Nothing crosses the boundary
until SILDA decides.
Every OT session is fully terminated at the DMZ and re-originated only if it's clean. Agile per-asset AI scores it, a cryptographic ledger records it, and, if it's a threat, the plant keeps running while SILDA isolates the problem.
Simulated for demonstration, mirrors the real anomalies.jsonl schema written by every SILDA node.
One platform, five different reasons to care.
Stop guessing, start blocking
Per-asset AI, MITRE-mapped detections, a forensic chain that survives audit, see the Detection Authority.
Downtime avoided, in dollars
Every blocked event carries a calculated ROI. Run the calculator with your own sector and volume.
Three ways to connect it
Inline proxy, reverse proxy, or passive TAP, deploy against real OT gear without redesigning the network.
Sector templates, ready-made
Manufacturing, Water, Oil & Gas, Energy, pre-loaded device registries and downtime benchmarks.
The one level built specifically to sit between OT and IT.
The Purdue Enterprise Reference Architecture (ISA-95) splits an industrial network into six levels, Level 0 physical process up through Level 5 enterprise IT. Level 3.5, the Industrial DMZ, is where a break-and-inspect authority belongs: the one segment with a legitimate reason to see both zones. That's exactly where SILDA sits.
- 01Inline Proxy, OT devices route through SILDA:8080, full break-and-inspect on every session.
- 02Reverse Proxy, the MES server calls SILDA instead of the cloud directly. One URL changes.
- 03Passive TAP, SPAN/mirror port copy for monitor-only rollouts before you flip on enforcement.
One box, two NICs, and the only device with access to both zones. It's the sole path between them, so it's the only place a break-and-inspect decision can actually be enforced, not a claim, a consequence of where it physically sits.
See the full architecture →Six stages, every single session, no exceptions.
Six things no competitor ships together.
Passive monitors tell you something happened. SILDA decides, blocks, proves it cryptographically, and puts a dollar figure on what it just saved you.
Agile per-asset AI
river.HalfSpaceTrees scores every event in real time. One model instance per OT device, a PLC's 10 KB is normal, an HMI's 10 KB isn't.
Cryptographic forensic chain
Every entry SHA-256 linked to the one before it, Ed25519 signed. Tampering with any record breaks the chain and is instantly detectable.
Financial ROI per event
Every blocked event is priced against your sector's real downtime cost, avoided loss minus mitigation cost, logged and exportable.
Privacy-preserving federation
Multiple sites improve detection together via differentially-private FedAvg. Raw traffic and IPs never leave the site, only DP-noised statistics.
Agentic investigation
On every high-confidence block, a 7-tool agent perceives, plans, replans, and produces a severity-scored report, entirely on-prem, no data egress.
Self-installing package
Compiled binaries for six platforms. One command, or one double-click, starts everything and opens the browser, no Docker required.
Passive visibility is table stakes. Enforcement isn't.
Most of the OT security field is built to watch and report. SILDA is built to decide, it blocks inline, proves the decision cryptographically, and ships as self-installing software, not an appliance or a SaaS subscription.
See the full market position →| Capability | Typical OT security platform | SILDA |
|---|---|---|
| Real-time enforcement / blocking | Partial | Yes |
| Financial ROI per blocked event | No | Yes |
| SHA-256 + Ed25519 forensic chain | No | Yes |
| Privacy-preserving federated learning | No | Yes |
| Requires vendor appliance or SaaS | Yes | No |
“SILDA is the only platform in its category that simultaneously delivers Break-and-Inspect mediation, agile per-asset AI, a cryptographic forensic chain, financial ROI per event, and privacy-preserving federation, as self-installing software, with no appliance and no subscription lock-in required.” SILDA v2.0 market position summary