An air gap is a policy, not a product. The question is who audits the gap.
OPSWAT and Waterfall both sell excellent hardware for the boundary of a disconnected network, and both publish more numbers than we do. Neither sells you the assurance that the boundary is still holding, which is the part most air-gapped estates actually get wrong.
Our off-grid work is assurance for systems already in service: isolated control rooms, remote sites and air-gapped enclaves that cannot depend on a live connection back to a vendor cloud. It is delivered by the same team that runs our defensive operations, on estates that are running now rather than in a lab.
Side by side
| Attribute | Represented by UnstratOff-grid cybersecurity | OPSWATMetaDefender Kiosk Tower 5123United States | Waterfall Security SolutionsUnidirectional Security Gateway WF-50045Israel |
|---|---|---|---|
| What you actually buy14One is a service, two are boxes. A disconnected estate normally needs all three roles filled, from whichever suppliers can be sustained. | An assurance engagement for disconnected environments: isolated, air-gapped and remote systems assessed and defended without reliable connectivity | A removable-media security appliance that scans, sanitises and validates portable media before it is allowed into a secure network | A hardware gateway pair that replicates industrial servers out of an OT network while making a reverse connection physically impossible |
| Threat vector addressed14 | Not published as a vector list | Portable media entering the enclave: USB, memory cards, optical discs and 3.5 inch floppy, with malware, sensitive-data and file-based vulnerability checks | Network path out of the enclave: one-way replication so no packet, command or malware can travel back into the ICS network |
| Detection engines and published hit rate14 | Not published | 30+ anti-malware engines, stated to detect over 99% of known malware, plus Deep CDR file regeneration and data-loss redaction | Not published. The gateway enforces direction rather than inspecting content |
| Throughput14 | Not published | 17,000+ files per minute on the Tower 5 | 1 Gbps standard, multi-Gbps with several TX/RX pairs, with an optional high-availability configuration |
| Physical footprint134 | Not applicable. No appliance is sold | Tower 5 is 16.5 x 60.25 x 19.625 in and weighs 180 lb (81.6 kg); smaller Desktop, Mobile and Mini models are listed on the product page | TX and RX modules 0.8 kg each and a host module 1.2 kg; standard, compact and DIN-rail chassis at 2.5, 4 and 3 kg |
| Environmental range134 | Not published | Operating 0 to 35 °C, 10% to 90% humidity, on the Tower 5. The Mobile model is rated for a wider thermal range | Not published in the datasheet |
| Integration with what is already installed14 | Not published | Local, network or cloud storage, MetaDefender Managed File Transfer, NetWall and third-party data diodes; central management on-premises or in the cloud | 100+ commercial connectors covering historians, SCADA protocols, enterprise monitoring, file transfer and antivirus and WSUS update flows, with no customisation fee stated |
| Certification claimed14 | Not published | FCC Class A, CE, RoHS, UKCA, UL, WEEE and Common Criteria EAL4+ | Not published in the datasheet, which cites US patents 8,223,205 and 7,649,452 |
| Regulatory mapping offered24 | Not published | Deployment guide maps Kiosk use to NERC CIP-010-2 R4 transient cyber asset and removable media requirements for electrical plants | Not published in the datasheet |
| Support model14 | One accountable team from first briefing through delivery and in-region sustainment | Four published tiers. Ticket response ranges from 12 business hours on Silver to 24 hours seven days a week on Platinum and Emerald; phone support only on the top two tiers | Not published in the datasheet |
| Origin and political exposure145 | Independent, non-aligned origin, with no political exposure to any major-power ecosystem | United States company. The Tower 5 datasheet lists the hardware country of origin as the UK | Israel. The company profile states headquarters in Israel with sales and support offices elsewhere |
Competitor values are quoted from the vendor documents listed under Sources, as published on the date shown. Configurations vary, so treat every row as a starting point for the evaluation rather than a like-for-like test result.
What the table means
Disconnected systems fail at the human boundary, not the wire
Waterfall's physics are not arguable. A laser that only transmits and a receiver that only receives cannot carry a return packet, and 1 Gbps of one-way replication with 100+ ready-made connectors solves the historian-to-enterprise problem properly. What neither a diode nor a kiosk can tell you is whether the enclave behind them has quietly grown a second modem, an engineer's laptop that spends alternate weeks on the corporate network, or a maintenance contract that requires a vendor's remote session once a quarter. That is the failure mode we are hired to find, and it is a review of people, process and configuration rather than a box on a wall.
Sustainment is different when the site has no connectivity
A kiosk is a Windows appliance with a signature-based scanning stack. Its value decays the moment media stops being updated, and OPSWAT's own support matrix puts phone access only on the upper tiers. A gateway needs its connectors maintained as the historians and SIEMs behind it change. Both models assume somebody visits, or that someone senior enough owns the update path. Our model is that the same team who assessed the enclave keeps returning to it, in region, without an offshore support queue between your engineer and an answer.
What we do not publish, and will not invent
OPSWAT and Waterfall publish detection rates, throughput, weights, temperature ranges and certification lists. We publish none of those for this service because it is not an appliance. Where a buyer needs a comparable figure, ask us for it in writing and we will either give it or say plainly that we do not hold it.
Questions buyers ask
How do you secure an air-gapped network without internet connectivity?
Three jobs have to be filled. Control what crosses the boundary on removable media, which is what an OPSWAT kiosk does with 30+ scanning engines and file regeneration. Make the network path one-way where data has to leave, which is what a Waterfall gateway does in hardware. Then verify, repeatedly, that the gap is still real. The third job is ours, and it is the one that gets skipped, because it is a service rather than a purchase order for a box.
Is a data diode better than a firewall for OT networks?
For traffic that only ever needs to travel outward, yes, and Waterfall's WF-500 makes the case cleanly: the transmit module contains a fibre laser and nothing else, so a reverse connection is not a policy decision that can be misconfigured. A firewall is a rule set, and rule sets drift. The honest limitation is that a diode does not solve two-way requirements, does not inspect content, and does not tell you what is happening inside the protected network.
What is the alternative to OPSWAT MetaDefender Kiosk for a government that cannot use a US supplier?
We are not a like-for-like replacement, and we will not pretend to be. OPSWAT ships a certified appliance with published scan rates and Common Criteria EAL4+; we ship assurance for disconnected estates. If the constraint is procurement rather than function, the practical route is to pair whatever media-control hardware your rules permit with an independent, non-aligned assurance partner who has no reporting line to a foreign government.
How often should an air-gapped system be reassessed?
More often than most operators do, because the gap is eroded by ordinary work rather than by attack: a vendor laptop, a temporary link for a commissioning window, a new remote-monitoring contract. We do not publish a fixed cadence. Set it against how frequently your site accepts external engineers, and treat every maintenance visit as a boundary event.
Sources
- 1. OPSWAT, MetaDefender Kiosk Tower 5: Removable Media Security Kiosk (datasheet, Rev. 2026-01) (copy held on this site)Retrieved: 2026-07-31 · Hardware, scanning-performance, media-port, certification and support-tier tables for the largest Kiosk model.
- 2. OPSWAT, MetaDefender Kiosk Deployment Guide (copy held on this site)Retrieved: 2026-07-31 · Recommended deployment for power plants, including the NERC CIP-010-2 R4 requirements the Kiosk is positioned against.
- 3. OPSWAT, MetaDefender Kiosk (product page)Retrieved: 2026-07-31 · HTML only. Lists the Kiosk range (Tower, Desktop, Mobile, Mini, Stand, App) and per-model scanning rates.
- 4. Waterfall Security Solutions, Unidirectional Security Gateway WF-500 (datasheet) (copy held on this site)Retrieved: 2026-07-31 · TX/RX architecture, throughput, connector catalogue and per-module dimensions and weights.
- 5. Waterfall Security Solutions, The Story of Waterfall Security & Unidirectional Gateway Technology (company profile) (copy held on this site)Retrieved: 2026-07-31 · States that the company's headquarters are in Israel, with sales and support offices elsewhere.