Top 7 Data Diodes for Oil and Gas Pipeline Networks in 2026
Pipeline operators face a widening attack surface as SCADA systems, remote terminal units, and compressor station telemetry connect to corporate IT networks and cloud analytics platforms. A single misconfigured firewall rule can open a path back into control systems that were never designed to be internet-facing. Data diodes solve this by physically enforcing one-way data flow, so operational data can leave the control network for monitoring and compliance reporting while no path exists for traffic to travel back in.
Following the Colonial Pipeline ransomware attack, pipeline operators and regulators have scrutinized this kind of hardware-enforced segmentation more closely than before. This guide compares seven data diode vendors serving oil and gas pipeline networks, covering throughput, certifications, and deployment models to help you match the right diode to your SCADA and ICS architecture.
Data Diode Vendors at a Glance
| Vendor | Key Feature / Strength | Max Throughput |
|---|---|---|
|
Data diode built into SmartNA-PortPlus and SmartNA-XL hybrid platforms |
Not disclosed |
|
|
Unidirectional Security Gateway with OT protocol replication (OSIsoft PI, historians) |
Up to 10 Gbps |
|
|
Protocol Filtering Diodes with FPGA-based, protocol-aware filtering |
Up to 100 Gbps |
|
|
Hardware-only DD1G Gen 2 and DDSFX-10G diodes, no configuration options |
Up to 10 Gbps |
|
|
SPAN-based Hardware Data Diode for substations and metro sites |
Up to 1 Gbps |
|
|
XTS Diode and Common Criteria EAL 7+ Data Diode Solution |
Up to 10 Gbps |
|
|
MetaDefender Optical Diode with Class 1 Division 2 hazardous-area rating |
Up to 10 Gbps |
Network Critical
Network Critical builds data diode functionality directly into its existing TAP and packet broker hardware rather than selling it as a separate appliance. The capability is available as a standalone module or embedded inside the SmartNA-PortPlus and SmartNA-XL platforms already deployed across the oil and gas sector. A pipeline operator adding one-way enforcement to a SCADA monitoring feed does not need to rack a separate diode appliance or manage a second console.
The diode enforces one-way communication at the hardware level, so a downstream firewall or access control list cannot be misconfigured into allowing a return path into the control network. Network Critical states sub-millisecond latency for the diode function, though standalone throughput figures for the module are not publicly disclosed. Operators should confirm throughput against their specific SCADA telemetry volumes before deployment.
The hybrid TAP and network packet broker architecture combines passive access, traffic aggregation, and enforced unidirectional flow in a single chassis. This reduces the number of separate appliances an OT team needs to rack, wire, and maintain in a space-constrained pipeline control room.
Proven results:
- BP: Enabled centralized monitoring of IT and OT systems across refinery buildings spanning 10 to 12 facilities using passive fiber TAPs
- State of Maryland: Achieved compliance-ready network visibility across a government IP services migration using the SmartNA-XL
- Darktrace: Enabled automated threat detection through a SmartNA-PortPlus API integration that adapts to traffic changes without manual reconfiguration
Waterfall Security Solutions
Waterfall Security Solutions pioneered the unidirectional gateway category and remains one of the most widely deployed names in oil and gas pipeline security. The company's Unidirectional Security Gateway physically separates a pipeline's SCADA network from lower-trust networks using paired transmitter and receiver hardware connected by fiber optic cable. Waterfall's gateway software replicates industrial data sources, such as OSIsoft PI historians, onto the enterprise side, so IT users interact with a live-updating copy rather than a direct connection to the control network.
The flagship gateway model reaches 10 Gbps throughput and supports high-availability configurations for continuous pipeline operations. Waterfall has documented deployments protecting gas transmission SCADA systems, including a cross-border natural gas interconnection pipeline. This depth of pipeline-specific deployment experience differentiates Waterfall from vendors whose data diode work centers on defense or general critical infrastructure. The company also offers CloudConnect for one-way feeds into predictive maintenance and cloud monitoring applications, a common requirement for digital oilfield initiatives.
Owl Cyber Defense
Owl Cyber Defense builds hardware-enforced data diodes using a paired-card design, where one card can only transmit and the other can only receive. This physical separation removes any inbound path into the protected pipeline network, regardless of how a downstream system is configured. The Owl Talon One model provides one-way transfers at up to 1 Gbps in rackmount or DIN rail form factors, while the company's Protocol Filtering Diode line scales to 100 Gbps for higher-throughput environments such as historian replication or SIEM feeds.
Owl serves upstream, midstream, and downstream oil and gas operators, moving pipeline and SCADA data one way to IT networks, historians, and cloud platforms without creating a return path. The company's protocol filtering approach inspects and validates data at the field, message, and application level before it crosses the boundary. Owl's diode technology also carries government validation credentials, which matters for pipeline operators subject to federal oversight following recent Transportation Security Administration (TSA) pipeline security directives.
Advenica
Advenica is a Swedish vendor whose SecuriCDS and DD1G product lines take a deliberately minimal approach to data diode design. The DD1G Gen 2 is a hardware-only diode with full Gigabit throughput and no configuration options, an approach the company argues removes the risk of misconfiguration entirely. For higher-speed pipeline telemetry, the DDSFX-10G variant extends throughput to 10 Gbps in a compact SFP form factor.
Advenica's customer base leans heavily toward European national authorities and operators of essential infrastructure, including electricity and water utilities, alongside oil and gas customers seeking Common Criteria EAL4+ certification. Customers needing bidirectional application support can pair any Advenica hardware diode with the company's Data Diode Engine, a proxy software layer that manages file transfer and sensor data export without compromising the underlying one-way guarantee. This European regulatory alignment and certification depth make Advenica a common shortlist candidate for pipeline operators managing both NIS2 and national data sovereignty requirements.
Garland Technology
Garland Technology offers a Hardware Data Diode built around SPAN port regeneration rather than inline TAP deployment, a simpler retrofit path for substations, compressor stations, and metro pipeline sites that already use SPAN for monitoring. The device requires no configuration and enforces one-way data flow for SPAN links using physical hardware separation, so reverse traffic cannot reach the protected network.
Garland's diode throughput tops out at 1 Gbps, which suits substation and lower-speed industrial links well but is not built for high-throughput data center or telecom environments. Garland has built a partner ecosystem with OT security vendors including Nozomi Networks and Radiflow, giving pipeline operators pre-built integration paths for downstream monitoring tools. The company's no-subscription, no-hidden-fees commercial model appeals to operators comparing total cost of ownership against diode vendors that add ongoing software licensing on top of the hardware purchase.
BAE Systems
BAE Systems brings decades of cross-domain solution heritage from defense and intelligence work to its Data Diode Solution and XTS Diode product lines. The Data Diode Solution is Common Criteria EAL 7+ certified, one of the highest assurance levels available, and is approved under the National Cross Domain Strategy Management baseline used across United States government and defense procurement.
The XTS Diode reaches 10 Gbps of throughput while maintaining a compact footprint, according to BAE Systems' own product documentation, and includes forward error correction so messages can be recovered after transmission. BAE Systems converts data into sequenced UDP packets for transfer across the diode, and the receiving side reconverts the broadcast to its original format. While BAE Systems' core customer base sits in defense, intelligence, and government rather than commercial oil and gas, its assurance credentials appeal to pipeline operators with defense-adjacent ownership structures or national infrastructure designations requiring the highest available certification tier.
OPSWAT
OPSWAT offers the MetaDefender Optical Diode, formerly known as Fend, as a preconfigured platform that connects source and destination networks using a single optical fiber with no network connection between them. The base model transfers at up to 10 Gbps, with lower-throughput 100 Mbps and 1 Gbps tiers available for smaller telemetry feeds, and supports industrial protocols including Modbus, OPC, and DNP3 alongside AVEVA PI historian replication.
OPSWAT's Din Rail version has achieved Class 1 Division 2 certification, meaning it is rated safe for operation in hazardous locations where combustible gases or vapors are present, a requirement specific to oil and gas and similar environments. This certification is uncommon among data diode vendors and directly addresses a physical safety requirement pipeline operators face at wellheads, compressor stations, and other locations classified as hazardous areas. OPSWAT's broader MetaDefender platform also gives pipeline operators a path to add file sanitization and multi-scanning to diode-transferred data if that need arises later.
How To Choose A Data Diode For Pipeline Networks
Throughput And Telemetry Volume
Match a diode's rated throughput to your actual SCADA and telemetry data volume, not your network's overall link speed. Most pipeline monitoring feeds, sensor streams, and historian replication jobs run well under 1 Gbps, so a diode rated for 100 Gbps often represents unused capacity you are paying for. If you plan to add high-volume capture behind the diode later, size for that future state now rather than replacing hardware in two years.
Certification And Compliance Requirements
Pipeline operators covered by NIS2, NERC CIP, or IEC 62443 should look for Common Criteria EAL4+ as a baseline, with EAL7+ reserved for defense-adjacent or highest-assurance deployments. Ask any vendor for their actual certification scope rather than a general assurance claim, since certifications often apply to a specific model or firmware version rather than an entire product line.
Hazardous Area And Environmental Ratings
Wellheads, compressor stations, and remote drilling platforms often require equipment rated for hazardous locations where combustible gases or vapors are present. Confirm Class 1 Division 2 or equivalent certification if your deployment site falls into this category. Check operating temperature range and power consumption against your cabinet's environmental conditions before shortlisting a vendor.
Deployment Complexity And Change Management
Any change to a production SCADA network typically requires a planned maintenance window, so ask how long installation actually takes and whether it demands SCADA reconfiguration. A hardware-only diode with no configuration options removes an entire category of deployment risk, since there is nothing to misconfigure. Where your monitoring architecture already includes a network TAP or network packet broker, check whether diode functionality can integrate into that existing hardware rather than adding a separate appliance to rack and wire.
Integration With Existing Tools And Protocols
Confirm the diode supports the industrial protocols your operation runs, such as Modbus, DNP3, OPC, or IEC 104, along with the historian or SIEM platform receiving exported data. Some diodes require protocol-specific software connectors on both ends, while others pass data more generically. Consider:
- Whether the vendor supports your specific historian platform, such as OSIsoft PI or AVEVA
- Whether your SIEM or SOC tooling can ingest the diode's output format without a custom connector
- Whether adding the diode changes how existing TAP or packet broker feeds are mapped to monitoring tools
Total Cost Of Ownership
Compare not just hardware cost but ongoing licensing, subscription fees, and the cost of a separate appliance versus diode functionality built into hardware you may already operate. Some vendors charge per-protocol or per-connector software licensing on top of the diode hardware itself, which changes the three-year cost picture significantly against a flat, perpetual hardware purchase.
Frequently Asked Questions
What Is A Data Diode?
A data diode is a hardware device that physically enforces one-way data flow between two networks of different trust levels. Unlike a firewall or access control list, which relies on software rules that can be misconfigured or exploited, a data diode has no return path built into its hardware. Pipeline operators use them to move SCADA and sensor data out of a control network to IT, historians, or cloud analytics without creating a route back in.
What Is The Difference Between A Data Diode And A Firewall?
A firewall filters traffic using software rules that permit or deny connections in both directions, while a data diode uses physical hardware that only allows data to travel one way. Firewalls can be misconfigured, exploited, or bypassed through a vulnerability in the rule set. A data diode carries no equivalent risk, since there is no software interface on the return path to exploit. Many pipeline operators deploy both together, using firewalls for general perimeter control and data diodes for the highest-assurance segments of the SCADA network.
How Much Does A Data Diode Cost For A Pipeline Deployment?
Data diode pricing varies by throughput tier and certification level, with basic Gigabit hardware-only diodes typically costing less than higher-assurance models carrying Common Criteria EAL7+ certification. Some vendors charge additional software licensing for protocol connectors or historian replication on top of the hardware itself. Request quotes based on your specific throughput and certification requirements rather than comparing list prices, since configurations differ significantly. Where diode capability integrates into existing hybrid TAP and packet broker hardware rather than a standalone appliance, the incremental cost can be lower than adding a separate device.
Do I Need A Data Diode If I Already Use A Firewall For OT Segmentation?
A firewall alone is not equivalent to a data diode for the highest-consequence segments of a pipeline network, since firewall rules remain software that can be misconfigured or bypassed. Regulatory frameworks including NERC CIP and IEC 62443 increasingly expect provable, hardware-enforced separation for the most sensitive OT and ICS zones, which a firewall cannot fully demonstrate on its own. Many operators layer a data diode behind existing firewalls specifically for SCADA telemetry export, historian replication, or remote monitoring feeds.
What Throughput Do I Need For Pipeline SCADA Data Diode Deployment?
Most pipeline SCADA and telemetry feeds require well under 1 Gbps of sustained throughput, since sensor data, alarm states, and historian updates are small compared to full network traffic capture. Higher throughput becomes necessary only if you plan to export full packet captures or aggregate multiple sites through a single diode. Confirm your actual data volume with your OT team before selecting a throughput tier, since overprovisioning adds cost without adding security benefit.
Can A Data Diode Replace A Network TAP In A Pipeline Monitoring Architecture?
A data diode and a network TAP solve different problems and are not interchangeable. A network TAP passively copies live traffic for monitoring tools without affecting production traffic, while a data diode enforces one-way flow between two networks of different trust levels. Many pipeline deployments use both together: a network TAP captures traffic for security and performance tools, and a data diode ensures that any data leaving the control network cannot be used as a path back in.
Build Your Pipeline Visibility Architecture With Network Critical
Selecting a data diode is only one piece of a pipeline's OT security architecture. The right choice depends on your actual throughput needs, certification requirements, and how much complexity you want to add to an already tightly controlled control room.
Network Critical's approach avoids adding another isolated appliance to that control room. Data diode capability builds into the OT Network Monitoring Solutions already handling TAP and packet broker duties, so pipeline operators get hardware-enforced segmentation without a new console or vendor relationship to manage. Perpetual hardware licensing avoids the subscription surprises common among broader OT security platforms, and Drag-n-Vu deployment typically completes in under two hours rather than requiring specialist configuration.
If you are evaluating data diode options for a pipeline SCADA or ICS environment, speak to the Network Critical team about matching diode throughput and certification to your specific architecture.
