Five categories. One honest matrix.
This compares SILDA against the categories of platforms it's most often evaluated alongside, not any single named product, capabilities shift release to release, and pinning a claim to one vendor's snapshot goes stale fast. YES means full native support, Partial means limited or third-party-dependent, No means the feature is absent. Where SILDA falls short, we say so.
| Capability | IT App-Delivery Platforms(typical) | Converged IT/OT Perimeter Platform(typical) | OT Visibility Platform A(typical) | OT Visibility Platform B(typical) | OT Threat-Intel Platform(typical) | SILDA v2.0 |
|---|---|---|---|---|---|---|
| Layer 7 reverse proxy | YES | Partial | No | No | No | YES |
| Full session termination & re-origination (Break-and-Inspect) | No | Partial | No | No | No | YES |
| Purdue Level 3.5 native positioning | No | Partial | YES | YES | Partial | YES |
| OT protocol port / device fingerprinting | No | YES | YES | YES | YES | YES |
| Native industrial protocol frame parsing (Modbus, S7, DNP3, OPC-UA) | No | YES | YES | YES | YES | Roadmap |
| Per-asset behavioural AI models | No | Partial | YES | YES | YES | YES |
| OT device registry & auto-discovery | No | YES | YES | YES | YES | YES |
| Real-time enforcement / blocking | YES | YES | Partial | Partial | No | YES |
| Virtual patching for legacy OT (no reboot needed) | No | YES | No | No | No | YES |
| Shadow / observe-only mode before enforcement | Partial | YES | YES | YES | YES | YES |
| SHA-256 cryptographic forensic chain | No | No | No | No | No | YES |
| Ed25519 cryptographic attestation, per event | No | No | No | No | No | YES |
| Financial ROI per blocked event | No | No | No | No | No | YES |
| Built-in OT traffic simulator (demo / training / testing) | No | No | No | No | No | YES |
| Sector templates with pre-loaded device registries | No | No | Partial | Partial | Partial | YES |
| SIEM integration (common platforms) | YES | YES | YES | YES | YES | YES |
| Privileged remote access / vendor PAM | No | Partial | YES | No | No | YES |
| Compliance evidence export (NIST / IEC 62443 / NERC CIP) | No | Partial | YES | YES | YES | YES |
| Privacy-preserving federated learning (multi-site) | No | No | No | No | No | YES |
| On-prem agentic investigation, no LLM data egress | No | No | Partial | No | No | YES |
| Fully open & auditable source | No | No | No | No | No | YES |
| Deployment model | Cloud / On-Prem Appliance | Appliance / Cloud | SaaS / On-Prem | Appliance / Cloud | Appliance / Cloud | On-Prem Software |
| Pricing model | Per-device / per-seat license | License + subscription | Per-asset SaaS subscription | Per-sensor subscription | Per-asset subscription | Open source / commercial |
| Requires vendor appliance or SaaS subscription | YES | YES | YES | YES | YES | No |
Categories reflect publicly documented capabilities typical of each platform type as of the most recent product review, not any single named vendor's current release. We keep "Roadmap" honest rather than inflating it to YES, deep OT protocol frame parsing (Modbus/S7/DNP3) is currently covered at the network layer by the Go proxy's WAF and virtual-patching engine, not by native packet decoding.
SILDA is the only platform in this comparison that simultaneously delivers Level 3.5 Break-and-Inspect mediation, agile per-asset AI anomaly detection, a SHA-256 + Ed25519 cryptographic forensic chain, financial ROI per event, virtual patching, privacy-preserving federated learning, and an on-prem agentic investigation engine with no LLM data egress, as self-installing software, with no appliance, no subscription lock-in, and no cloud dependency required. Every category benchmarked here typically requires professional deployment, a dedicated appliance, or a SaaS subscription running $50,000+ annually per site.