Product Update: BlastShield 2.0 Brings Device Posture, Agent Cloaking, and Post-Quantum Key Exchange
Executive Overview
BlastShield 2.0 is a major release. It changes three major things at once: 1) what BlastShield checks before granting access, 2) how session keys are protected against harvest-now-decrypt-later, and 3) what remote access actually feels like for the person using it.
New capabilities in this release:
- Device posture enforcement
- Agent cloaking
- Post-quantum key exchange
- BlastAccess hybrid rendering
- BlastAccess on phones and tablets
- Authorized Resources view
- Chat in BlastAccess
BlastShield already binds each login to a device enrolled with its own key. BlastShield 2.0 adds a second question: is that device healthy enough to trust, and should it have been admitted at all?
Where business systems connect persistently to the operational network and the Agent is deployed, BlastShield 2.0 cloaks the business-side endpoints of those connections and can restrict them to accept inbound traffic only over BlastShield.
What is new
1. Device posture enforcement
What it is. Device health becomes an independent factor in access decisions, alongside the user’s identity. In the Orchestrator, a new pane appears for User Devices, where individual user devices can be configured for specific required security postures.
How it works. Two behaviors, and they are independently enforced:
Unknown devices can be refused outright. A device that has never been admitted to the network can be blocked from joining even when it presents fully valid, fully authenticated user credentials. The login being real is no longer sufficient. The machine has to be one you have accepted. Configuration options include Accept all, Require admin approval, or Accept devices matching a specific security posture. If Admin approval is set, a pop-up appears in the Orchestrator when a new device presents itself, and the device remains in limbo until approved.
Compliance rules gate individual policies. You define what a healthy device looks like, and BlastShield checks it before granting a policy. If a device fails a rule, it is denied that policy even when its user sits squarely in the group entitled to it. Access becomes user-is-authorized AND device-is-compliant, not user-is-authorized alone. Posture is monitored continuously.
What it means for you. A stolen or phished credential still can’t open a session from an attacker’s laptop, because only enrolled devices can log in. With enrollment set to admin approval or posture matching, a device you never admitted can’t join at all. Where posture rules or approval apply, a contractor’s unmanaged machine doesn’t inherit the contractor’s entitlements just because the contractor’s login is legitimate. A device that drifts out of compliance loses access to any policy that requires compliance, including sessions in progress, without an administrator stepping in.
Available Posture Checks:
2. Agent cloaking
What it is. BlastShield’s cloaking now extends to the endpoint running the Agent. As on the Gateway, unauthenticated packets are silently dropped, so a scanner cannot tell the host from empty address space.
How it works. The protected machine does not respond to scans, does not expose open ports, and does not appear as a reachable target to other hosts on its network. It remains fully usable to the people and systems that the BlastShield policy allows, and effectively absent from everything else.
Self-isolation. The Agent can also restrict its host to accept inbound traffic only over BlastShield, so the only connections that reach it are the ones BlastShield policy authorizes. With self-isolation on, a compromised or out-of-compliance machine elsewhere on the network cannot connect to the host except through BlastShield. Cloaking means the host does not answer others. Self-isolation makes it reachable only through BlastShield. The two work as a pair.
What it means for you. Cloaking now extends to the endpoint you connect from, not only the assets you connect to. An IT-side endpoint that answers its neighbors on a flat corporate LAN is an obvious way in. With Agent cloaking, it stops answering.
Get BlastWave’s stories in your inbox
Join Medium for free to get updates from this writer.
This matters most at the IT-OT boundary. For an operator who must run persistent connections from business systems into the operational network, cloaking the IT-side endpoints means they stop answering scans from the business network.
3. Post-quantum key exchange
What it is. BlastShield 2.0 uses a hybrid ECDHE and ML-KEM key exchange, so session keys are protected against harvest-now-decrypt-later by a NIST-standardized post-quantum algorithm alongside the classical exchange. Post-quantum key exchange is used where both sides support it, and administrators can require it from the Orchestrator’s network settings.
What it means for you. The exposure is not only in the future. Attackers can capture encrypted traffic today and decrypt it later, once the capability exists. Any session carrying process data, engineering credentials, network topology, or vendor access is worth capturing. A post-quantum key exchange protects the keys to that recorded traffic. Forward secrecy answers key compromise today; post-quantum key exchange answers harvest-now-decrypt-later.
For federal, defense, and federally connected operators, BlastShield 2.0 adds a hybrid ML-KEM exchange.
4. BlastAccess hybrid rendering
What it is. A new rendering mode that produces a genuinely sharp image on the screens operators actually look at.
How it works. Previous releases encoded the entire screen as video. Video encoding is efficient for motion and poor for fine detail. BlastShield 2.0 identifies when only a small region of the screen updates frequently and sends the rest as bitmaps. The result is a sharp image wherever the screen is not in constant motion.
What it means for you. This addresses small, blurry text in BlastAccess sessions. Consider an HMI where one trend widget or alarm banner refreshes continuously while the rest of the display is static tag names, setpoints, and alarm text. Under full-screen video encoding, that constant motion degraded the whole display. Now, the moving region is encoded as video, and the text remains crisp and legible.
Reading a setpoint correctly is not a cosmetic concern. An operator acting on remote data has to be able to read it.
5. BlastAccess on phones and tablets
What it is. BlastAccess now runs on iPhone, iPad, and Android phones and tablets, with full input support. The device needs the BlastShield Client and the Authenticator installed, and mobile sessions are recorded the same way as desktop sessions.
What it means for you. An on-call engineer can triage from the device already in their hand. No laptop, no waiting to get back to a desk. The release ships with complete input support, so a mobile session is interactive rather than a read-only view. This matters most in an emergency, when a new device is the only one available to reach a critical system. New devices still have to meet whatever admission and posture rules are configured.
6. Authorized Resources view
What it is. After authentication, a user can see the systems they are allowed to connect to in a resource view, including BlastAccess sessions.
What it means for you. An engineer can immediately see whether they have access to the systems they need to do their job. If a system isn’t listed, BlastShield won’t connect them to it.
7. Chat in BlastAccess
What it is. Administrators and the person at the remote computer can chat directly with connected BlastAccess users. A chat permission controls who can use it.
What it means for you. Enables “over-the-shoulder” troubleshooting and direct interactions between administrators and users.
Who this release is for
Water and wastewater utilities. Device posture and agent cloaking address two exposures where IT and OT responsibilities overlap or contractors connect regularly: unmanaged devices holding valid credentials and IT-side machines serving as an entry path.
Manufacturing. Your plant may need business systems permanently connected to the operational network. Where the Agent is deployed, the business-side endpoints of those connections are cloaked and can be set to accept inbound traffic only over BlastShield.
Federal, defense, and federally connected operators. BlastShield 2.0 adds a hybrid ML-KEM exchange.
Any operator relying on remote support. The BlastAccess improvements make HMI screens legible over secure remote access.
Live webinar: Inside BlastShield 2.0
Want to see BlastShield 2.0 in action? Join us on Wednesday, November 4, 2026, at 2:00 p.m. ET for a live, 45-minute webinar exploring the new capabilities, including device posture enforcement, Agent cloaking, post-quantum key exchange, and BlastAccess improvements.
BlastWave’s team will walk through the new features, demonstrate their configuration in the Orchestrator, and answer your questions during a live Q&A. Whether you’re planning an upgrade or evaluating BlastShield for your OT environment, this is your opportunity to see what’s new firsthand.
Register now for Inside BlastShield 2.0 to reserve your spot.
How to get started
BlastShield 2.0 is available now. The full list of changes, including fixes, is in the release notes. Existing customers can reach out to our customer support team with questions about upgrading.
To see it for yourself, schedule a demo. We scan a protected controller in front of you, then have an authorized operator reach the same device. Bring your own scenario rather than watching ours.
