It’s not a storm — it’s the climate

It’s not a storm — it’s the climate

Arbit: Making Data Move Only One Way

14 October 2026

Summary:

Arbit is one of only two companies in the world holding Common Criteria EAL7+, the highest security certification available.

At that level, it isn’t enough to claim your product works. You have to formally prove it, along with your supply chain, your production, your transport and your company culture. The first time took Arbit around 3,000 hours.

Arbit builds data diodes and cross-domain solutions for armed forces, police, intelligence services and governments. It turns data into light and sends it in one direction only, and it can prove that nothing comes back.

Rik Ferguson and I sat down with Kasper Gubi of Arbit to talk about how you move data only one way (cross-domain)!

We talk about:

  • What EAL7+ certification actually takes, and why so few companies get there
  • Why one-way data transfer is different from encryption
  • How the customer base moved from intelligence services to the NATO battlefield
  • Insider threats, release portals and getting rid of USB sticks
  • Armoured vehicles running up to seven networks of different classifications
  • The F-35 integration question every European customer asked
  • Twenty years bootstrapped, 10x growth in six years, and a partnership with Leonardo
  • NATO data-centric security: prepare to share, but control what you share