Why Four differentiators
We built our platform from the ground up with security, reliability, and simplicity as core design principles.
01 Differentiator #1
Across the publicly reported attacks on US water systems, nobody defeated sophisticated protections. Attackers found controllers reachable from the public internet, used passwords that were still the factory default or shared across a crew, and logged in through consumer remote-access software with no second factor.
Every one of those is a property of the architecture as much as of the utility. You can harden a conventional system a long way, and you should, but hardening cannot change what the system fundamentally is. Our platform removes the property instead of patching the instance.
01 / 05
Field devices open connections outward to the platform and keep them open. Nothing at your utility listens for inbound connections: no port to forward, no service waiting for a login attempt, no address that answers a probe. A scanner sweeping the internet finds nothing to talk to.
02 / 05
Traffic between your sites and the platform travels inside TLS, and the message itself is encrypted a second time with a per-device key. It cannot be switched off. That is the direct answer to unencrypted radio, where somebody within a few miles can listen to your telemetry and send commands your controllers accept as genuine.
03 / 05
Each device holds a certificate issued when it is deployed. It is never typed, never spoken, and never travels in a form anybody could reuse. There are no default device passwords to leave unchanged, and revoking access for a departing employee is an administrative action that takes effect immediately, not a trip to every site.
04 / 05
No USB. No Bluetooth. No Wi-Fi. Where a controller does have a port, like the Ethernet ports on the Nexus.io AC, it is locked down. Cut the padlock at a remote site, open the panel and plug in a laptop, and you get nothing without a valid certificate issued for that system. The lock stops being the only control.
05 / 05
Everyone gets their own login with role-based permissions; shared crew accounts are not needed to make it work. Every action is written to an audit trail, so you can answer who changed what, and when.
Nothing listening. Nothing that trusts a stranger. Nothing to steal and reuse.
Outbound-only connectionsCertificate-only local portsRevocable certificates
Secure By Design, applied
The problems a security audit typically turns up at a water system, and what each one becomes under this architecture.
| Typical audit finding |  Under this architecture |
|---|---|
| Equipment reachable from the internet | Nothing listens, so there is nothing to find by scanning |
| Default passwords on controllers or radios | No device passwords to leave at their default |
| One shared login the whole crew uses | Per-person credentials; shared logins are not needed to make it work |
| Access still active for somebody who left | Revoke that person’s credential; device credentials are unaffected |
| Remote-access software with no second factor | No inbound remote-access tool; access is through the platform, per person |
| Unencrypted radio between sites | Encrypted cellular; interception yields nothing usable |
| A panel anyone could open and plug into | No USB, Bluetooth or Wi-Fi, and Ethernet ports accept certificate-holding devices only; the lock stops being the only control |
| Equipment that no longer receives firmware updates | Supported equipment that updates itself, remotely, as fixes are released |
| Nobody has tested a backup in years | Configuration and programs are retained centrally and continuously |
Don’t know which of these apply to you? That is what the self-audit workbook below is for.
Honest by design
No architecture removes the need to do a few things well: phishing awareness, your business network and billing systems, physical protection of the equipment, and an emergency plan that lets you run manually. We would rather say so than pretend otherwise.
Help your staff recognize suspicious emails, links and calls. People are still a target.
Office computers, billing and email systems need their own protection, separate from SCADA.
Fences, locks and site checks still matter for pumps, tanks and treatment equipment.
Know how your crew will run the system by hand, and practice it before you ever need it.
Free resources
Two workbooks for water systems, written to be useful whether or not you ever buy anything from us. Neither one names a product, including ours.
Start here
A guided walkthrough that finds the problems which cause real incidents: how people log in from outside, the passwords on your equipment, and what protects your unmanned sites. You do it yourself, at your own pace, with no special tools and no IT background. Everything in it is looking, reading and writing down, never probing or changing, so nothing in it can take your plant down.
Then this
Some audit findings cannot be fixed with a setting change. This guide is about those. It explains what cloud SCADA actually is, why hardening has a ceiling, and how to specify and buy a system so that what you get is genuinely secure rather than merely modern, including the ten requirements to write into your bid and the red flags to watch for in the answers.
Download PDF PDFBoth documents are free to use, copy and share within your utility and with other water systems. All security guides, including the Engineer Edition →
02 Differentiator #2
Traditional SCADA systems require a programmer to configure each device. When a device fails, you need to schedule a site visit, bring a laptop, and spend hours reconfiguring the replacement. Our platform eliminates this problem entirely.
03 Differentiator #3
Traditional SCADA requires purchasing PLCs, RTUs, radios, and software from multiple vendors, then paying an integrator to make it all work together. Our integrated approach dramatically reduces total cost.
Hardware, software, connectivity, and support all from one vendor. No integrators needed. No finger-pointing when something goes wrong.
Every device comes with a 2-year warranty, extended for as long as you keep the Uptime Plan. If it fails, we replace it.
We guarantee parts availability for 20 years. Your investment is protected for the long term.
Prefer an operating expense to a capital purchase? See the Flex Plan →
04 Differentiator #4
When you call D6 Labs, you’re talking to the engineers who design and build our products. We don’t outsource manufacturing. We don’t outsource support.
Designed, built and supported in Oklahoma City
Side by side
| Feature | D6 Labs | Traditional SCADA |
|---|---|---|
| Security architecture | Outbound-only connections | Open ports and VPNs |
| Device credentials | Revocable certificates | Shared passwords |
| Device replacement | Hot-swap, config from the cloud | Reprogramming |
| Warranty | 2 years, extended with the Uptime Plan | 1–3 years |
| Integration required | None | Expensive integrator |
| Support | Direct from engineers | Multiple vendors |
| Data storage | 1 year included | Limited or extra cost |
Get started
Talk to our team about your specific application and see how D6 Labs can help.
