Critical Infrastructure Beta · Security Platform

Air-gapped, hardware-bound, out-of-band cordon.

Energy, water, transport, telecom, and the IT-side of every OT environment operate inside an audit perimeter that doesn't tolerate downtime. Tessarac is designing an air-gapped install, hardware-bound TPM agent identity, and out-of-band cordon so you can run security without giving up operational independence.

Not available yet. This page describes the Security Platform we are building; ACOG is the product you can use today.

Talk to us See what's available now

Regulatory posture

NIST 800-82 + NERC CIP + TSA SD + sector-specific.

Critical infrastructure maps to NIST SP 800-82 (Industrial Control Systems Security), NERC CIP for the bulk electric system, TSA Security Directives for pipeline and rail, plus sector-specific guidance from CISA, the EPA (water), and the FCC (telecom). Tessarac's per-tenant compliance presets are designed to configure these baselines and collect the evidence.

  • NIST SP 800-82 — designed for Industrial Control Systems security on the IT side of OT environments
  • NERC CIP-005 / CIP-007 / CIP-010 — electronic security perimeter, system security management, configuration change management evidence
  • TSA Security Directives — pipeline and rail cybersecurity baselines
  • CISA Cross-Sector Cybersecurity Performance Goals (CPGs) — control mapping planned
  • Air-gapped install — a Federal-plan offline bundle is planned for sovereign and OT-adjacent deployments

The critical-infrastructure deployment

Designed for air-gapped install, hardware-bound agent identity, an out-of-band cordon backstop, and a deployment shape that respects operational availability requirements.

  • Air-gapped install

    Planned for the Federal plan: an offline bundle with no outbound network required during install or operation, and updates as signed offline bundles you verify before applying.

  • Hardware-bound TPM identity

    Sentinel's ECDSA P-384 keypair is generated inside the workstation's TPM — private half never leaves hardware. Defeats the credential-extraction class of attack against ICS-adjacent IT operators.

  • Out-of-band cordon backstop

    If the agent is compromised, the control plane cordons via cloud / network APIs (security group, firewall rule, identity lockout) so isolation works even when the host can no longer be trusted. Critical for OT-adjacent fleets.

  • Tamper-evident audit

    Hash-chained audit log — verify the chain from any starting block to any ending block. Export to your existing historian, SIEM, or to a syslog destination. Customer opt-out of Tessarac retention entirely — operationally-sensitive data never leaves the boundary.

Why this is different from commercial SaaS

Operational availability comes first. Security ships around it.

In commercial SaaS, security can hold a deploy. In critical infrastructure, security has to fit between the deploy windows. Tessarac is designed to operate inside availability budgets that don't bend — air-gapped, low-footprint, out-of-band cordon, and a control plane that can be paused without breaking the data plane.

  • Sentinel's < 100MB RAM and < 1% CPU steady-state footprint fits inside ICS-adjacent workstation budgets
  • Sentinel operates fully on local rules + signatures while disconnected; reconciles when connectivity returns — air-gap-friendly by design
  • Out-of-band cordon decouples isolation from the agent's runtime trust

Talk to a Tessarac critical-infrastructure architect

The Security Platform is in beta. Design partners help shape the OT-adjacent deployment.

Get a demo Read the docs