BlastShield is BlastWave’s Zero Trust network access solution for OT environments. It uses a software-defined perimeter approach to help organizations reduce risk from stolen credentials, simplify access control, cloak critical systems, secure remote access, and segment OT networks.

How does BlastShield help stop OT attacks before they start?

BlastShield helps stop OT attacks before they start by requiring authentication and authorization before users or devices can access protected systems. It combines network cloaking, phishing-resistant access, secure remote connectivity, and software-defined segmentation to reduce exposure and limit lateral movement.

What is the BlastShield Security Gateway?

The BlastShield Security Gateway is a hardware-independent software package that can be installed in a VM, container, or pre-installed appliance. It delivers network cloaking, terminates secure remote access connections, and uses software-defined segmentation to secure OT networks.

What is the BlastShield Client?

The BlastShield Client is a Zero Trust client for secure OT connectivity. It supports Windows, Mac, and Linux, allowing authorized users to connect securely to approved OT systems without disrupting existing operations.

What is the BlastShield Authenticator?

The BlastShield Authenticator provides passwordless authentication using a QR code challenge-response, localized biometric authentication, and the device keystore. It is designed to prevent credential theft, phishing, and AI-powered attacks while keeping a human in the loop.

BlastAccess is BlastWave’s secure remote desktop connectivity solution. It provides high-performance remote access with session recording, while removing open ports and reducing risks from browser hijacking, password theft, PAM weaknesses, and web-based RDP exposure.

What does the BlastShield Agent do?

The BlastShield Agent helps secure servers by requiring a verified BlastShield client before a connection can be made. It supports Windows, Mac, and Linux and helps turn protected servers into Zero Trust-controlled assets.

What does the BlastShield Orchestrator do?

The BlastShield Orchestrator manages real-time policy enforcement across the network. It can be deployed on-premises or in the cloud and helps ensure users and devices connect only to the systems they are authorized to access.

How does BlastShield support network cloaking?

BlastShield supports network cloaking by requiring users and devices to authenticate and authorize before access is granted. This helps make protected systems non-discoverable to unauthorized users and reduces the value of reconnaissance.

How does BlastShield support OT network segmentation?

BlastShield supports OT network segmentation through software-defined access controls that divide the network into isolated segments. This limits lateral movement and helps contain the impact of a breach.

Vulnerability Disclosure Policy

Security

Vulnerability Disclosure Policy

BlastWave protects operational technology that water utilities, energy providers, and manufacturers depend on. We welcome reports from security researchers, customers, and partners who find vulnerabilities in our products, and we work with reporters to fix issues and disclose them responsibly.

Report a Vulnerability Security Advisories

This policy explains what is in scope, how to report, what you can expect from us, and the protections we extend to researchers acting in good faith.

Scope

How to report

What to expect

Guidelines

Safe harbor

CVEs and advisories

Scope

This policy covers vulnerabilities in products and services developed and maintained by BlastWave, Inc.

In scope

BlastShield software, including gateways, BlastAccess, agents, the orchestrator, authenticator, and client applications
BlastWave-hosted management services and APIs
Current and supported prior releases of the above

Out of scope

Third-party products, including OT and ICS equipment that BlastShield protects. Report those to the vendor or to CISA (see below).
Customer networks, sites, and systems. Never test a customer environment.
BlastWave marketing websites, unless the issue exposes customer data or product infrastructure
Denial-of-service testing, social engineering, and physical attacks against BlastWave staff or facilities
Findings without a demonstrated security impact, such as missing headers or version banners alone

If you find a vulnerability in third-party ICS or OT equipment, you can report it through CISA's coordinated vulnerability disclosure process.

How to Report a Vulnerability

Email security@blastwave.com. Encrypt sensitive details with our PGP key (fingerprint: 7240 BC23 4C7D DCAB F296 B7F8 701D 646F 9F0F E18C).

A useful report includes:

The affected product, component, and version
A description of the vulnerability and its potential impact
Step-by-step instructions to reproduce it, plus any proof-of-concept code
Your configuration or test environment
How you would like to be credited, if at all

Segment Flat Networks to isolate critical OT functions within BlastShield deployments.

You may report anonymously. Please do not include customer data, credentials, or other sensitive information you may have encountered beyond what is needed to demonstrate the issue.

What to Expect From Us

We aim to meet these timelines:

Step

Target

Acknowledge your report

Within 3 business days

Initial assessment and severity rating

Within 10 business days

Status updates while we work on a fix

At least every 30 days

Fix and coordinated public disclosure

Within 90 days of the report

We rate severity using CVSS and prioritize issues that could affect the safety or availability of operational environments. If a fix needs more than 90 days, for example because customers must schedule changes in plant maintenance windows, we will explain why and agree on a revised date with you.

We ask that you keep vulnerability details confidential until we publish an advisory or the agreed disclosure date passes. If we stop responding, you may escalate to CISA.

Guidelines for Researchers

Our products protect physical processes, so testing must never put real operations at risk. When researching BlastWave products:

Test only in your own lab or environments you own, or with BlastWave's written permission
Never test against production systems, customer sites, or live industrial processes
Access, modify, or delete only data you own, and stop as soon as you confirm the issue
Do not degrade service, run denial-of-service attacks, or use automated scanning against BlastWave-hosted services
Give us reasonable time to fix the issue before sharing details with anyone else
Do not demand payment or other compensation in exchange for disclosure

If you are unsure whether an activity is allowed, ask us at security@blastwave.com before you start.

Safe Harbor

If you make a good-faith effort to follow this policy, BlastWave considers your research authorized. We will not pursue or support legal action against you for it, including claims under the Computer Fraud and Abuse Act, the DMCA's anti-circumvention provisions, or our license terms, to the extent they would otherwise restrict the research.

If a third party brings legal action against you for research conducted under this policy, we will make it known that your actions were authorized. This safe harbor does not cover activity that violates the guidelines above, causes harm to customers or operations, or breaks laws other than those named here.

CVE Assignment and Security Advisories

BlastWave publishes security advisories for confirmed vulnerabilities at blastwave.com/security/advisories. Each advisory lists affected versions, severity, remediation steps, and credit to the reporter if they wish.

We request CVE IDs for qualifying vulnerabilities in our products. We also share advisories with CISA so affected critical infrastructure operators are notified.

Recognition and Policy Updates

We credit reporters by name or handle in our advisories unless they ask us not to. BlastWave does not currently run a paid bug bounty program.

We may update this policy over time. The revision history below shows the latest change.

Version

Date

Change

1.0

October 25, 2026

Initial policy

Questions about this policy: security@blastwave.com

Vulnerability Disclosure Policy

What is BlastShield?

Scope

How to report

What to expect

Guidelines

Safe harbor

CVEs and advisories

Scope

In scope

Out of scope

How to Report a Vulnerability

What to Expect From Us

Guidelines for Researchers

Safe Harbor

CVE Assignment and Security Advisories

Recognition and Policy Updates

Getting started with BlastShield is easy and free.