A Window and Door Manufacturer Keeps DOS-Era Cutting Saws Isolated and in Production With Files.com

A US window and door manufacturer builds its products at domestic plants for contractors, builders, and dealers.

Window orders become sets of machine instructions: files that tell the saws on the plant floor exactly what to cut. The software that generates those files is modern and lives on the corporate network. The machines that consume them are another matter.

Machines Built to Last 20 Years Could Not Join the Corporate Network

A vinyl cutting saw is capital equipment. It is not replaced on a software schedule, it cannot be patched the way a server can, and no amount of effort will bring it up to modern security standards. The manufacturer’s answer was the disciplined one: the legacy equipment lived on its own segregated network, walled off from everything else the company ran.

Quarantine solved only half the problem. An isolated saw makes nothing. The machines produced windows only if they continuously received instruction files from the GED production software on the corporate side, which put the company’s security posture in direct conflict with its production throughput. Without a controlled way to move files across that boundary, the options were bad in both directions: connect unsecured, decades-old equipment to the corporate network and accept the exposure, or retire working machines early to satisfy a security requirement. A network design decision becomes either a standing risk or a capital expense.

For the segmentation to hold, the manufacturer needed a transfer point that sat outside both networks: somewhere the corporate side could push files to and the plant side could pull them from, so that neither network ever opened a path into the other. It had to speak plain FTP, because that is what the scripts and machine-side computers on the plant network actually speak. It had to be fully scriptable, because no person can sit in the loop between an order and a saw. And it had to run on fixed, known endpoints that a locked-down environment could allowlist.

The manufacturer selected Files.com as that transfer point.

A Transfer Point Between Two Networks That Never Touch

The workflow runs the same way today as it did on day one. GED production software turns each window order into machine-instruction files. The company’s scripts push those files from a Windows server into Files.com over FTP. On the segregated network, scripts on a second server pull them down and hand them to the computer driving the appropriate saw. With Files.com endpoints allowlisted, the locked-down network reaches a controlled destination outside itself.

The point of the design is what never happens. The corporate network never opens a connection into the plant network, and the plant network never reaches into corporate. Files.com is the only thing exposed to both. On the machine side, nothing had to change to make that true: no agent to install, no protocol to upgrade, no modification to computers that cannot accept one. Files arrive the way that equipment has always received files, over plain FTP, and Files.com is the endpoint that decades-old scripts can treat as just another server.

In Continuous Production

• Equipment serves out its full lifecycle. Saws that cost roughly $200,000 to replace keep running for the 20 years the manufacturer expects of them, rather than being retired early to satisfy a security policy.
• The pattern repeats across machine types. The same push-and-pull design carries .ged, .cut, .csv, .wld, and .saw files for different equipment without requiring a new integration for each one.
• The workflow has run continuously for years, feeding live production lines the files that tell the machines what to make.

Security Decisions and Equipment Decisions, Uncoupled

Today, when an order for a custom window reaches one of the manufacturer’s plants, the path from order to cut vinyl crosses a hard network boundary automatically. Production software writes the instructions, Files.com carries them over, and a saw that may be running DOS cuts the product. No exception to the segmentation policy is needed, and no working machinery has to be replaced to comply.

That is the change underneath the workflow. The manufacturer’s equipment decisions now run on manufacturing timelines and its security decisions run on security’s, because Files.com sits between them and keeps them from colliding. The usual assumption about legacy plant equipment is that it must eventually be either networked and risk-accepted, or replaced. The manufacturer did neither. The machines stayed isolated, the machines stayed in service, and the file layer between the two networks provided the integration the plant floor needed.