When the diode isn't enough.
Replace it without losing isolation.
Modern OT operations need RDP to SCADA, SSH to production systems, real-time APIs, and controlled vendor access. truePass Gravity delivers all of it - under the same isolation principle that diodes were built to enforce.
Why it works.
Three signs your diode is being pushed beyond its design.
If you're seeing one or more of these in your environment - operational pressure has already outgrown what the diode was built for.
Workarounds are appearing
Engineers tunnel sessions through bastion hosts. Vendors get permanent VPN access. Files move via USB sticks because the diode-MFT path is too slow. The very isolation the diode was meant to enforce is being eroded by everyday operational pressure.
Point products are stacking up
A diode for one-way transfer. A proxy for SMB. A TCP connector for one API. A bastion for SSH. Each addition has its own console, its own logs, its own policy model. Unified security oversight becomes impossible.
Audit and compliance break down
Regulators ask "who accessed this SCADA console at 03:14?" The answer requires correlating five different log sources, two of which don't capture user identity. Per-request policy enforcement is missing where it's needed most.
A physical data diode is not Zero Trust compliant. It enforces direction at the wire, but it can't verify identity, apply per-request policy, or produce a unified audit trail - the controls Zero Trust requires. Bolting point products around it doesn't close that gap; it widens the attack surface.
One platform. Three layers.
Same isolation principle.
truePass Gravity replaces the patchwork of point products around your diode boundary with a unified software platform. It enables interactive operational connectivity - RDP, SSH, HTTP, Web Services, API, CIFS/ SMB - while preserving the core architectural principle: OT-initiated outbound communication only. No inbound ports. Ever.
Where a physical diode controls direction at the wire level, Gravity controls connectivity at the identity, policy, and audit level - extending isolation from a single boundary point to your entire operational envelope.
From identity check to audited session.
Identity verification
User authenticates with Active Directory, MFA, and device posture check. No identity → no access. Period.
Outbound from OT
The Access Controller inside your OT network initiates an outbound 443 TLS connection to the Gateway in the DMZ. No inbound firewall rules.
Per-request policy
Every session, every file action, every API call evaluated against policy in real time. Least-privilege by default. Time-limited by design.
Unified audit trail
Single audit log for every action. Exported natively to Syslog, SIEM, and SOC platforms. One source of truth for compliance.
Three modules. One unified deployment.
Replacing the diode is enforced through truePass Gravity, with Grid and Guard covering what happens once data and users are inside the protected zone.
The flagship module for this scenario - a software-defined diode that keeps the separation a hardware appliance provides while adding the interactive protocols it cannot carry.
Prevents lateral movement inside the OT zone once access is granted — identity-based segmentation so a single crossing never becomes a path to everything.
Governs file workflows moving between IT and OT, sanitising every inbound file before it lands on a production system.
Real scenarios. Real environments.
These are the operational situations where teams have already moved from physical diodes to truePass Gravity.
Operators access engineering workstations and SCADA consoles via RDP from corporate or external networks. Per-session MFA. Clipboard, printer, and port controls. Full session recording. No VPN tunnels into OT. No exposed RDP gateways.
Equipment vendors access specific PLCs or controllers for scoped maintenance windows. Time-limited access. Per-user identity. Full audit. The vendor never gets network-level access - only what's needed, when it's needed.
Real-time API integrations between OT and IT zones - for production analytics, predictive maintenance, ERP integration. Bidirectional where business requires; unidirectional where security requires. Always under one policy.
Configuration files, firmware updates, engineering documents moving between zones pass through CDR sanitization, identity verification, and policy enforcement. No more USB sticks. No more uncontrolled FTP.
What changes when you make the shift.
Per-user accountability
Every action tied to identity, not just IP.
Unified audit
One log. One policy. One console.
Interactive connectivity
RDP, SSH, HTTP, API, SMB - no more workarounds.
Same isolation principle
Outbound-only, no inbound ports. Ever.
No infrastructure changes
No firewall rewrites. No re-architecture.
Compliance ready
NIST 800-82, IEC 62443, NERC CIP - out of the box.
Industries where this transition matters most.
Replace your diodes
without losing isolation.
A 30-minute consultation with our security architects. We'll map your current diode-and-point-product setup, identify what Gravity replaces and what it complements, and propose a tailored Proof of Concept.