Architecture

Safetybits splits into two components: the sensor, which runs where your OT network is, and the console, where you view and act on what it finds.

The sensor

The sensor sits on a mirrored port of your network switch, watching traffic without ever injecting packets into it. It discovers devices, evaluates detection rules against the traffic it sees, and builds a statistical baseline of normal behaviour for each device. See Discovery and the inventory and Baselines and anomaly detection for how that works.

The console

The console is where discovery results, alerts, and baseline statistics land. It runs the compliance evaluation, matches resources against vulnerability feeds, and aggregates data across every facility your account can see. It is also where you configure rules, benchmarks, users, and integrations.

    graph LR
    subgraph Facility
        OT[OT / IT network]
        Sensor[Sensor]
        OT -->|mirrored traffic| Sensor
    end
    subgraph Console["Safetybits Cloud"]
        UI[Console]
    end
    Sensor -->|gRPC, TLS| UI
    You[You] -->|browser, HTTPS| UI
  

One console can receive data from sensors in more than one facility, which is what lets an organization with several plants work from a single pane of glass.

SaaS versus on-prem

In a SaaS deployment, the sensor is the only thing that runs in your facility. The console runs in the Safetybits cloud, and the sensor reaches it outbound over gRPC.

    graph LR
    subgraph Facility1["Your facility"]
        Sensor1[Sensor]
    end
    subgraph Cloud["Safetybits Cloud"]
        Console1[Console]
    end
    Sensor1 -->|gRPC, TLS, outbound| Console1
    You1[You] -->|browser, HTTPS| Console1
  

In an on-prem deployment, the console runs on your own IT infrastructure, separate from the sensor and from any single plant’s OT network. It can receive data from sensors across several plants at once, so a multi-site operator does not need a console per site. The console’s only outbound connection is to your identity provider, for login.

    graph LR
    subgraph Facility2["Plant 1"]
        Sensor2[Sensor]
    end
    subgraph Facility3["Plant 2"]
        Sensor3[Sensor]
    end
    subgraph Facility4["Plant 3"]
        Sensor4[Sensor]
    end
    subgraph IT["Your IT infrastructure"]
        Console2[Console]
    end
    subgraph Identity["Identity provider"]
        IDP[IDP]
    end
    Sensor2 -->|gRPC, TLS| Console2
    Sensor3 -->|gRPC, TLS| Console2
    Sensor4 -->|gRPC, TLS| Console2
    You2[You] -->|browser, HTTPS| Console2
    Console2 -.->|outbound, login only| IDP
  

What crosses the boundary

In both layouts, the sensor sends discovery results, flow summaries, alerts, and baseline statistics to the console. It does not stream a full copy of your network traffic; raw packet captures upload only when you or a rule’s response action asks for one. See Data handling and trust for the full picture, including encryption and sensor privileges.