Radiflow iSID

Radiflow iSID is a paid OT security platform for industrial networks and critical infrastructure. It is best suited to operators, utilities, and managed security providers that need passive visibility across plants or remote sites. Its strongest case is non-disruptive asset and behavior monitoring with centralized oversight; custom pricing and Chrome browser access make it less suitable for teams seeking a self-service purchase or broad browser choice.

Overview

iSID observes mirrored network traffic rather than actively probing production systems. Its deep packet inspection discovers OT assets, records their roles and impact on the environment, and builds an inventory that can give security teams a practical map of industrial communications. This passive approach is appropriate where scanning could interfere with operations, provided the deployment can supply suitable mirrored traffic.

The platform learns normal network, asset, and communication behavior and continuously looks for deviations. It also monitors configuration changes in PLCs and other network devices. Together, these functions cover both gradual changes in operational patterns and direct changes to important equipment, rather than limiting monitoring to a conventional IT endpoint view.

Key features

• Passive OT asset discovery: Automatic inventory includes asset roles and environmental impact, helping teams prioritize systems instead of treating every discovered device alike.
• Behavior baselining: Learned communication and asset patterns provide a reference for spotting anomalies. This is useful for environments where normal traffic is highly specialized, although the quality of alerts depends on the baseline formed from observed activity.
• Non-disruptive DPI: Analysis of mirrored traffic avoids inserting the product into live communications, a meaningful advantage for sensitive industrial processes.
• PLC and device-change monitoring: Continuous observation of configuration changes can expose unauthorized or unexpected modifications in PLCs and other network devices.
• Threat and vulnerability detection: iSID combines threat intelligence, SNORT-based signatures, common attack signatures, and CVE mapping. That mix addresses both known indicators and vulnerability-related anomalies, rather than relying on behavioral detection alone.
• Supported OT protocols: Modbus, CIP, DNP3, and IEC 104 are supported, covering common industrial and utility communications.
• Deployment choices: Organizations can centralize collection with iSAP Smart Collectors, place monitoring at remote sites, or combine central and local arrangements. The flexibility is relevant to distributed infrastructure, but the right design will depend on site connectivity and operational topology.
• Central management and integrations: iCEN supplies enterprise-wide and site-specific web views while managing multiple iSID instances. A pxGrid-certified Cisco Identity Services Engine integration shares OT asset context and supports Adaptive Network Control quarantine policies, giving Cisco environments a path from detection to containment.
• MSSP administration: iCEN supports multiple customers with client-based view permissions. That separation makes the platform applicable to service providers, not only a single industrial owner.
• Signature handling: Digitally signed signature files, SHA-256 hashes, quarterly email notices for current customers, and support-site downloads provide a defined update process.

Pricing

iSID uses paid, custom pricing. The Contact Radiflow plan has no published price; prospective customers must request a demo or contact Radiflow. That model fits industrial organizations that need deployment and site requirements assessed together, but it prevents a quick cost comparison and offers no stated free tier or trial terms.

Because pricing is not itemized by seats, sites, traffic volume, or other quotas, buyers should obtain a proposal that spells out the licensing scope, collector and iSID-instance counts, support, and renewal conditions. There is no cheaper published plan to trade features against cost, so smaller teams cannot use a lower tier to validate fit before committing.

Platforms

iSID is offered as self-hosted software with web access. The iSID 6.0 user guide specifies Google Chrome for browser management, so organizations should standardize on Chrome for administration. Central, local, or mixed deployment supports multi-site industrial estates and remote facilities, while iCEN provides the unified management layer.

Who it's for

Radiflow positions iSID for industrial enterprises, utilities, and critical-infrastructure operators. It is a strong fit for teams responsible for OT asset inventory, passive network monitoring, and anomaly investigation across multiple locations. MSSPs can also benefit from multi-customer management and permission-based separation. Organizations without mirrored traffic, those wanting a SaaS-first service, or buyers who need transparent entry pricing should look elsewhere.

Pros and cons

Pros

• Passive, non-disruptive visibility: Mirrored-traffic DPI reduces operational interference while still building an OT inventory.
• Combines context and detection: Asset roles, behavioral baselines, PLC-change monitoring, signatures, threat intelligence, and CVE mapping support layered investigation.
• Built for distributed operations: Central, local, and hybrid deployment plus iCEN multi-instance management suit multi-site infrastructure.
• Useful Cisco workflow: pxGrid asset context and quarantine policies connect OT findings with Cisco ISE controls.
• MSSP separation: Client-based view permissions support managed services with multiple customers.

Cons

• Custom pricing only: No published price, free plan, or trial makes budgeting and low-risk evaluation harder.
• Chrome-specific administration: Browser management centered on Google Chrome may constrain organizations with different browser standards.
• Traffic-visibility dependency: Passive discovery and baselining require appropriately mirrored network traffic, which can add deployment planning.
• Self-hosted responsibility: Teams must plan the infrastructure and operations associated with a self-hosted deployment.

Alternatives

Nozomi Networks Platform is the better starting point for buyers wanting API, Linux, self-hosted, and web options plus a free Nozomi Vantage SaaS plan used to license hardware and Guardian nodes.

EmberOT suits a narrower, low-cost evaluation need: its free OT PCAP Analyzer provides PCAP device and protocol breakdown, with a valid school or business email required for download.

Honeywell Forge is worth considering when a broader Android, iOS, Linux, macOS, web, or Windows footprint matters and product-specific, term-based offerings are acceptable.

FactoryTalk Analytics is an alternative with API, Linux, web, and Windows platforms.

Kaspersky Industrial CyberSecurity Platform targets enterprise OT and IoT environments with Linux, web, and Windows support and demo-led sales.

OTDefend offers a tailored solution proposal and pricing for organizations that want a customized engagement.

Claroty CTD is the alternative to examine for federal OT cybersecurity controls, on-premises deployment, and mobile flyaway kits.

Claroty xDome is a modular SaaS option when web and API access and sales-based pricing align better with your architecture.

For a broader category comparison, see OT and ICS Security Monitoring Software.

Verdict

Choose Radiflow iSID if you operate industrial or utility sites and need passive OT asset context, behavioral anomaly detection, and centralized or MSSP-scale management without placing a monitor in the production path. Look elsewhere if you require published pricing, a free evaluation tier, SaaS-first delivery, or browser flexibility beyond Chrome.