Top 6 Data Diodes for SCADA System Segmentation in 2026

SCADA systems run the processes that keep water treatment, power distribution, and manufacturing lines operational around the clock. Connecting these systems to IT networks or the cloud creates a return path. Attackers can exploit that path. A data diode closes it by physically enforcing one-way data flow. Telemetry leaves the SCADA environment, but nothing can travel back in.

Firewalls and unidirectional software rules can be misconfigured or bypassed. A hardware data diode cannot, because it has no return-path circuitry to exploit. Regulators increasingly treat this distinction as material. NERC CIP, IEC 62443, and NIS2 all reference provable one-way segmentation as a control. It is considered stronger than a firewall rule, which could in theory be changed. This guide compares six vendors offering hardware-enforced data diodes for SCADA and ICS segmentation. It covers throughput, certification, and deployment fit.

Data Diode Vendor Comparison at a Glance

Vendor	Key Feature / Strength	Max Throughput
Network Critical	Data diode integrated into existing TAP and packet broker hardware	—
Owl Cyber Defense	FPGA-based protocol filtering diodes, EAL4+ certified	Up to 100 Gbps
Garland Technology	SPAN-compatible diode line plus fiber Data Diode Network TAP	Up to 100 Gbps
Waterfall Security Solutions	Dedicated SCADA collector library, NERC CIP compliance exemption	Up to 10 Gbps
BAE Systems	EAL7+ certified, National Cross Domain Strategy Management baseline approved	Up to 10 Gbps
Advenica	Optical hardware-only separation, approved to Swedish TOP SECRET classification	Up to 1 Gbps

Network Critical

Network Critical brings data diode capability directly into the hardware family already handling network TAP and network packet broker duties. It is not a bolt-on appliance. The company offers a standalone hardware data diode module. It also offers integrated options built into the SmartNA-PortPlus packet broker and the SmartNA-XL hybrid TAP. Operators enforce unidirectional flow at the same point where they already manage TAP and broker traffic.

The data diode is protocol agnostic. It supports IP-based protocols without extra translation configuration. Network Critical states sub-millisecond latency for the underlying transfer. This matters for SCADA operators who cannot tolerate delay in process telemetry. The company positions the data diode for classified and highly regulated deployments, including military, ICS, and SCADA infrastructure.

Data diode functionality shares a chassis with network TAPs and packet brokers. This means operators avoid running a separate unidirectional appliance alongside their existing visibility stack. Drag-n-Vu software handles configuration for the broader SmartNA family. This reduces the specialist engineering time that standalone diode deployments often require. Network Critical also lists government, financial services, and energy sector customers among data diode deployments. Named account details for those specific customers were not published.

Proven results:

BP: Centralized monitoring of IT and OT systems across refinery buildings with zero impact on production traffic
State of Maryland: Unified communications monitoring deployed across a government network environment
Darktrace: SmartNA-PortPlus API integration feeding AI-driven threat detection without disrupting monitored traffic

Owl Cyber Defense

Owl Cyber Defense is a US manufacturer of hardware-enforced data diode and cross domain solutions. Its Protocol Filtering Diode (PFD) technology pairs one-way transfer with FPGA-based packet inspection. The Talon One appliance delivers up to 1 Gbps of hardware-enforced transfer on a single PCIe card. The broader PFD line scales to 100 Gbps for higher-throughput environments. The OPDS-1000 platform supports configurable capacity at 26, 155, or 1,000 Mbps for industrial control applications.

Owl's diodes carry Common Criteria EAL4+ evaluation. They support the same high-assurance protections used in defense and nuclear environments. A 2026 integration with Trihedral's VTScada software targets water, wastewater, and other critical infrastructure operators. It moves SCADA data from OT networks into IT systems and the cloud. No return path opens during that transfer. VTScada carries IEC 62443-4-1 Maturity Level 3 certification. This gives operators a documented compliance chain from SCADA software through to the diode hardware.

Garland Technology

Garland Technology pairs its TAP and packet broker portfolio with a dedicated hardware data diode line. It is built for SPAN-fed industrial deployments. The AggregatorTAP Data Diode and standalone Hardware Data Diode models regenerate SPAN traffic to multiple monitoring tools. They physically block any return path, targeting utility substations, manufacturing facilities, and other critical infrastructure sites. These SPAN-compatible models run at 10/100/1000 Mbps.

For higher-speed fiber environments, Garland's Data Diode Network TAP scales to 100G with custom split ratio options. This extends diode-grade separation beyond copper SPAN feeds. Garland positions data diodes as one part of a broader industrial visibility platform. That platform also includes bypass TAPs and packet brokers. Operators can standardize on a single vendor across TAP access, traffic management, and unidirectional enforcement in the same OT deployment.

Waterfall Security Solutions

Waterfall Security Solutions has protected industrial networks since 2007 with its Unidirectional Security Gateway product line. The flagship WF-600 offers a choice of 1 Gbps or 10 Gbps throughput. It comes in single or high-availability dual configurations. A web GUI controls the gateway. It is backed by a collector library covering most industrial control systems and SCADA products on the market. The WF-500 and its DIN rail variant address smaller or space-constrained sites.

Waterfall's software connectors replicate SCADA servers on the IT side. This gives enterprise applications read access to OT data without opening a bidirectional path back into the protected network. The gateways carry Common Criteria EAL4+ High Attack Potential certification. Waterfall states that NERC CIP exempts over 35 percent of cybersecurity requirements. This applies when unidirectional gateways are deployed at the OT boundary. That is a direct compliance argument for regulated utility operators.

BAE Systems

BAE Systems supplies cross domain solutions built for defense, intelligence, and critical infrastructure customers. These buyers need the highest available assurance level. The Data Diode Solution is Common Criteria EAL7+ certified. It is approved on the National Cross Domain Strategy Management Office baseline. This supports unidirectional transfer of files, streaming data, and email. The company's XTS Diode reaches up to 10 Gbps of throughput while remaining compact enough for tactical deployments.

BAE Systems serves telecommunications and critical infrastructure customers alongside its core defense and government base. Sales and support resellers cover North America, the UK, Europe, and Asia Pacific. Public throughput and configuration detail is more limited than commercially packaged OT diode vendors. BAE typically runs a consultative, requirements-driven sales process suited to government procurement rather than off-the-shelf industrial buying.

Advenica

Advenica is a Swedish manufacturer whose SecuriCDS data diodes use optical hardware separation. A physical transmitter and receiver pairing guarantees no signal travels in the reverse direction. The SecuriCDS DD1000A ships as hardware only, with no software or configuration options. This eliminates misconfiguration risk entirely. The SecuriCDS DD1000i adds integrated proxy servers for use cases like file transfer, syslog export, and systems monitoring. It keeps the diode function isolated from the proxy layer.

Both models deliver full gigabit throughput. The Swedish Armed Forces has approved them for data transfer up to TOP SECRET classification. This makes Advenica a common shortlist entry for European government and defense buyers. The company also serves essential infrastructure sectors including electricity, water, and transportation across Europe. It supplements its hardware with network design and security assessment services.

How to Choose a Data Diode for SCADA Segmentation

Selecting a data diode for SCADA segmentation differs from choosing a general-purpose security appliance. Production safety, not feature depth, drives the decision. Any risk of disrupting a live control system is an automatic disqualifier for most OT teams. The six criteria below reflect how OT security leads and ICS engineers actually weigh these purchases. Production safety and change management carry the most weight in practice.

Production Safety and Fail-Safe Design

Your first filter should be whether the diode can fail without affecting the SCADA process it monitors. A true hardware data diode has no return-path circuitry. Even a complete device failure cannot introduce backflow into your control network. Confirm the vendor's failure mode in writing before you schedule a maintenance window.

Throughput Against Real Data Volume

Match the diode's rated throughput to your actual telemetry volume, not your network's overall link speed. SCADA polling traffic and historian exports rarely approach gigabit levels. A 1 Gbps diode may outperform a 100 Gbps unit for typical SCADA telemetry. The oversized unit carries a higher price tag with no real benefit.

Protocol and SCADA Software Compatibility

Check whether the diode has a documented connector library for your SCADA platform, historian, or protocol set. Common examples include Modbus, DNP3, and OPC-DA. A diode with prebuilt SCADA connectors reduces integration time. Compare that with a generic one-way link that needs custom protocol handling on both sides. If NWC's hybrid TAP and packet broker architecture is already in place, add diode enforcement at that same access point. This avoids introducing a second, unfamiliar appliance into the control room.

Certification and Compliance Evidence

Look for independent certification such as Common Criteria EAL4+ or higher. Confirm the vendor can produce audit-ready documentation mapping the deployment to your applicable framework. That might be NERC CIP, IEC 62443, or NIS2. Auditors increasingly expect provable segmentation evidence, not just a vendor claim of one-way enforcement.

Deployment Complexity and Change Management

OT teams typically require deployment inside a short, pre-approved maintenance window. The SCADA system itself should need no reconfiguration. Favor diodes that install inline without protocol changes on the control side. Confirm a rollback path exists if the pilot deployment needs to be reversed.

Ask for a lab or pilot test plan before committing to a production install
Request a reference site in the same vertical, such as water, power, or oil and gas
Confirm the vendor's typical deployment window against your own maintenance schedule

Vendor Track Record in Critical Infrastructure

Prioritize vendors with a documented history in power, water, oil and gas, or defense deployments. Favor these over newer entrants without reference sites. A long operating history and named critical infrastructure customers lower the risk that a vendor disappears mid-contract. This matters more in OT than in most IT purchasing decisions. A replacement vendor in IT can be swapped in with far less disruption.

Frequently Asked Questions

What Is a Data Diode?

A data diode is a hardware device that physically enforces one-way data flow between two networks of differing trust levels. Unlike a firewall, it has no return-path circuitry. There is no software rule to misconfigure or bypass. Data diodes are commonly deployed at the boundary between a SCADA network and a corporate IT or cloud environment.

How Is a Data Diode Different From a Unidirectional Gateway?

A data diode is the physical hardware component that enforces one-way transfer. A unidirectional gateway is a broader product category. It combines that hardware with software connectors that replicate SCADA servers or historians on the receiving side. Waterfall Security Solutions markets unidirectional gateways as a complete product. A standalone diode module is one component of that architecture.

Is a Data Diode Required for NERC CIP or IEC 62443 Compliance?

Neither framework mandates a specific product, but both recognize hardware-enforced one-way transfer as strong evidence of segmentation. Waterfall Security Solutions states that NERC CIP exempts over 35 percent of cybersecurity requirements. This applies when unidirectional gateways protect the OT boundary. IEC 62443 treats a documented, physically enforced conduit as a defensible control between security zones.

Can a Data Diode Support Real-Time SCADA Monitoring?

Yes. Data diodes are designed to carry continuous, real-time telemetry out of a SCADA environment. This includes historian data, alarms, and performance metrics. Because the transfer is one-way, downstream monitoring and analytics tools receive live data. No path exists for that connection to be used against the protected network.

How Much Throughput Does a SCADA Data Diode Need?

Most SCADA environments generate well under 1 Gbps of monitoring traffic. Polling and historian exports are lightweight compared with typical enterprise data flows. Oversizing a diode to 100 Gbps rarely benefits a single SCADA segment. It usually reflects a broader shared infrastructure requirement rather than the SCADA traffic itself.

Can a Data Diode Be Bypassed or Hacked?

A properly implemented hardware data diode is extremely difficult to bypass because it has no software interface to exploit. Risk increases only with poor implementation, such as software components layered on top of the diode. Side-channel attacks against adjacent systems, rather than the diode itself, are the more realistic threat.

Build Your OT Segmentation Architecture With Network Critical

Choosing the right data diode protects the one boundary your SCADA operators cannot afford to get wrong. Network Critical's approach folds diode enforcement into the same hardware already handling TAP access and packet broker traffic. You are not left managing a separate unidirectional appliance alongside your existing visibility stack.

That single-chassis model reflects the same hybrid architecture behind the SmartNA-XL. It combines TAP and packet broker functions for space-constrained OT and edge environments. Perpetual licensing means no recurring subscription cost as your segmentation footprint grows across multiple sites. Speak to the Network Critical team to walk through where diode enforcement fits into your SCADA segmentation plan.