Xage Fabric Platform & XPAM (Zero Trust for OT)

Xage Security is a zero trust identity and access company headquartered in Palo Alto, California, that has raised 80 million USD from investors including Chevron, Aramco Ventures, GE and SAIC. It secures access to operational technology, IT, cloud and AI agents for energy, utilities, manufacturing, defence and government operators, where legacy PLCs, RTUs and HMIs cannot run security agents.

The Xage Fabric Platform is a distributed mesh of nodes with no central vault, so policy and credentials keep being enforced at sites that go offline or are air-gapped. Its Extended Privileged Access Management (XPAM) discovers privileged accounts, rotates passwords, grants just-in-time agentless access and records sessions. Other modules provide identity-based microsegmentation to isolate critical assets, secure remote access that replaces VPNs, zero trust data exchange across OT and cloud, and identities and runtime policy for AI agents.

• Privileged account management: Discovers accounts, rotates passwords and handles check-in and check-out.
• Just-in-time access: Grants agentless remote and local access with MFA and session recording.
• Asset protection: Uses identity-based microsegmentation to isolate legacy and critical systems.
• Secure remote access: Opens policy-limited tunnels to specific OT assets instead of broad VPNs.
• Offline enforcement: Keeps policies working at disconnected or air-gapped sites.
• Zero trust for AI: Gives AI agents distinct identities with runtime policy enforcement.

An oil and gas operator in Vietnam can give vendors just-in-time, recorded access to offshore control systems without VPNs. A power company can isolate legacy substation RTUs with identity-based microsegmentation. A factory can rotate shared PLC and HMI passwords and keep access control working when sites lose connectivity.

Operators can protect legacy OT assets without agents or network redesign. The distributed design removes the single central vault that attackers target and keeps enforcing policy during connectivity loss. The site states deployment in as little as one day, with two core components compared with five or more for some legacy PAM tools. Licensing is per user with unlimited assets in a single tier.

Remote vendor access and stolen credentials are among the main entry points for attacks on industrial sites, and regulations such as NERC CIP, IEC 62443 and NIS2 now require strong access control. Energy companies in Southeast Asia, including national oil and gas groups, are digitising remote sites and need zero trust access that works over unreliable links.

Headquartered at 445 Sherman Avenue, Palo Alto. Raised 80 million USD from Piva, March Capital, SCF Partners, SAIC, Chevron, Aramco Ventures, GE and others. Certified to ISO 27001:2022, IEC 62443-4-1, IEC 62443-4-2 and FIPS 140-3. XPAM won several 2026 PAM awards; Petronas and Saudi Aramco appear among customers.