The Industrial Internet of Things (IIoT) is the practice of connecting industrial equipment, machines, sensors, PLCs, meters, to networks and software so their data can be collected, analyzed, and acted on. Strip the buzzwords and IIoT is plumbing: getting signals off the floor and into systems that do something useful with them.
That plumbing enables everything the brochures promise, machine monitoring true OEE, predictive maintenance, digital twins but the plumbing itself is unglamorous: protocols, gateways, network segments, and data models. This post walks the stack from sensor to insight, the retrofit-versus-greenfield decision honestly, and the security basics no plant gets to skip.
How is IIoT different from regular IoT?
Same idea, different stakes. Consumer IoT connects thermostats and doorbells; IIoT connects equipment where failure costs real money or injures people. That drives the differences: industrial protocols instead of consumer ones, wired reliability where wireless is not good enough, decade-long equipment lifecycles instead of two-year gadget cycles, and security requirements shaped by the fact that a compromised device might control a 400-ton press. IIoT also has to coexist with an installed base of controls, PLCs and SCADA systems that predate the internet and were never designed to share.
What does the IIoT stack look like?
Five layers. Every IIoT product you will ever evaluate lives in one or more of them.
Sensing is wherever data originates: tags inside existing PLCs, add-on sensors (vibration, temperature, current draw, photo eyes), cameras, and, often forgotten, operators entering what sensors cannot see. Edge devices sit next to the machines, translating the floor's many protocols into something a platform can consume, filtering noise, and buffering data when the network hiccups. Network moves it, plant ethernet, Wi-Fi, or cellular, properly segmented from the office network. The platform stores and historizes the data and, critically, adds context: which machine, which order, which product, which shift. A vibration reading without context is trivia; the same reading tied to press 4 running order 1182 on nights is evidence. Applications are why you did all this: dashboards, alerts, analytics, and automation that acts on the data.
A word on protocols
The floor speaks many languages, and the edge layer exists to translate them. Older equipment talks serial or fieldbus protocols like Modbus, a design from the late 1970s that still moves an enormous share of industrial data. Newer controllers expose OPC UA, the vendor-neutral standard for secure industrial data exchange, while lightweight publish-subscribe protocols like MQTT have become the default for moving tag data from edge gateways to platforms because they tolerate flaky networks and scale cheaply. You do not need to memorize the alphabet soup; you need two rules. First, prefer open protocols over proprietary ones at every purchase decision, locked-in data is the most expensive kind. Second, push protocol translation to the edge, so the platform sees one clean, consistent stream regardless of what forty different machines speak below.
What actually happens between a sensor and an insight?
It helps to follow one reading through the pipe.
Notice where the value concentrates: not in the sensor (commodity), not in transport (commodity), but in context and action. A plant that stops at "data lands in a database" has bought expensive storage. The last hop, pattern detected, action drafted, human approves, is where the payback lives, and it is the hop most projects never reach because the data was never contextualized well enough to trust.
Retrofit or greenfield: what is honest?
Greenfield, new machines with modern controllers, native connectivity, clean networks, is easy and rare. The average U.S. plant runs equipment spanning four decades, and the honest answer is that most IIoT is retrofit machine by machine, and that this is fine. Retrofitting has a bad reputation only because people attempt it as a monolith. Taken per-machine, it is a sequence of small, cheap decisions:
Three honest notes on retrofit. First, tapping an existing PLC is usually read-only and non-invasive an edge gateway subscribes to tags without touching control logic, so production risk is minimal when done properly. Second, clamp-on sensors see less than native integration current draw tells you run/stop and load, not why the machine stopped; accept the fidelity trade knowingly. Third, operator entry is a legitimate sensing layer, not an embarrassment downtime reasons, changeover notes, and quality observations are data no sensor produces, and a tablet at the station captures them at the source. A capture strategy that combines all three beats a purist strategy that connects six machines beautifully and ignores the other forty. This is the “no rip-and-replace” path: start from the equipment and systems you already own (how Harmony connects machines and systems).
What are the security basics?
Connecting the floor expands the attack surface, and industrial security has its own discipline. The reference frame is the Purdue model the layered architecture developed by Theodore Williams and the Purdue consortium in the early 1990s that separates plant systems into levels, from physical process (level 0) through controls (levels 1–2) and operations systems (level 3) up to enterprise IT (level 4) (Purdue Enterprise Reference Architecture). The model predates modern IIoT, and data flows now legitimately cross its layers, but its core security lesson stands: segment the network so control systems are never directly exposed to the office network or the internet. The current standards family for industrial cybersecurity, ISA/IEC 62443 builds its zones-and-conduits architecture on exactly this foundation.
The practical baseline for a mid-market plant:
- Segment networks. Controls traffic and office traffic live on separate segments; anything crossing goes through a firewall you configured on purpose.
- Prefer read-only, outbound connections. Data flowing out of the control layer is far lower risk than write access flowing in. Most monitoring needs only reads.
- Inventory what is connected. You cannot secure devices you do not know about. Keep a live list of every gateway, sensor, and connected controller.
- Change default credentials and update firmware. Unpatched gateways with factory passwords are the most common real-world hole.
- Control remote access. Vendor VPNs and remote-support tools are frequent entry points; grant per-session, log everything, and expire access.
- Align with ISA/IEC 62443 as you scale. You do not need certification to borrow its zones, conduits, and security-level thinking.
What do the standards and numbers say?
- The Purdue model (early 1990s, Purdue University consortium under Theodore Williams) remains the shared vocabulary for plant network layers, and ISA-95 / IEC 62264 the enterprise-control integration standard, uses its level numbering (ISA-95).
- ISA/IEC 62443 is the internationally recognized standards series for industrial automation and control system security (ISA).
- The workforce math favors augmentation: with BLS JOLTS showing roughly 400,000–550,000 open manufacturing jobs in a typical month across 2025–2026 (BLS), plants cannot hire their way to visibility, connecting the equipment they already own is the scalable path.
How should a mid-market plant actually start?
Start with a question, not a technology. Pick one decision you cannot currently make with data, "which machine causes the most downtime?", "did line 2 hit rate last night?", "why is scrap up on the third shift?", and connect only what answers it. That usually means one line, a handful of machines, a mix of PLC taps and simple sensors, plus tablets for what machines cannot say. Get the data into one model, put a screen on the floor, and let the answer create demand for the next question. Plants that scale IIoT this way build trust with every step; plants that start with a 200-sensor deployment build a dashboard nobody opens. When CLS started, the first move was not sensors everywhere, it was replacing paper production logging with real-time capture, then building automated reporting on top (the CLS case study). The stack grew from a question the plant needed answered. Yours should too. For the broader technology map this fits into, see smart factory technology.