged
Points and logic	Rebuilt and re-commissioned	Mapped once in NeoStudio; device logic unchanged
Outage	Each device is out of service during cut-over	Planned around a short network cut-over
Security	Depends on the new device	TLS and IEC 62351-5 on the DNP3 or IEC 104 link

Outage and effort depend on each site. NeoTechX states the scope for your site after a survey; this table describes the approaches, not a quote.

How does a retrofit project run?

Survey
We list your devices, protocols, points and the control system at the other end, and check what it accepts.
Plan
We agree the point mapping, security settings and cut-over plan with your team or your integrator.
Install
A licensed electrical contractor installs the NeoCore controller. NeoCore is configured with NeoStudio.
Commission
The secured link is brought up and checked frame by frame with the IEC 104 Test Tool or the master's own logs.

What does NeoCore connect to?

NeoCore connections for legacy retrofit
Side	Protocols	Security
Field side (your existing devices)	Modbus RTU and TCP; DNP3 serial and TCP; IEC 60870-5-101 and -104; BACnet/IP and BACnet MS/TP; OPC UA; Siemens S7; Beckhoff ADS; IEC 62056-21 meters	Local connection inside the panel
Control-system side	DNP3 and IEC 60870-5-104, as outstation or master	TLS and IEC 62351-5 secure authentication Available
IT side, optional	MQTT, OPC UA, SQL	TLS

Full NeoCore specifications · IEC 62351 explained

While NeoCore is there: alarms after hours

Small teams cannot watch a screen all night. The same NeoCore that secures the link can watch the site.

Alarm notification

NeoCore logic can email up to 100 recipients per driver instance when a condition you define occurs, with delivery diagnostics.

Works with your monitoring

The same data can go to the SCADA, HMI or monitoring software you already run, or to NeoPilot.

Local logic keeps running

Alarms, interlocks and scaling run on site and keep running if the upstream link is lost.

Who is this for?

Small and mid-sized municipalities: water, wastewater and pump stations
Small industry and independent manufacturers with remote sites
Integrators maintaining RTUs that their manufacturer no longer updates
Anyone asked by a security review to encrypt and authenticate field links

What is available, and what is in development

Available TLS and IEC 62351-5 secure authentication for DNP3 and IEC 104

Available Protocol conversion from Modbus, DNP3, BACnet and others

In development Outbound-only connectivity, hardware-backed keys and signed updates

Frequently asked questions

Can I add encryption to an old RTU without replacing it?

Yes. NeoCore Edge Runtime is designed to sit in front of an existing RTU or controller, in the same panel. The RTU keeps its local connection to NeoCore, and NeoCore carries the data to the control system over TLS-secured DNP3 or IEC 60870-5-104 with IEC 62351-5 authentication.

Why is unencrypted DNP3 or Modbus a risk?

DNP3, Modbus and IEC 60870-5-104 were designed without built-in encryption or authentication. Anyone with access to the network path can read the traffic, and a forged or altered command can look legitimate to the device. IEC 62351-5 adds authentication of critical messages, and TLS encrypts the connection.

Which protocols does NeoCore accept from legacy devices?

NeoCore reads legacy devices over Modbus RTU and TCP, DNP3 (serial and TCP), IEC 60870-5-101 and -104, BACnet/IP and BACnet MS/TP, OPC UA, Siemens S7 and Beckhoff ADS, among others. Towards the control system it serves DNP3 and IEC 60870-5-104 secured with TLS and IEC 62351-5.

Does my SCADA master need to change?

The control system at the other end must accept TLS and, where used, IEC 62351-5 secure authentication on its DNP3 or IEC 104 connection. NeoTechX checks this during the site survey and discusses the options before any work is agreed.

Who installs NeoCore?

A licensed electrical contractor installs the controller that runs NeoCore, in the existing panel or an adjacent enclosure. NeoTechX does no electrical work itself. NeoCore is configured with NeoStudio, by NeoTechX or an installation partner.

Is this certified?

NeoCore implements IEC 62351-5 secure authentication and TLS for IEC 60870-5-104 and DNP3. NeoTechX does not claim third-party certification. The IEC 104 device profile and IEC 62351-5 PICS are available on request for interoperability review.

Tell us what is in your panels.

We survey your devices and the control system they report to, and tell you what securing them would take. No obligation.