Killing the Sneakernet: From USB Drives to Automated M2M File Transfer Across Industrial Fleets

Key takeaway: Patches, configuration backups, and log files still move by USB drive, or worse, by external hard disk, across a lot of industrial fleets, a workaround with no log of who touched a file, no record of who deleted it, and a physical point of failure at every handoff. Automated machine-to-machine file transfer eliminates that gap without new infrastructure. It runs over the same Zero Trust connectivity already brokering remote sessions, so every transfer inherits the same vaulted credentials, administrator approval, and audit trail your team already trusts. 

The USB drive is still your patch distribution strategy. That's a bigger problem than it sounds, and it's an easier fix than you'd think. 

I was on a call not long ago with the operations team at a heavy-equipment manufacturer, walking through what our Industrial Data Streaming capability could do for them. Partway through, one of their engineers stopped me to describe a use case he’d just learned about, one he hadn’t even run by his own colleagues yet. 

His company builds large industrial equipment in batches, and every unit that rolls off the line carries its own configuration data, the settings and calibration record for that specific machine. That configuration gets backed up at each stage of production. Here's how: a vendor's engineer shows up with a laptop, plugs in a USB stick, and pulls the entire configuration off the equipment. From there it gets copied onto a laptop, and eventually into an IT file share that, in his words, was known only to the people who put it there and protected by no one. Anyone with access to that share could delete a file that's supposed to be an immutable production record, and nobody would necessarily know until it was needed and gone. 

He wasn't describing a hypothetical. He was describing what his team does today, for records they explicitly told me need to be permanent. 

The Sneakernet Never Actually Went Away 

There's a name for this pattern, the “sneakernet,” moving data by physically carrying it from one machine to another because there wasn't a trusted network path to send it electronically. It sounds like a relic. It isn't. Across manufacturing, energy, and process industries, it's still how a lot of patches, configuration backups, and log files move between sites, because a secure electronic path has historically meant more infrastructure and more risk than just handing someone a drive. And the cost is real, a USB transfer has no log of who touched it, a file share with open permissions has no record of who deleted or replaced what landed in it, and every handoff is a physical chance for a lost drive or a file that quietly stops matching the version everyone assumes is authoritative. 

It's also often bigger than a USB stick, external hard disks carrying terabytes, shipped to a third party because there was never a faster path built. That's not just a security gap, it's a shipping delay, days for something that should take minutes. And a lot of modern security frameworks require disabling removable media outright, which sounds like the fix until you realize it doesn't replace the job removable media was doing. It just removes the workaround without replacing the workflow, leaving a compliant team with no sanctioned way to move a file at all. For the teams that haven't disabled it yet, every one of those handoffs is likely already breaking the same requirement. 

And OT can't just ban USB outright the way IT might. A lot of OEM engineering software, Mitsubishi's GX Works among them, connects to a PLC directly over USB as its primary control path, not Ethernet. The port a removable media policy wants closed is sometimes the port a vendor's own software needs open. That's exactly why the fix has to be an automated path, not just a locked port. 

What Automated Machine-to-Machine Transfer Looks Like 

The fix isn't complicated, and it doesn't require new infrastructure. If your sites already have modern OT secure remote access in place, like the Dispel Zero Trust Engine, the same connectivity layer that brokers a vendor's remote session can move a file between two machines with the same governance. Plenty of OT remote access tools claim this; fewer actually deliver it without bolting on a separate file-transfer product. That's the whole idea behind machine-to-machine, or M2M data streaming: instead of a person carrying a file by hand, the file moves itself, automatically, between a defined source and a defined destination, over the same Zero Trust path a remote session would use. 

Here's what that looks like end to end, based on how we build it for customers running exactly this kind of fleet: 

• A source and a destination, defined once. Each device gets a file share, read, write, or read-only, with credentials vaulted rather than handed to whoever’s doing the transfer. Once that’s set up, the workflow for the end user is just: put the new file where it belongs. The transfer happens on its own from there. 

• An administrator has to accept the transfer. The receiving side isn’t a wide-open drop box. Someone with authority over the destination approves it, which means every transfer has a person accountable for it, not just a folder anyone can write to. 

• Every transfer is logged, end to end. Full visibility into every file as it moves, so you can verify integrity and produce an audit trail on demand instead of reconstructing one from memory when someone asks where a backup came from. 

• It’s built for the files that actually break native transfer tools. Large datasets, full OS images, ISO files, all supported, with retry-resistant transfer that picks up where it left off instead of starting over if a connection drops. And for data that changes incrementally rather than all at once, streaming just the differential instead of the full file again cuts the bandwidth a transfer needs substantially. 

Go back to the story that opened this piece. Put the Dispel Zero Trust Engine in front of that equipment instead of a USB stick, and the configuration backup streams automatically to a controlled destination the moment it's created, no laptop in the loop, no unprotected file share, no single point of failure sitting on someone's desk. The engineer still does his job exactly the same way. The file just gets where it's going on its own, and there's a record of it doing so. 

Same Connectivity. Different Cargo. 

This only works because it isn’t a separate system to secure. It’s the same Zero Trust infrastructure already governing remote access, functioning as a gateway and firewall, supporting both one-way and two-way streaming so you can enforce network segmentation and directionality control exactly where compliance requires it. The goal is to eliminate ad hoc file sharing methods, USB drives and unsecured email included, without re-architecting the systems you already run. 

That means the access controls, the audit trail, and the exfiltration policy governing who can move what data, where, are the same ones your security team already trusts for remote sessions. No second platform to buy. No second security model to defend to an auditor. Just the sneakernet, replaced by a path that was already there. 

Modernize Your Connectivity. Solve Both Problems. 

Every distributed industrial fleet has some version of this problem sitting in plain sight, patches, configs, or backups that move by hand because nobody's gotten around to automating the path between two machines. It's not usually a hard problem. It's just one that's been easier to work around than to fix, until the workaround is the thing that costs you a record you can't get back. Fixing it doesn't mean standing up a separate platform for file transfer on top of whatever you use for remote access. The same platform that governs who connects to what can also govern how a file gets from one machine to another, one investment, not two. 

And that same platform does more than patch files. The connection that stops USB drives and shipped hard disks from being your patch and backup strategy is the same one that can stream your process data off the plant floor in real time, to a historian, an analytics platform, or the operational AI models manufacturers are racing to stand up. We wrote about that race in The Pilot Problem. Most AI pilots stall not on the model, but on the data infrastructure underneath it, still built for storage and reporting, not real-time movement at fleet scale. Killing the sneakernet and feeding an AI pipeline aren't two separate projects. They're the same infrastructure question, asked twice. 

When the secure path is also the automatic one, the workaround disappears on its own, not because policy demands it, but because there's no longer an easier way to get the file where it needs to go. 

Eliminate Operational Friction with Modern Remote Access 

Download the new research from Takepoint Research on how leading organizations reduce downtime, accelerate response, and standardize access across every plant, including how they're closing the same manual-workaround gaps this piece describes. → Read the Takepoint Research whitepaper