Tosibox matches a key to a lock and gives you a plug-and-go encrypted tunnel to a site's network. ThinRemote installs a software agent on each Linux device and gives you SSH, monitoring, remote desktop, filesystem and fleet automation on top. One connects you to a location; the other operates the machines on it.
ThinRemote operatesThis isn't a feature war. Tosibox and ThinRemote solve different problems, and the real question is whether you need to reach a site or operate the devices once you're there.
A plug-and-go industrial VPN. You match a Key (a physical USB crypto-processor, a SoftKey or the mobile client) to a Lock / Node gateway, and the whole LAN behind that gateway (PLCs, HMIs, IPCs) becomes reachable over an encrypted tunnel, brokered by the Tosibox MatchMaker relay. Excellent, no-IT-skills connectivity to a location, but what you do once the tunnel is up is up to your own client tools.
A remote management platform. One outbound software agent on each Linux host gives you live telemetry, alarms, shell, file transfer, remote desktop, web-service proxy, device APIs, fleet automation and an MCP server for AI agents, all out of the box. No gateway to install in front of the device and no key to match: you manage what the machine is doing, not just whether you can reach its network.
Tosibox anchors on a gateway. A hardware Node (with 4G, WiFi and Ethernet) or the software Lock for Container sits at the edge of a site and bridges the LAN behind it into the VPN. That's the right shape for industrial equipment that can't run software of its own, but it means the thing you deploy and match is the gateway, not each machine.
ThinRemote is a tiny agent, a single static binary under 10 MB, that you install on the Linux host itself. It runs on almost anything, from a modern server to a years-old industrial box (kernel 2.6 and up, 16 architectures), inside containers, and makes one outbound connection that changes nothing about the device's own networking. Every device is a managed asset with a stable identity, not just an IP behind a gateway.
Tosibox gives you the encrypted path. Once the Key is matched to the Lock, any service on the site LAN, Remote Desktop (RDP), web (WWW), FTP or SSH, is reachable over the tunnel using your own client software. Powerful and protocol-agnostic, but the terminal, the file browser and the desktop client are all bring-your-own.
ThinRemote ships the operating surfaces over the same agent. A web console with an in-browser terminal, file explorer, remote desktop and live dashboards; a scriptable CLI with JSON output; and a built-in MCP server so AI agents drive the fleet in natural language. Same authentication, roles and audit across all three, nothing for an operator to install locally.
Tosibox has grown a strong monitoring story: TosiControl gives a topological view of the network and its gateways, and TosiANTA adds OT traffic analytics, asset inventory and prioritised alerts. That view is centred on the network and the Tosibox devices themselves, CPU, RAM and storage of each Node, plus what's moving across the wire.
Every ThinRemote agent reports a structured monitoring resource per host: CPU and load, memory and swap, per-filesystem usage, network throughput, temperature and uptime, wired straight into threshold alarms over email or webhook. And you define the criteria: expose any value from a small script on the device, a fault code from a PLC, the kWh a charger delivered, units left in a machine, and it becomes a first-class metric you can chart, roll up across the fleet and alarm on like any built-in one.
Tosibox scales by sites and matched keys: add a Node, match the keys that should reach it, and the site is on the network. That model is a great fit for connecting many locations, but applying a change to the software on hundreds of devices is a separate problem you solve with your own tooling over the tunnels.
ThinRemote makes the whole fleet programmable. Playbooks describe a change once, try it on a single device first, then roll it out across the product in controlled batches that stop on their own if too many devices fail. The same flow runs from your terminal, your CI/CD pipeline or an AI agent over the built-in MCP server, so operating ten thousand endpoints looks the same as operating ten.
Both products are firewall-friendly: a Tosibox Lock dials out to the MatchMaker relay, and a ThinRemote agent dials out to its cloud, so neither needs an inbound port opened on the device side. The difference is what a connection grants. Tosibox matches a Key to a Lock and joins the operator to the site's LAN over a Layer-3 VPN, exactly what OT teams want when they need to reach the equipment behind a gateway.
ThinRemote brokers scoped access to a specific device through the cloud, authenticated with tokens and governed by RBAC and audit logging, over TLS 1.3, without placing the operator on a network. There are no physical keys to distribute or match, roles and tokens are managed centrally, and ThinRemote is ISO 27001 certified.
Over a Tosibox tunnel you reach a device's existing services and drive them with the tools those services already speak. There's no notion of a portable, named operation you can invoke the same way on every device in a fleet without knowing its address.
With ThinRemote each agent exposes resources, named operations you call by name that return JSON. Run diagnostics, read a meter, push new firmware, restart a service, with no interactive session and no bespoke glue. Turn any script into a resource and it's instantly callable across the fleet, from a CI/CD step, a cron job, a webhook, an incident runbook, or an AI agent over the built-in MCP server.
How the two approaches line up, side by side, once you're operating more than a handful of machines.
product execA fair reading: Tosibox is deliberately a connectivity layer, so most "partial" cells reflect that you bring your own tools over an excellent tunnel. ThinRemote's value is that the operations ship as one product, installed on the device itself.
Different jobs, remember. If your problem is secure connectivity to a site, reach for Tosibox.
You want secure remote access to a site in minutes, with no IT skills, no network config and a matched-key trust model with a strong OT and critical-infrastructure pedigree.
Your PLCs, HMIs and controllers can't run software of their own. A Node bridges the entire LAN into the VPN, so you reach equipment that could never host an agent.
You need a rugged edge box with 4G, WiFi and Ethernet and Layer-3 site-to-site networking, rather than software running on the hosts themselves.
Plenty of teams run both: Tosibox for the secure path to the site, ThinRemote agents on the Linux hosts to operate what's on it.
Pick by the question you're actually trying to answer.
"I need to operate, observe and fix a fleet of Linux devices."
"I need a dead-simple, secure tunnel to a site's network."
The questions OT and IoT teams ask when they compare the two.
For plug-and-go secure connectivity to a plant or substation, Tosibox is an excellent, purpose-built fit, especially when you need to reach equipment behind a gateway and want a matched-key trust model with no IT skills. ThinRemote fits the other half of the problem: operating the Linux devices themselves, with SSH, monitoring, remote desktop and fleet automation at scale. Many teams run both.
No. ThinRemote is a software agent you install on the device with a single command, and access is controlled with cloud RBAC and tokens. There is no gateway appliance to rack and no physical key to match or ship. Tosibox, by design, anchors trust in a Key (a physical USB crypto-processor, a SoftKey or the mobile client) matched to a Lock or Node.
Tosibox provides the encrypted VPN tunnel, and once it's up you can reach SSH, RDP/VNC, web and FTP services on the site LAN using your own client software; TosiControl and TosiANTA add network monitoring and OT analytics. ThinRemote ships those surfaces built in, per device: an in-browser terminal, remote desktop, file explorer, per-host metrics with custom values, and threshold alarms, with nothing for an operator to install locally.
They scale along different axes. Tosibox scales by sites and matched keys, ideal when you're connecting many locations. ThinRemote installs a per-host agent and manages fleets programmatically, with playbooks, batched rollouts, a JSON CLI for CI/CD and an MCP server, so operating ten thousand individual endpoints looks the same as operating ten.
No. Like Tosibox, the ThinRemote agent only dials out, over TLS 1.3, so no inbound port is needed. Unlike a Layer-3 VPN, it doesn't join you to the device's LAN: it brokers scoped access to a specific device's services through the cloud, governed by RBAC, tokens and audit logging. ThinRemote is ISO 27001 certified.
Yes. A common pattern is to keep Tosibox for the secure network path to a site and run ThinRemote agents on the Linux hosts at that site to observe, operate and automate them. The two layers complement each other rather than compete.
Install the agent in seconds and get SSH, telemetry, alarms, device APIs and automation from one outbound connection, with no hardware or keys to provision.