Buyer's Guide: OT & ICS Security Platforms

Executive Summary

An OT security platform finds the industrial devices on your networks, learns how they talk to each other, and flags vulnerabilities and threats without disturbing the process they control. NIST states that OT encompasses a broad range of programmable systems and devices that interact with the physical environment, including industrial control systems, building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems. Most platforms collect traffic passively from a network tap or mirrored switch port, and many add carefully limited active queries to read firmware and configuration.

The vendors differ most in what happens after an alert. Some route it into the security operations center (SOC) tools you already run. Some trigger a firewall, network access control or ticketing action through an integration. One sells an incident response retainer with stated response times. None of these replaces an owner’s own plan to run the plant by hand during an incident.

This guide covers what OT and ICS security platforms do, how the vendors compare on incident response where their own pages state it, the capabilities to test, seven approaches to buying, the eight vendors in the table that represent them, and how pricing works. Three of the eight have a new owner or majority investor since the previous edition, and each change is sourced to the companies’ own announcements.

What Does OT and ICS Security Cover?

NIST lists SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security. NIST states that its guide covers how to secure operational technology (OT) while addressing its unique performance, reliability, and safety requirements. NIST has published an initial public draft of Revision 4, with public comments due by November 30, 2026.

CISA states that ICS and OT are the foundation of U.S. critical infrastructure, particularly in the Energy, Water and Wastewater Systems, Transportation Systems, Critical Manufacturing, Food and Agriculture, Nuclear Reactors, Materials, and Waste, and Chemical Sectors. The same platforms are sold to factories, pipelines, utilities, hospitals and building operators.

Every program starts with the inventory. CISA describes an OT asset inventory as an organized, regularly updated list of an organization’s OT systems, hardware, and software, and states that without an inventory, organizations do not know what they have and what should be secured and protected. CISA states that creating an asset inventory is one of CISA’s Cybersecurity Performance Goals (CPGs). An OT security platform builds and maintains much of that inventory from network traffic. It does not replace a walk-down of the plant. CISA recommends a physical inspection and logical survey, gathering detailed digital and network-based information about system components, to identify assets.

ISA states that the ISA/IEC 62443 series of standards define requirements and processes for implementing and maintaining electronically secure industrial automation and control systems (IACS). ISA states that the standards define requirements for stakeholder groups including asset owners (end users), automation product suppliers, integrators who build and maintain control system solutions and their components, and service suppliers who support the operation of control systems. ISA lists ANSI/ISA-62443-2-1-2024, Part 2-1, as security program requirements for IACS asset owners. ISA lists Part 2-4 of the series as security program requirements for IACS service providers. Part 2-4 is the one to cite when you contract for monitoring or response services.

How Do OT Security Vendors Compare on Incident Response?

Incident response in OT has two halves. The platform detects and hands off. People contain the threat and keep the process safe. CISA states that the capability to revert to manual controls to quickly restore operations is vital in the immediate aftermath of an incident. CISA lists recommended practices including Creating Cyber Forensics Plans for Control Systems and Developing an Industrial Control Systems Cybersecurity Incident Response Capability. The comparison below covers only what each vendor’s own pages state about response.

One vendor sells response as a service. Dragos states that it provides 24/7 xOT incident response through its Rapid Response Retainer. Dragos offers Essential (80 hrs), Standard (160 hrs), and Enhanced (240 hrs) retainer tiers, and states that unused hours can be applied to proactive security services including architecture reviews, penetration testing, and tabletop exercises. Dragos states that Rapid Response Retainer customers with the Dragos Platform receive first contact within 1 hour, analysis starts within 2-4 hours, and onsite response within 48 hours. Those times are the vendor’s own figures; put them in the contract.

Another describes response as workflow. Claroty lists operationalized incident response: repeatable, governed workflows that empower the SOC to respond to industrial alerts with the specific context needed to avoid accidental downtime. Claroty states that the Claroty Platform automatically routes alerts to the right person within the organization, integrating with existing security workflows.

Nozomi Networks lists routing detected vulnerabilities, anomalies or threats into platform workflows, playbooks and integrated security tools to accelerate incident response. On the endpoint, Nozomi Networks describes Nozomi Arc as a host-based security sensor that detects and defends against malicious or compromised endpoints.

Two vendors describe automated actions through integrations. Armis states that through integrations Armis Centrix™ can trigger actions like quarantining a device via a Network Access Control (NAC) solution, blocking malicious communications by updating firewall rules, opening a high-priority ticket in ServiceNow, and initiating a workflow in a SOAR platform. Tenable states that through integrations, Tenable One can trigger actions such as blocking malicious communications by updating firewall rules, opening a high-priority ticket in JIRA or ServiceNow, and initiating a specific workflow in a SOAR platform. Tenable states that AI-powered remediation guidance, SIEM/SOAR integrations, and attack path analysis accelerate incident response.

The IT security vendors connect OT alerts to the tools the SOC already uses. Microsoft offers a unified view of the entire cyberattack, including those beginning on the IT network and traversing into business-critical networks and OT environments, to accelerate incident response. Microsoft states that threats can be answered by integrating with Microsoft services such as Microsoft Sentinel, other partner systems, and APIs, and with SIEM, SOAR and XDR services. Forescout states that, integrated with eyeAlert, detection spans over 180 IT/OT data sources and turns alerts into orchestrated actions across the security stack. Palo Alto Networks states that with Advanced Device-ID you can create targeted, adaptive device policies, while also taking advantage of virtual patching with NGFW.

An automated block on an OT network can stop a process as surely as an attacker can. For each automated action a vendor offers, ask who approves it, whether it can run in alert-only mode, and how plant operations is told.

Discovery, Segmentation and the Capabilities to Test

Passive monitoring reads copies of traffic and sends nothing to the devices. Active querying asks devices for detail such as firmware versions, using their own industrial protocols. Most platforms now do both and let you limit active queries by site or device. Ask which devices each vendor has queried actively in production at a site like yours, and how to switch active querying off.

Segmentation is the main control most platforms help design. CISA describes a Zone as a grouping of logical or physical assets that share common security requirements based on factors such as criticality and consequence. CISA states that Conduits consist of the grouping of cyber assets dedicated exclusively to communications, and that they ensure that only authorized data or traffic can pass between Zones. CISA states that segmenting critical systems and introducing a demilitarized zone for passing control data to enterprise logistics reduces the potential impact of cyber threats and the risk of disruptions to essential OT operations. A platform that maps communications can propose zone and conduit rules; your firewalls or NAC enforce them.

Vulnerability results need OT context. CISA recommends cross-referencing inventories with established vulnerability databases, such as CISA’s Known Exploited Vulnerabilities (KEV) Catalog. CISA recommends continuously exploring security controls for known OT vulnerabilities in vendor systems and applications that cannot be patched immediately or are end of life. CISA recommends scheduling mitigating actions or patching during maintenance windows, unless urgency drives an emergency change.

Threat detection is easier to compare when vendors use one vocabulary. CISA recommends prioritizing threat factors by mapping potential attack patterns to known threat intelligence sources like MITRE ATT&CK Matrix for ICS. Ask each vendor to show which ATT&CK for ICS techniques its detections cover on your traffic.

Remote access is the most common way into a plant. CISA recommends that, if remote access is essential, OT assets move to a private IP network connection, with virtual private network (VPN) functionality, a strong password and phishing-resistant multifactor authentication (MFA) for user remote access. Several platforms sell secure remote access as a module; compare it with the remote access product you already run.

Vendors in OT & ICS Security Platforms

Representative vendors include Armis (ServiceNow), Claroty, Dragos, Forescout, Microsoft Defender for IoT, Nozomi Networks (Mitsubishi Electric), Palo Alto Networks Industrial OT Security (OT Device Security) and Tenable OT Security (Tenable One OT Exposure). The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors

The approaches below follow two questions: where the product came from, and who runs the response. Buyers looking for alternatives inside a mixed OT ecosystem should also ask which control system vendors and security tools each platform integrates with.

A CPS protection platform covers industrial, healthcare and building systems in one product. Claroty states that the Claroty Platform combines asset visibility, threat detection, exposure management, network protection and secure access, and can be deployed on-premise or in the cloud. Claroty describes Claroty xDome as a cloud-native modular platform that protects CPS environments against cyber threats. Claroty describes Claroty Continuous Threat Detection (CTD) as an on-premise solution purpose-built to protect industrial cybersecurity environments. Claroty states that it discovers and profiles CPS devices, such as PLCs, HMIs, IIoT sensors and building management systems, with multiple discovery methods across more than 450 industrial protocols.

A sensor family places network, endpoint and wireless sensors under one console. Nozomi Networks states that the Nozomi Guardian security sensor passively observes and analyzes local network traffic to provide comprehensive OT and IoT asset visibility. Nozomi Networks states that Nozomi Guardian sensors can be deployed as hardware appliances, virtual machines, embedded devices or containers, and send data to either an on-prem Nozomi Central Management Console or the Nozomi Vantage cloud management platform. Nozomi Networks announced on January 28, 2026 that Mitsubishi Electric Corporation has completed its acquisition of the company. Nozomi Networks states that, as a wholly owned subsidiary, it will continue to support the full OT/ICS ecosystem with the same open, multi-vendor approach.

An OT platform with its own response practice pairs the product with responders. Dragos states that passive-first discovery keeps the xOT inventory continuously current, and that active collection adds firmware, OS, and patch detail. Dragos announced on September 21, 2026 that it has acquired NetRise and runZero, following the close of Accenture’s majority investment in Dragos. Dragos states that it continues to operate independently with its existing leadership team and the vendor neutrality required to defend critical infrastructure built on systems from multiple providers. Its retainer is described in the incident response section above.

Asset intelligence across IT, OT and medical devices now sits inside a workflow platform. ServiceNow announced that it has completed its acquisition of Armis. Armis states that the Armis platform remains available as part of the ServiceNow AI Platform and as a standalone solution. Armis states that it passively monitors network traffic and uses Safe Active Querying with native, vendor-approved industrial protocols to gather more details from devices without generic, risky scans. Armis offers cloud, on-premises and hybrid deployment, and describes on-premises as ideal for highly regulated or air-gapped OT networks.

IT security vendors extend products you may already run into OT. Microsoft states that Defender for IoT provides agentless, network layer monitoring, and integrates with both industrial equipment and security operation center (SOC) tools. Microsoft states that in an air-gapped environment, OT network sensors can be connected to the OT sensor console to keep all OT network data fully on-premises. Palo Alto Networks states that Device Security works with next-generation firewalls and Prisma to discover and maintain a real-time inventory of all connected assets in the network. Palo Alto Networks states that Device Security uses passive and active traffic monitoring, as well as third-party integrations, to identify over 2,000 attributes. Palo Alto Networks states that, where the portal has no predetermined vertical theme, Device Security prompts owners or superusers to select one: Enterprise Device Security, OT Device Security, or Medical Device Security. Palo Alto Networks documentation lists new integrations of Device Security with Nozomi CMC and Nozomi Vantage.

Exposure management vendors extend vulnerability programs into OT. Tenable announced new capabilities within Tenable OT Security on March 9, 2023. Tenable presents Tenable One OT Exposure as a way to manage OT security across the cyber-physical ecosystem and unify the digital and physical attack surface. Tenable states that Tenable One OT Exposure combines passive network monitoring with patented, vendor-approved Safe Active Querying to communicate with devices in their native protocols.

Device visibility and network access control vendors add OT monitoring to enforcement. Forescout states that Forescout eyeInspect combines real-time asset intelligence, actionable risk, and threat detection in one platform across Cyber Physical Systems. Forescout states that eyeInspect classifies events in an analyst-friendly interface and maps them to the MITRE ATT&CK for ICS. Forescout states that the Vistaro platform enforces NAC and zone-based segmentation, managing transient devices and remote connections. Forescout states that eyeInspect runs on Forescout appliances, existing equipment, or certified partner hardware.

Eight vendors across seven approaches; Microsoft and Palo Alto Networks share one. The approaches were written before any vendor was placed in one, and the eight are the vendors the previous edition evaluated. None of the eight positions in the table is for sale. The roster check for this edition also covered TXOne Networks, Cisco Cyber Vision, Fortinet, Industrial Defender, Waterfall Security Solutions and OPSWAT, and any of them can make its own case in the Spotlight below.

How much should you budget for OT & ICS Security Platforms?

None of the eight vendors publishes an OT price list on the pages checked for this guide, so every price is a quote. Quotes are built from the number of sites, sensors or monitored devices, the modules licensed, and services.

Of the eight, one publishes its OT licensing unit on the pages checked. Microsoft states that OT monitoring is billed using site-based licenses, where each license applies to an individual site, based on the site size. Ask the other vendors which unit they price by, and model the bill for your largest and smallest sites.

Response services are priced separately from the platform. Retainers are sold in blocks of hours. Ask what happens to unused hours, what rate applies once the hours run out, and whether response times depend on also licensing the platform.

Hardware is a real line item. Count the sensors each site needs, including ruggedized models for the plant floor, and the taps or switch ports to feed them.

How long does implementation take for OT & ICS Security Platforms?

Run the rollout with plant engineering from the first day. Engineering approves where sensors go, which devices may be queried, and every automated response. Start with the sites whose failure would hurt most, not the easiest to reach.

What should you ask vendors about OT & ICS Security Platforms?

Ask each vendor to answer in writing and to demonstrate on traffic from one of your sites.

Related Resources