Owl Cyber Defense has launched the Incident Response Diode, a pocket-sized protocol filtering diode designed for incident response and forensics teams. The device lets responders move evidence from compromised endpoints into trusted analysis environments without introducing additional risk.
When an endpoint is compromised, responders race to pull critical data before systems are wiped, reimaged or attacked again. Legacy tools and risky connections can spread malware, break chain of custody and trigger costly enclave rebuilds.
The Owl IRD uses hardware-enforced, protocol-aware one-way transfer that meets U.S. government protocol filtering diode requirements, with filtering at the field-programmable gate array level, reducing reinfection risk and preserving forensic integrity.
The IRD extends Owl’s product suite to the endpoint, complementing Owl Talon’s network monitoring with incident response capabilities including endpoint triage, evidence intake and one-way mission data collection.
“Every incident responder knows the uncomfortable tradeoffs they face when collecting evidence from a live, compromised system,” said Tim Fahl, chief technology officer at Owl Cyber Defense. “Their options are to rush ahead with tools that put their clean environments at risk, or slow everything down trying to engineer safer workarounds in the middle of a crisis. The Owl IRD eliminates that tradeoff by putting protocol-aware, hardware-enforced, one-way protection directly into the responder’s go-bag, so teams can confidently collect what they need without opening new paths for the adversary.”
With the Owl IRD, incident response and forensics teams can:
- Collect evidence from compromised endpoints using standard USB operations without exposing trusted analysis environments to hidden risk.
- Standardize how evidence moves from the field to the lab with built-in session records.
- Reduce downtime with a self-contained diode usable anywhere.
Owl IRD will be made available to select customers for field testing.