Zero Trust for the Machines Your Security Stack Can’t Secure
Faction puts Zero Trust protection at the local network boundary. Machines and devices behind it join your owner-controlled Faction Network: reachable by what you authorize, unreachable from the public Internet. No agents, no additional firewall to deploy or configure, no rip-and-replace.
- The InternetNo route in
- Your existing routerNever trusted
- Faction protectionAt your local
network boundary - Machines & devicesNothing installed
Faction Pods or Outposts sit behind your existing modem, router or other upstream gateway and never trust it. The machines and devices behind them join your Faction Network via secure tunnel, with keys created and controlled by you.
Agents, patching and segmentation fail for the machines and devices that matter most
Robots, CNC machines, PLCs, HMIs, cameras and sensors can’t run agents, often can’t be patched and rely on the router and firewall they are connected to for protection. If the routers and other networking hardware, or the smart hardware behind them, are vulnerable or compromised, the rest of the security stack is worthless for that equipment.
Three options to deploy protection
Rapid, flexible, low cost
All three provide the same Faction Network security and owner-controlled cryptographic trust. Hardware provenance and assurance vary by option.
Pods & Portals
- Hardware
- Faction hardware running Faction firmware. Pod: compact, low cost. Portal: higher capacity.
- Assurance
- Purpose Built, Assembled in USA, ORION Assured.
- Setup
- Click, scan and adopt in the Faction app. Minimal IT staff.
- Local admin
- Managed in your Faction app.
Faction Outpost
- Hardware
- Screened third-party hardware that Faction curates, configures, tests and ships.
- Assurance
- FCC-authorized, not on the Covered List; tested at a stated firmware version. Optional ORION Assured: contact us.
- Setup
- Plug in and adopt on your local network with the Faction desktop app or CLI. Turn-key.
- Local admin
- Full local administration retained. Faction manages only what it set.
Faction Canopy
- Hardware
- Compatible hardware you already own, or a supported model bought through your own procurement.
- Assurance
- FCC-authorized for sale in the US; compatibility identified by Faction. Field hardware can’t go through ORION.
- Setup
- Faction enables it with Canopy. Each step is verified, and your hardware generates its own keys.
- Local admin
- Full local administration retained. Faction manages only what it set.
What every Faction Outpost and Canopy-enabled networking device needs:
- A secure tunnel for the encrypted Faction connection.
- Local access only, with vendor cloud access restricted or off.
- A firewall that denies by default.
- NAT for the network behind it.
- Owner-controlled keys. Keys and certificates are created and controlled by the Network Owner and distributed only to authorized members. Faction never has access to them.
- Off the public Internet. Equipment behind Faction protection has no path to the Internet, and is reachable only from inside your Faction Network.
- Out-of-band authentication. A direct key exchange with no phishable credentials, blocking phishing, spoofing and Man-in-the-Middle attacks by design.
- Nothing on the equipment. No agent, no software and no changes to the machines and devices you protect.
- Zero knowledge of content. Faction never has access to your keys, so it can never read your data. It sees only the routing metadata of encrypted traffic crossing your Faction Network.
- Zero anonymity of access and action. Every device is cryptographically verified before any access, and no anonymous or unsigned connections are accepted. Every action is tied to a verified device or user.
- Contained by design. A compromised machine or device behind it can’t reach the Internet or call home, and Faction Groups limit it to what it is allowed to reach.
- Plug it inEthernet, behind the existing modem or router at each site.
- Adopt itJoins the Faction Network with owner-controlled keys, out-of-band in the Faction app or CLI.
- Connect equipmentBy Wi-Fi or Ethernet. Nothing is installed on the machines and devices behind it.
- ManageEverything in the Faction app. Use Faction Groups to segment access and permissions.
Built for MSPs and MSSPs
Secure what software can’t
A service for the OT, IoT and ICS machines and devices your clients’ software-only tools can’t secure.
Rapid deployment, minimal support
From a few hours to a few days per site, including training. No firewalls to configure for Pods and Outposts. Easy to use and manage.
Client-controlled keys
Each client creates and controls the keys for their own Faction Network. Faction never has access, and MSPs cannot be a vector for breach.
Conversations already happening
Ransomware, the FCC Router Mandate, cyber insurance requirements, and nation-state threats amplified by AI.
Close the gap on critical vulnerabilities now
Contact us and we’ll walk you through the MSP / MSSP Program, and set up a 60-day free pilot for your clients.
Frequently asked questions
What’s the difference between a Pod and an Outpost?
Both provide the same Faction Network security and owner-controlled keys. Pods and Portals are Faction hardware and firmware: Purpose Built, Assembled in USA, ORION Assured. An Outpost is screened third-party hardware Faction curates, configures, tests and ships, with full local administration retained.
Does it replace the firewall or router?
No, it sits behind them, and it doesn’t need a firewall. No rip-and-replace. Machines and devices behind it can’t be routed to from the Internet, so there’s no firewall to configure (and misconfigure). Existing routers and firewalls are never trusted, so their vulnerabilities no longer expose the equipment behind a Faction Pod, Portal or Outpost.
How is a Pod or Portal adopted?
Tap Add a Pod in the Faction app and scan the QR code on the unit. Your keys are created by you at adoption, out-of-band with nothing exposed to the Internet, and distributed only to authorized members. Faction never has access to them.
How is a Faction Outpost adopted?
Plug it in behind your existing modem or router and adopt it into your Faction Network on your local network, with the Faction desktop app or command-line tool. Adoption is out-of-band, with nothing exposed to the Internet. Your keys are created and controlled by you, distributed only to authorized members, and Faction never has access to them.
How does Faction Canopy work?
Canopy is a combination of tools and support that enables you to convert compatible routers you already own into your own Faction Outposts. Canopy checks compatibility, enables the hardware and verifies each step, and your hardware generates its own keys. The result is a Faction Outpost, so everything here about Outposts applies.
Can Faction see or reach our network or data?
No. Faction never has access to your keys, so it can never read your data or reach your network. It sees only the routing metadata of encrypted traffic crossing your Faction Network.
How does this prevent an MSP from being a vector for breach?
Most MSP tools run on one central platform with standing access to every client’s network, so when that platform is breached, attackers inherit the access. In 2021, ransomware pushed through Kaseya VSA hit about 60 MSPs and up to 1,500 of their customers in a single weekend, and ConnectWise ScreenConnect has been breached or exploited repeatedly since 2024. With Faction, the MSP gets a single pane of glass for visibility and support, but never has default access to its clients’ networks. Each client’s Faction Network has its own control inside it, with keys the client creates and controls. Access is granted by the client, every device is cryptographically verified, Faction Groups limit what it can reach, and every action is tied to a verified device or user. There is no central platform or shared credential that opens every client.
What happens if a device behind a Pod or Outpost is compromised?
It’s contained by design. It can’t reach the Internet or call home, and each Pod can be isolated to limit the reach of anything behind it.
Why is there no password or credential to phish?
Access is authorized by keys, not passwords. Every device is cryptographically verified before any access, via a direct out-of-band key exchange that blocks phishing, spoofing and Man-in-the-Middle attacks by design.
The plain-English overview and the 60-day free pilot for manufacturers.
Secure Your Critical OT & IoT Machines and Devices
Prefer to talk first? partners@factionnetworks.com