
How to choose a brownfield IIoT platform for many sites: 10 criteria to check before you buy
A brownfield IIoT platform connects the equipment your sites already have installed, from different brands and eras, instead of waiting to replace it. Choosing one well takes more than reading the protocol list: what matters is what happens when the Internet drops, how sites with different equipment are compared, who maintains the connectors, whether the platform can act and how it is priced. This guide sums up ten criteria for evaluating any vendor, a five-step evaluation process, when you don't need a platform like this and how GSS Analytix answers each point.
Ten criteria for evaluating a brownfield IIoT platform
- It connects to the equipment you already have over the open protocols it already speaks (BACnet, Modbus, OPC UA, SNMP, MQTT, HTTP/REST), without changing firmware, controllers or programming
- It reads equipment from different manufacturers and eras on the same gateway, and has a way in for equipment that was never instrumented
- It doesn't lose readings when the Internet drops at a site: the gateway stores them and resends them on reconnect
- It maps the data to a common model, so the same type of equipment can be compared across sites even when the brands differ
- It correlates signals across systems, such as energy, HVAC, backup power and security, instead of showing each device on its own
- It detects anomalies and alerts through the channels your team already uses, with reports by role and audit-ready traceability
- It can act on equipment that supports it, logging every action, and it can also run read only when the risk justifies it
- It scales to many sites: gateways provisioned without a site visit and signed firmware rolled out in stages or fleet-wide
- The data stays yours and is available to your own dashboards, reports and systems through APIs
- It is sized with a clear unit and spells out what the upfront fee covers and what the monthly fee covers
Ask the vendor to answer each criterion with an example in production, not a feature list. If an answer depends on custom development at every site, count it as integration cost.
How to evaluate one in five steps
- 1Inventory. List, site by site, which equipment you have, its brand and era, and which port or protocol each device exposes; equipment with no data output counts too.
- 2Prioritize. Decide which decisions you want the data to drive, such as failures, energy, backup power or compliance, and which equipment feeds them; that sets the scope, not the full asset list.
- 3Size. Count the data sources you will connect. At GSS Analytix each piece of equipment or data source connected to the gateway is a primary connection, the unit used to size and price the project.
- 4Pilot. Start with a limited-scope pilot at a representative site and measure whether the platform catches in time what your team finds out late or on site today.
- 5Scale. Before rolling out to every site, check how gateways are provisioned, how their firmware is updated and who maintains the connectors when a piece of equipment changes.
Gateway, platform or both: what you are buying
A generic gateway translates data from one protocol to another. It works for one site or a pilot, but mapping every device, the local queue, the common model, dashboards, alerts and fleet management are left to your team.
A complete brownfield platform includes on-site capture and cloud intelligence. At GSS Analytix they are two products built and operated by the same company: Phantom Shield, the edge gateway, physical or virtual, and Reveal, the platform that normalizes, analyzes, correlates and acts on that data.
How GSS Analytix answers these criteria
Phantom Shield speaks BACnet, Modbus, OPC UA, SNMP, MQTT and HTTP/REST in one device and stores and forwards readings with a configurable buffer. It uses zero-touch provisioning, receives signed firmware in stages or fleet-wide and, in sensitive contexts such as CCTV, is deployed read only by choice.
Reveal maps every signal to a common semantic layer (Brick), detects anomalies, analyzes root cause, correlates systems and sites, alerts by WhatsApp, email or ticketing and delivers reports by role with full traceability. The data is owned by the customer, and every project is priced by primary connection, with a one-time fee for equipment, installation and onboarding plus a monthly service fee.
Equipment that was never instrumented
For many older devices, the gateway is their first digital touchpoint. Where a direct connection is not possible or cost-effective, the cameras already installed can read meters, levels and indicators, and where wiring is hard, Modbus-to-LoRaWAN converters carry the readings wirelessly.
When you don't need one
- You have a single site or a pilot with few devices and one or two protocols, and your team already has a data platform and people to maintain connectors, dashboards and alerts
- You only need to move data into a system that already exists: a generic gateway can be enough for that
- You are looking for plant process control, such as control loops, sequences or operator screens: your SCADA, BMS and PLCs keep doing that
- You are replacing all your equipment with new devices that come connected: then your problem is not brownfield
If you run dozens of sites with equipment from different brands and eras, and today you find out about failures late or on site, that is where a brownfield platform saves a per-site integration project.
Where this model already runs
Telecom operator, 460 sites
Cabinets, batteries and access control at 460 base stations sit on one platform, with 85% fewer vandalism events and real savings of USD 2.3 million.
Manufacturing, three plants
More than 200 cameras, 24 recorders and 34 power meters across three plants sit on one platform through a virtual gateway, with no additional hardware on site.
Restaurant chain
The chain saves about USD 350 a month per site on energy by automating hoods, controlling bain-maries and seeing the power use of every location.
Related pages
- Data acquisition from existing equipment
- Phantom Shield: the gateway
- Phantom Shield vs. a generic IoT gateway
- Reveal platform
- Monitoring on top of the BMS you already have
- A SCADA alternative for multisite monitoring
- One dashboard for every site
- AI agents for physical infrastructure
- Generator, UPS and battery monitoring
- GSS Analytix FAQ
FAQ: how to choose a brownfield IIoT platform
What should a brownfield IIoT platform have to run many sites?
A connection to existing equipment over open protocols without firmware changes, store and forward when the Internet drops, a common data model to compare sites, alerts and reports by role, provisioning without a site visit, signed firmware and a clear way to size and price the project.
What is the difference between buying a gateway and buying a brownfield platform?
A generic gateway translates protocols; the rest (device mapping, local queue, common model, dashboards, alerts and fleet management) is built and maintained by your team. With Phantom Shield and Reveal those pieces come integrated and GSS Analytix operates them.
How do you compare sites that have equipment from different brands?
Reveal maps every signal to a common semantic layer (Brick). That way a chiller, a generator or a meter at one site is compared with those at another, even when each site's equipment or BMS is a different brand.
Which cybersecurity questions should you ask a brownfield vendor?
Whether gateway firmware is signed and how it is updated, whether it can run read only, whether every action on a device is logged and who owns the data. Phantom Shield uses signed firmware, is deployed read only by choice in sensitive contexts, and Reveal logs every action.
How do you test a brownfield platform before rolling it out to every site?
With a limited-scope pilot at a representative site, on the equipment that feeds the decisions that matter most to you. After that, gateways at the other sites are provisioned without on-site intervention and firmware is rolled out in stages or fleet-wide.
Who owns the data the platform collects?
You do. The data Reveal collects from your equipment is owned by the customer and processed only to provide the contracted service.
How is a brownfield platform from GSS Analytix priced?
By primary connection: each piece of equipment or data source connected to the gateway counts as one. The proposal includes a one-time fee for equipment, installation and onboarding, plus a monthly service fee. Tell us how many sites and how much equipment you have and we will prepare a proposal.
Are you evaluating a platform for your sites?
Tell us how many sites you have and what equipment runs at each one, and we will show you in a demo how Phantom Shield and Reveal answer each of these criteria with the equipment you already have.