Critical national infrastructure operators face a structural problem. Operational Technology (OT) networks must stay isolated to remain safe. Yet operators still need data out of those networks for monitoring, compliance, and analytics. Firewalls rely on rule sets that can be misconfigured or bypassed. Data diodes solve this differently, using a physical hardware barrier that makes return traffic impossible rather than merely disallowed. Regulators have taken notice. NERC CIP, the EU NIS2 Directive, and IEC 62443 all push energy, water, and transportation operators toward stronger network segmentation. Unidirectional hardware is one of the few controls that satisfies auditors without relying on configuration discipline alone.
This guide compares seven verified data diode manufacturers serving energy, defense, water, and transportation operators. It then covers how to choose between standalone and integrated deployment models.
Comparing Leading Data Diode Manufacturers
| Vendor | Key Feature / Strength | Max Throughput |
|---|---|---|
|
Standalone module or integrated into SmartNA-PortPlus and SmartNA-XL, protocol agnostic |
— |
|
|
FPGA-based Protocol Filtering Diodes, US Government validated |
Up to 100 Gbps |
|
|
Unidirectional Security Gateway with software replication layer |
Up to 10 Gbps |
|
|
Raise-the-Bar compliant, Common Criteria EAL 7+ certified |
Up to 10 Gbps |
|
|
Swedish national approval to Top Secret classification |
Up to 1 Gbps |
|
|
SPAN-compatible diode line built for OT retrofits |
Up to 1 Gbps |
|
|
OT-hardened network isolation hardware for industrial environments |
— |
Network Critical
Network Critical offers hardware-enforced data diode capability in two forms. Buyers can deploy a standalone Hardware Data Diode Module. They can also configure unidirectional flow directly within the SmartNA-PortPlus packet broker or the SmartNA-XL hybrid TAP. This integrated option removes a separate appliance from the rack. The same chassis already handling TAP and packet broker duties also enforces the one-way boundary. The platform is protocol agnostic across IP-based traffic, so it avoids the translation work some pure hardware diodes require. Network Critical states sub-1 millisecond latency and 99 percent reliability for the data diode line. A specific maximum throughput figure was not published at the time of writing. Customers cited on the data diode page span government, financial services, and energy, including named quotes from BP and HSBC. BAE Systems and EDF Energy are referenced as partners in the same deployment context.
Proven results:
- BP: Deployed passive fiber TAPs across refinery buildings to monitor IT and OT systems without adding power-dependent points of failure
- HSBC: Achieved zero-latency monitoring for real-time financial systems using SmartNA and passive fiber TAPs
- Airbus: Used network TAPs across aircraft test rigs to achieve full visibility with zero impact on safety-critical test traffic
Owl Cyber Defense
Owl Cyber Defense builds Protocol Filtering Diodes (PFDs) that combine hardware-enforced one-way transfer with FPGA-based protocol filtering. The Owl Talon One appliance delivers up to 1 Gbps in a single PCIe card. Larger appliance and card configurations scale to 100 Gbps for higher-bandwidth missions. Owl PFDs have completed the US Government PFD evaluation process and align with Raise the Bar and Zero Trust guidance. The product line covers defense, intelligence, and critical infrastructure use cases. These include ISR feeds, sensor telemetry, and cyber monitoring data leaving high-assurance networks. Owl also offers an Incident Response Device for extending one-way protection to compromised endpoints. This gives buyers a path to standardize on one platform across multiple mission profiles. It avoids mixing diode vendors by use case.
Waterfall Security Solutions
Waterfall Security Solutions pairs hardware diode technology with software connectors in its WF-600 Unidirectional Security Gateway. The gateway is available in 1 Gbps or 10 Gbps throughput configurations. It replicates OT servers, historians, and OPC-DA sources onto an IT-side replica. Enterprise users can then query data normally without ever opening a path back into the protected network. Waterfall has deployed more than 1,000 sites across nuclear power, electric utilities, and oil and gas. Its connector library covers most common industrial control system protocols out of the box. Waterfall positions the WF-600 as an evolutionary alternative to firewalls rather than a bolt-on addition. The company also offers high-availability configurations for sites that cannot tolerate a single point of failure on the gateway itself.
BAE Systems
BAE Systems offers two distinct one-way transfer products: the XTS Diode and the Data Diode Solution. The Data Diode Solution is Common Criteria EAL 7+ certified. That is the highest assurance level achieved by a commercial product in this category. It converts data into sequenced UDP packets for transfer across the hardware boundary. The XTS Diode reaches up to 10 Gbps throughput. It is the first product named Raise-the-Bar compliant by the National Cross Domain Strategy Management Office. Both products serve defense, intelligence, and critical infrastructure clients, including power grids and water systems.
Advenica
Advenica, based in Sweden, manufactures the SecuriCDS data diode family. The SecuriCDS DD1000A is a hardware-only device with no configuration options, eliminating misconfiguration risk entirely. The SecuriCDS DD1000i adds integrated proxy servers supporting file transfer, log export, and OPC UA data services. Both models deliver Gigabit throughput. Both carry Swedish national approval for data transfer up to Top Secret classification. This makes Advenica a strong fit for defense and government buyers with strict national assurance requirements.
Garland Technology
Garland Technology's Hardware Data Diode line is SPAN-compatible and built for straightforward retrofit into existing OT switch infrastructure. The AggregatorTAP Data Diode aggregates up to four TAP links or eight SPAN ports into one or two monitoring ports. This is useful when distributed OT sites must feed a centralized security operations center. Garland's diode hardware operates at 10/100/1000M speeds and is manufactured in the United States. That appeals to buyers prioritizing domestic supply chains. The company markets a zero-subscription-fee model across its data diode and TAP portfolio. Garland also sells a portable diode form factor for field deployments. This suits utilities and pipeline operators who need temporary one-way protection at a remote site without a full rack installation.
Belden (Hirschmann)
Belden, through its Hirschmann brand, supplies network isolation and ruggedized hardware aimed at industrial automation and energy environments. Belden's industrial networking heritage gives it an established footprint in process manufacturing and utility deployments. Extended temperature ranges and DIN rail mounting are standard requirements in these settings. Published throughput figures for Belden's diode-class hardware were not available in current source data. Confirm current specifications directly with Belden before procurement.
Standalone Diodes Versus Integrated Visibility Platforms
A bare data diode enforces one-way flow at a single boundary. It does not, by itself, give teams a complete picture of traffic across the rest of an OT environment. The Purdue Model used to design industrial network zones recognizes this. Diode functionality controls what crosses a zone boundary, while network TAPs and packet brokers provide passive visibility around it.
This is the practical distinction between Network Critical's approach and most of the pure-play vendors above. Rather than adding a separate diode appliance to a crowded rack, Network Critical builds the boundary into SmartNA-XL itself. That chassis already carries PacketPro packet manipulation for OT traffic feeding multiple security tools. For sites that want the diode as a separate, single-purpose device, the standalone module covers that case too. For zero trust segmentation alongside a diode boundary, INVIKTUS adds an invisible network presence. It does not introduce a new addressable target. The trade-off is straightforward. Pure-play diode specialists like Owl Cyber Defense and BAE Systems carry deeper certification pedigree for the highest-assurance defense use cases. An integrated platform reduces rack space and vendor count for operators who also need broader TAP and packet broker visibility.
How to Choose the Right Data Diode for Your Network
Throughput and Protocol Support
Match diode throughput to your actual data export volume, not your network's total bandwidth. Most CNI export use cases, such as telemetry, logs, and historian replication, need well under 1 Gbps. Reserve 10 Gbps and 100 Gbps options for high-volume sensor feeds or video. Buying more throughput than your use case requires adds cost without adding security. The diode's hardware-enforced barrier provides the same protection regardless of rated speed.
- Confirm which protocols the vendor's proxy or connector software supports natively
- Check whether unsupported protocols require custom integration work
- Verify the vendor publishes independent throughput testing, not just rated capacity
Certification and National Approval
Government and defense buyers should prioritize Common Criteria EAL ratings or relevant national security approvals. Commercial energy and water operators have more flexibility but still benefit from third-party validation over vendor self-certification. Where frameworks like NERC CIP or IEC 62443 apply, ask for documentation mapping the product to the relevant controls. Generic compliance marketing rarely survives an audit unchanged.
Deployment Complexity
Hardware-only diodes with no configuration options reduce misconfiguration risk but limit flexibility. Diodes with integrated proxy software support more use cases but require more setup expertise. Decide which trade-off fits your team's capability before committing to either model.
Total Cost of Ownership
Diode hardware pricing varies widely by assurance level, from commercial-grade Gigabit units to defense-grade appliances. Ask whether the vendor charges ongoing software or support subscriptions. Some hardware-only models avoid this entirely, while proxy-based models often do not.
Integration With Existing Visibility Tools
A data diode controls the boundary. Your security operations center still needs visibility into traffic on both sides of it. Plan for network packet brokers or TAPs that feed your SIEM, NDR, or analytics platform independently of the diode itself. That way the diode becomes one control in a layered architecture, not your only source of truth.
- List every monitoring tool that needs OT-side data today
- Confirm the diode vendor's connector library covers your historian, SCADA, or PLC sources
- Map where TAPs or packet brokers will sit relative to the diode boundary
Ruggedization and Physical Environment
Refineries, substations, and water treatment facilities expose hardware to extreme temperatures, vibration, and humidity. Confirm the diode's rated operating range and mounting format match your physical deployment site before ordering.
Frequently Asked Questions
What Is a Data Diode?
A data diode is a hardware device that physically enforces one-way data flow between two networks. It makes return traffic impossible rather than just disallowed by policy. It typically uses an optical transmitter on one side and a receiver with no transmitting capability on the other. This physical separation means malware or remote attacks cannot propagate back into the protected network. That is why data diodes are standard in nuclear, defense, and grid environments.
What Is the Difference Between a Data Diode and a Unidirectional Gateway?
A data diode is pure hardware enforcing one-way flow with limited protocol support. A unidirectional gateway adds software that replicates servers and emulates client and server protocols on the receiving side. This lets enterprise users query OT data normally without compromising the hardware-enforced boundary. Most modern commercial products, including several covered above, ship as unidirectional gateways rather than bare diodes.
Do I Need a Data Diode if I Already Have a Firewall?
Firewalls rely on configurable rules that can be misconfigured, bypassed, or exploited through software vulnerabilities. A data diode removes that risk at the physical layer for the specific link it protects. Most critical infrastructure operators use both. Firewalls handle general perimeter control. Data diodes enforce the boundaries where one-way flow is non-negotiable, such as between OT and IT networks.
How Much Does a Data Diode Cost?
Pricing varies significantly by assurance level and throughput. Commercial-grade Gigabit diodes for industrial use typically cost in the low tens of thousands of dollars per unit. Defense-grade appliances with Common Criteria EAL certification cost substantially more due to certification overhead and lower production volumes. Installation, proxy software licensing, and ongoing support can add to the base hardware price, depending on the vendor's model. Request quotes directly, since none of the verified vendors above publish list pricing.
Can a Data Diode Replace My Network Monitoring Tools?
No. A data diode controls flow at one boundary. It does not give you visibility into traffic elsewhere on your network. Most CNI architectures pair diodes with network TAPs or packet brokers that passively monitor both sides of the boundary. That traffic feeds SIEM, NDR, or analytics platforms, giving security teams a complete picture rather than a single control point.
Are Data Diodes Required by Regulation?
Some regulations recommend or effectively require unidirectional communication for high-consequence systems. NRC Regulatory Guide 5.71 addresses this for nuclear facilities. Broader frameworks including NERC CIP, IEC 62443, and the EU NIS2 Directive push operators toward stronger segmentation. Data diodes are one accepted method. Confirm specific requirements with your regulatory body, since mandates vary by sector and jurisdiction.
Building a Layered OT Visibility Architecture With Network Critical
Choosing the right data diode protects one boundary in your network. Sustained protection across critical national infrastructure requires that boundary control paired with passive visibility everywhere else traffic moves. Network Critical's hybrid TAP and packet broker architecture delivers that layer at a lower cost. Three-year total cost of ownership runs 40 to 60 percent below incumbent platforms. Perpetual hardware licensing replaces recurring subscription fees. The Drag-n-Vu interface lets your team configure and adjust monitoring without specialist engineer support. The tool-agnostic architecture feeds any SIEM, NDR, or capture platform you already run. Boundaries and visibility points both need careful placement across your OT environment.
Speak to the Network Critical team to map out where TAPs, packet brokers, and diode boundaries should sit.
