A Waterfall gateway does not replace an OT segmentation program

Place the gateway on one named trust boundary

Waterfall’s product record describes a physical one-way communication constraint paired with software replication. In a defined architecture, that model can move selected OT data toward an external network without using the same gateway path for return traffic. The decision still begins with the industrial process, source and destination zones, data owner, protocol, update need, latency, availability, failure state, and consequence if information is missing, delayed, altered, or exposed.

A segmentation program covers more than that conduit. Asset owners must identify every zone, interconnection, identity, service dependency, vendor-access path, removable-media path, wireless link, maintenance route, safety interaction, monitoring point, emergency need, and recovery path within the approved scope. A one-way gateway can be an important control at one boundary without becoming evidence that unmodeled or temporary paths are absent.

Separate provider documentation from configured behavior

The official page states that gateway software replicates databases and emulates protocol servers and devices. It also presents architectures with different form factors, interfaces, throughput, high-availability, connectors, software, and certification attributes. Those are provider-documented capabilities. Buyers still need the exact product, hardware, software version, licensed connectors, protocol behavior, source and replica objects, timing, buffering, storage, administration model, support boundary, and acceptance criteria proposed for the site.

A safe evaluation should use an authorized non-production or otherwise controlled environment and qualified engineering review. Evidence should show normal replication, loss of source or destination service, stale data, malformed or unsupported data, capacity constraints, recovery, alarm handling, configuration change, time synchronization, and export of the audit record. OT Defense Review has not independently tested the product, so deployment safety, performance, connector fidelity, and operational fit are not established.

Keep return paths and operational exceptions explicit

One-way data export does not remove every business need for information to enter an OT environment. Production orders, engineering changes, patches, signatures, time, identity material, antivirus updates, and vendor maintenance may require separate controlled workflows. The product page itself discusses other mechanisms and variations for scheduled updates or emergency access. Those are distinct architectures and should never be treated as properties of the ordinary outward path without an exact design and authorization record.

The program record should identify which inbound need is allowed, prohibited, deferred, or handled through another process; who approves it; which system validates it; how safety and reliability are protected; and how the organization recovers from failure. This article does not prescribe a transfer, bypass, remote-access, patching, or isolation procedure. Any live-system change requires site authorization, engineering and safety review, vendor coordination where applicable, change control, qualified personnel, and a tested recovery plan.

Test the segmentation program beyond the product boundary

A defensible architecture review asks whether the complete set of controls supports the physical mission. It should trace asset identity, zone assignment, conduit purpose, allowed data, identity and administration, monitoring, exception handling, alternate routes, maintenance, incident response, backups, recovery, and evidence retention. Firewalls, unidirectional gateways, secure-access systems, endpoint controls, procedures, and operating roles can complement one another; none should inherit assurance from another by association.

Waterfall makes strong security and compliance statements on its product page. OT Defense Review records those statements as official provider positioning, not independent proof that a facility is secure, safely segmented, compliant, or resilient. The current public record does not establish the reader’s topology, threat paths, purchased package, configuration, protocol coverage, operational test results, standards applicability, or residual risk. Those unknowns belong in the buyer’s engineering and assurance record.

Enterprise buyer test

Translate this change into the exact population, record type, workflow stage, decision owner, effective date, and evidence that could be affected. Ask current or prospective providers to demonstrate the named workflow with representative data and an exception—not a polished feature tour. Record what official documentation establishes, what a provider states, what the team observes, and what remains unresolved.

A defensible review also identifies the dependency outside the product. Authority interpretation, policy configuration, data quality, integrations, human judgment, approval rights, release governance, training, and retained evidence may remain customer or service responsibilities. The evaluation should preserve those boundaries instead of treating a technology claim as the complete operating model.

What we will watch next

OT Defense Review will watch the named source and affected market records for later evidence that changes status, scope, availability, implementation timing, workflow consequence, or the limits of the initial report. A later announcement does not silently overwrite this dated account; the change ledger preserves the sequence.