Killing the Sneakernet: From USB Drives to Automated M2M File Transfer Across Industrial Fleets

Key takeaway: Patches, configuration backups, and log files still move by USB drive across a lot of industrial fleets, a workaround with no log of who touched a file, no record of who deleted it, and a physical point of failure at every handoff. Automated machine-to-machine file transfer eliminates that gap without new infrastructure: it runs over the same Zero Trust connectivity already brokering remote sessions, so every transfer inherits the same vaulted credentials, administrator approval, and audit trail your team already trusts. 

The USB drive is still your patch distribution strategy. That's a bigger problem than it sounds, and it's an easier fix than you'd think. 

I was on a call not long ago with the operations team at a heavy-equipment manufacturer, walking through what our Industrial Data Streaming capability could do for them. Partway through, one of their engineers stopped me to describe a use case he’d just learned about, one he hadn’t even run by his own colleagues yet. 

His company builds large industrial equipment in batches, and every unit that rolls off the line carries its own configuration data, the settings and calibration record for that specific machine. That configuration gets backed up at each stage of production. Here’s how: a vendor’s engineer shows up with a laptop, plugs in a USB stick, and pulls the entire configuration off the equipment. From there it gets copied onto a laptop, and eventually into an IT file share that, in his words, was known only to the people who put it there and protected by no one. Anyone with access to that share could delete a file that’s supposed to be an immutable production record, and nobody would necessarily know until it was needed and gone. 

He wasn’t describing a hypothetical. He was describing what his team does today, for records they explicitly told me need to be permanent. 

The Sneakernet Never Actually Went Away 

We gave this pattern a name years ago, the “sneakernet,” moving data by physically carrying it from one machine to another, because there wasn’t a trusted network path to send it electronically. It sounds like a relic. It isn’t. Across manufacturing, energy, and process industries, it’s still exactly how a lot of patches, configuration backups, and log files move between distributed sites, because standing up a secure electronic path between two locations has historically meant more infrastructure, more firewall exceptions, and more risk than just handing someone a USB stick. 

The problem is what that convenience costs. A USB transfer has no log of who touched the file or when. A file share with open permissions has no record of who deleted, replaced, or copied the file that just landed in it. And every one of those handoffs is a physical opportunity for something to go wrong: a lost drive, a laptop that never gets wiped, a file that quietly diverges from the version everyone assumes is authoritative. None of that is a hypothetical security gap. It’s the default in a lot of industrial environments today. 

What Automated Machine-to-Machine Transfer Looks Like 

The fix isn’t complicated, and it doesn’t require new infrastructure. If your sites already have modern OT secure remote access in place, like the Dispel Zero Trust Engine, the same connectivity layer that brokers a vendor’s remote session can move a file between two machines with the same governance. Plenty of OT remote access tools claim this; fewer actually deliver it without bolting on a separate file-transfer product. That’s the whole idea behind machine-to-machine, or M2M, data streaming: instead of a person carrying a file by hand, the file moves itself, automatically, between a defined source and a defined destination, over the same Zero Trust path a remote session would use. 

Here’s what that looks like end to end, based on how we build it for customers running exactly this kind of fleet: 

• A source and a destination, defined once. Each device gets a file share, read, write, or read-only, with credentials vaulted rather than handed to whoever’s doing the transfer. Once that’s set up, the workflow for the end user is just: put the new file where it belongs. The transfer happens on its own from there. 

• An administrator has to accept the transfer. The receiving side isn’t a wide-open drop box. Someone with authority over the destination approves it, which means every transfer has a person accountable for it, not just a folder anyone can write to. 

• Every transfer is logged, end to end. Full visibility into every file as it moves, so you can verify integrity and produce an audit trail on demand instead of reconstructing one from memory when someone asks where a backup came from. 

• It’s built for the files that actually break native transfer tools. Large datasets, full OS images, ISO files, all supported, with retry-resistant transfer that picks up where it left off instead of starting over if a connection drops. And for data that changes incrementally rather than all at once, streaming just the differential instead of the full file again cuts the bandwidth a transfer needs substantially. 

Go back to the story that opened this piece. Put a Dispel Zero Trust Engine in front of that equipment instead of a USB stick, and the configuration backup streams automatically to a controlled destination the moment it’s created, no laptop in the loop, no unprotected file share, no single point of failure sitting on someone’s desk. The engineer still does his job exactly the same way. The file just gets where it’s going on its own, and there’s a record of it doing so. 

Same Connectivity. Different Cargo. 

This only works because it isn’t a separate system to secure. It’s the same Zero Trust infrastructure already governing remote access, functioning as a gateway and firewall, supporting both one-way and two-way streaming so you can enforce network segmentation and directionality control exactly where compliance requires it. The goal is to eliminate ad hoc file sharing methods, USB drives and unsecured email included, without re-architecting the systems you already run. 

That means the access controls, the audit trail, and the exfiltration policy governing who can move what data, where, are the same ones your security team already trusts for remote sessions. No second platform to buy. No second security model to defend to an auditor. Just the sneakernet, replaced by a path that was already there. 

The Fix Was Already Sitting There 

Every distributed industrial fleet has some version of this problem sitting in plain sight: patches, configs, or backups that move by hand because nobody’s gotten around to automating the path between two machines. It’s not usually a hard problem. It’s just one that’s been easier to work around than to fix, until the workaround is the thing that costs you a record you can’t get back. Replacing it doesn’t mean a new platform or a new security model. It means pointing the connectivity you already have at the file, instead of the person. 

When the secure path is also the automatic one, the workaround disappears on its own, not because policy demands it, but because there's no longer an easier way to get the file where it needs to go. 

Eliminate Operational Friction with Modern Remote Access 

Download the new research from Takepoint Research on how leading organizations reduce downtime, accelerate response, and standardize access across every plant, including how they're closing the same manual-workaround gaps this piece describes. → Read the Takepoint Research whitepaper