FireSight OT · alternatives
A Tosibox alternative for OT remote access
If you're looking for a Tosibox alternative, you may want per-machine access through the browser, vendor working hours, or Cloud Connectors you can buy or build. This page compares Tosibox with FireSight OT, using only what Tosibox describes in its public documentation.
Being fair
When Tosibox is a good fit
Tosibox (now Tosi) connects sites with Lock devices, user Keys and a central hub: Tosibox HUB, formerly Virtual Central Lock.
- No open ports at the site for the hardware Lock and Lock for Container.
- 1:1 NAT on hardware Locks in Layer 3 mode, for sites with the same addresses.
- Access Groups to decide who reaches what, and a hardware key plus credentials for sign-in.
- A self-hosted HUB or Virtual Central Lock VM, with email alerts through your own mail server when a node disconnects.
Side by side
Tosibox and FireSight OT: where they differ
Only the points where the two differ, or where one side's public docs don't describe something.
| Point | Tosibox (public docs) | FireSight OT |
|---|---|---|
| Site devices | Hardware Lock, or Lock for Container on Docker. | Ready-made Cloud Connectors from us (CC-3, CC-4, CC-5, industrial CC-4i and CC-5i), or build your own from standard parts. |
| Central server | Self-hosted Tosibox HUB or Virtual Central Lock VM. Virtual Central Lock needs a reachable address. | Self-hosted Cloud Hub on your server or a cloud VM. It also needs a reachable address, with only TCP 443 open inbound. A hosted option is planned. |
| Identical sites with the same addresses | 1:1 NAT on hardware Locks in Layer 3 mode. Lock for Container has no Layer 2 or 1:1 NAT. | 1:1 mapping on every Cloud Connector, to its own range on the Hub. Machines need no route changes. |
| Sign-in | A hardware key plus credentials. | Authenticator apps (TOTP), which can be required for everyone and always are for vendors, or single sign-on (Entra ID, Google, Okta, OpenID Connect, SAML 2.0). |
| Who reaches what | Access Groups. | Grants per machine or per Cloud Connector, to people, divisions or vendors, with vendor access hours and end dates. |
| Web HMIs and remote desktop in the browser | Not described in their public docs. | Web HMIs, RDP and VNC open in the browser; RDP and VNC with clipboard and Ctrl+Alt+Del are new in 0.3.0. |
| Serial consoles | Not described in their public docs. | New in 0.3.0: USB console cables or USB-to-RS232 adapters, in a browser terminal or through the client. |
| Session recording | Not described in their public docs. | Text transcripts of browser SSH, Telnet and serial sessions, kept 90 days. Video recording of RDP and VNC is planned for 0.4.0. |
| Alerts | Email when a node disconnects (HUB, through your own SMTP server). | Email when a Cloud Connector is offline or a machine is unreachable, with one line per site outage, combined emails and maintenance mode. |
FireSight OT
What's different with FireSight OT as a Tosibox alternative
Access per machine
Nothing is visible until it's granted. People get one HMI, one engineering PC or one PLC port, not the whole machine network. A full-network WireGuard VPN is there when a tool needs it, still limited to what's granted.
Most work needs no client
Web HMIs, remote desktop and terminals open in the browser. For engineering tools such as TIA Portal or Studio 5000, a client for Windows, macOS and Linux opens a local port.
Working hours and end dates
Vendor accounts must use two-factor sign-in, can be limited to working hours, and stop on an end date. Their connections close when time is up, and every session is in the audit log.
Fewer, clearer alerts
One line when a whole site drops, combined emails, and a note when the Hub itself may have lost internet. New in 0.3.0, maintenance mode holds a site's alerts for 1 hour to 1 week.
Buy it or build it
Cloud Connectors are Raspberry Pi-based, so you can buy ready-made ones from us or build your own from parts at a local store. 1:1 mapping works the same on all of them, and new in 0.3.0, so do 4G/5G modems.
Your Hub, per-connector licences
The Cloud Hub runs on your own server and needs only TCP 443 open. Licensing is per Cloud Connector; if a licence lapses, it keeps working in a restricted mode and security updates continue.
Running both
Adding Cloud Connectors next to your Locks
A Cloud Connector is a separate small box, so it can go on a machine network next to an existing Lock while you compare them on real work.
- Start with one site. The 30-day evaluation covers up to three Cloud Connectors.
- Move outside vendors first, where working hours, end dates and per-machine grants make the most difference.
- Keep the Locks for anything that needs them until you've decided site by site.
Comparing several products? Use our eleven questions for any OT remote-access product.
Related: vendor remote access for OT, remote access with duplicate IP addresses, and the FireSight OT overview.
Product names are trademarks of their owners. Facts checked against public documentation on 25 October 2026; tell us at hello@firesightsystems.com if anything has changed.
FAQ
Questions people ask
How is FireSight OT different from Tosibox?
FireSight OT grants access per machine or per Cloud Connector, opens web HMIs, remote desktop and terminals in the browser, and gives vendor accounts working hours and end dates. Cloud Connectors can be bought ready-made or built from standard parts.
Does FireSight OT need a hardware key to sign in?
No. People sign in with two-factor authenticator apps or single sign-on, such as Microsoft Entra ID, Google Workspace, Okta or any SAML 2.0 provider.
Does it need open ports at the site?
No. The Cloud Connector only connects out to your Cloud Hub. The Hub itself needs a reachable address with TCP 443 open.
Can I run FireSight OT next to existing Tosibox Locks?
Yes. A Cloud Connector is a separate small box, so it can go on a machine network next to an existing Lock while you compare them. Licensing is per Cloud Connector, with a 30-day evaluation for up to three.
See it on a test line
Tell us about your sites and who needs to reach them. We'll show you FireSight OT in a live demo Hub, with real machines behind a Cloud Connector.
