Scaling Internet of Things (IoT) systems in large corporations often presents significant architectural challenges. While pilot projects successfully collect data from a few dozen devices, attempting to deploy a system across thousands of units without proper design turns the infrastructure into an unmanageable dump of raw data. Such "data lakes" are not integrated into business processes and create critical vulnerabilities at the boundary between operational (OT) and information (IT) technologies.
The 2026 update to the AWS Well-Architected IoT Lens defines a standardized framework for transitioning from experimental IoT pilots to scalable and secure enterprise ecosystems. The primary focus has shifted from simple telemetry accumulation to creating managed environments that combine operational technologies with business process management (BPM).
AWS Well-Architected IoT Lens: Balancing Edge and Cloud
One of the key mistakes in building IoT architectures is attempting to send all collected telemetry directly to the cloud. According to the AWS IoT Lens, it is necessary to make balanced decisions regarding which data should be processed at the edge and which should be transmitted to the cloud, taking into account latency and cost requirements.
Edge computing must provide initial filtering and real-time event processing. The cloud, conversely, is used for long-term storage of aggregated data and machine learning model training. Transitioning from a pilot project to industrial operation means scaling from dozens to thousands of devices, which requires automated provisioning and centralized monitoring.
The "dead lake" problem: Why raw data creates no value
When an enterprise collects massive amounts of telemetry without a clear connection to business logic, it faces excessive costs for network traffic and data storage. Instead of transmitting millions of routine heartbeat signals, it is much more effective to apply edge filtering, sending only data about anomalous events to the cloud.
True business value emerges when an indicator deviation triggers a specific action. If a sensor on the production floor detects a critical temperature spike, this information should not simply settle in log files. The optimal scenario involves the automatic creation of a service request in the corporate BPM system, allowing for an immediate response to the incident.
IT/OT convergence: Securing the industrial perimeter
Integrating operational technologies (IACS, controllers, sensors) with corporate IT systems carries specific risks. Industrial environments often contain legacy equipment that cannot be easily protected with software updates. This requires the implementation of compensating control measures.
According to NIST SP 800-82 (Guide to OT Security), strict IT/OT network segmentation is a fundamental control for the cybersecurity of industrial systems. The ISA/IEC 62443 series of standards, which cover cybersecurity requirements for industrial automation across more than 20 industries, also emphasizes that protection is not a one-time action, but a continuous risk management process. The architecture must ensure strict role-based access control (RBAC) so that only authorized specialists can modify OT gateway configurations.
Architectural pattern: Normalization via OPC UA and BPM integration
To build a scalable data transmission system, a three-tier architectural approach is applied:
- Collection and normalization layer (Edge): Data from sensors is collected by edge gateways (e.g., using the AZIOT Platform for industrial IoT). Routine events are filtered out here. For secure and reliable interaction between machine data and corporate systems, the OPC UA architecture is used—a platform-independent standard that ensures data normalization.
- Integration layer: Normalized events from gateways are transmitted to an intermediate level. Here, UnityBase can serve as the integration platform (a joint development of the Intecracy Group alliance, where InBase is a key, but not the only, developer). UnityBase is not a replacement for physical OT perimeter security, but it provides a reliable software layer: it validates events, controls access (RBAC), maintains a detailed audit trail, and initiates calls to business systems.
- Business process layer (BPM): Based on processed events, processes are launched in corporate solutions such as Megapolis.DocNet or Scriptum document and process management systems. In cases requiring deep customization, Softengi can handle the integration of embedded/IoT systems.
Practical case: From critical signal to automatic request
Consider the example of a manufacturing enterprise. A sensor on equipment detects a critical temperature spike. The processing of this event occurs as follows:
- The edge gateway analyzes the data stream locally, discarding standard heartbeat signals to save traffic, and identifies the temperature anomaly.
- The gateway forms an event according to the OPC UA standard and transmits it through a secure channel to the integration layer.
- The UnityBase platform records the receipt of the event in the audit trail, verifies the device's access rights using RBAC mechanisms, and calls the API of the corresponding business system.
- The corporate BPM system automatically generates a maintenance work order, assigns a responsible engineer, and notifies the repair team.
| Architecture layer | Key functions |
|---|---|
| Edge processing | Initial filtering, discarding routine heartbeat signals, data normalization (OPC UA), transmission of anomalies. |
| Integration layer | Event validation, role-based access control (RBAC), action logging (Audit Trail), initiation of BPM processes. |
| Cloud analytics | Long-term storage of aggregated telemetry, predictive analytics, global reporting. |
This architectural pattern allows enterprises to scale their IoT networks while avoiding unmanageable data arrays, maintaining control over IT/OT security, and turning sensor readings into automated management decisions.
FAQ
How does the AWS Well-Architected IoT Lens recommend balancing data processing between Edge and Cloud?
The framework advises balancing processing based on latency and cost requirements: the edge is used for latency-sensitive tasks and event filtering, while the cloud is used for long-term storage and advanced analytics.
How can the security of the IT/OT perimeter be ensured when transmitting data from industrial sensors?
According to NIST SP 800-82, a fundamental measure is strict segmentation of IT and OT networks. For legacy equipment, compensating control measures are applied according to ISA/IEC 62443 standards, as well as role-based access control (RBAC).
What role does the UnityBase platform play in integrating IoT with BPM systems?
UnityBase acts as a software integration layer: it receives normalized events from edge gateways, ensures access control, maintains a detailed audit trail, and translates events into calls to trigger business processes.