Published November 10, 2026
Operational technology (OT) is the hardware and software that monitors and controls physical equipment and processes. Industrial control systems (ICS) are the part of OT found in industry and critical infrastructure: supervisory control and data acquisition (SCADA) systems, distributed control systems and programmable logic controllers (PLCs). OT and ICS security products find these devices, watch how they communicate and flag activity that could stop or damage the process.
Where the market stands
Three companies that sell OT security changed owners in 2026, and Claroty raised new capital.
- Nozomi Networks. Mitsubishi Electric announced its plan to buy Nozomi Networks on September 9, 2025. It completed the purchase of all outstanding shares on January 28, 2026.
- Claroty. Claroty announced $150 million in Series F funding on January 22, 2026.
- Armis. ServiceNow announced on December 23, 2025 that it would acquire Armis for about $7.75 billion in cash. ServiceNow describes Armis as managing cyber risk across IT, OT and medical devices. The acquisition closed on April 20, 2026.
- Dragos. On June 18, 2026, Accenture agreed to acquire a majority stake in Dragos and all of runZero and NetRise, at a combined enterprise value of about $4.175 billion. Accenture said runZero and NetRise would operate under Dragos, which would continue as an independent business. Accenture says the NetRise purchase closed on July 31, 2026, its majority investment in Dragos on September 16 and the runZero purchase on September 17. Dragos now owns NetRise and runZero.
What regulators and agencies ask for
- EU NIS2 Directive. Member states had to adopt their national laws by October 17, 2024 and apply them from October 18, 2024. The directive covers energy, transport, drinking water and other high-criticality sectors, and parts of manufacturing in its list of other critical sectors. Covered entities must send an early warning of a significant incident within 24 hours and an incident notification within 72 hours.
- NERC CIP-015-1. On June 26, 2025, the Federal Energy Regulatory Commission approved this internal network security monitoring standard for the North American bulk electric system. It requires processes to monitor, detect and evaluate anomalous activity inside the electronic security perimeters of high impact systems and of medium impact systems with external routable connectivity.
- EU Cyber Resilience Act. It sets cybersecurity requirements for manufacturers of hardware and software products with digital elements. Its reporting obligations have applied since September 11, 2026. Its main obligations apply from December 11, 2027.
- CISA advisories. On April 7, 2026, CISA and partner agencies warned of Iranian-affiliated actors targeting internet-connected PLCs from Rockwell Automation/Allen-Bradley, Schneider Electric and Siemens. The advisory says the activity disrupted PLCs in several U.S. critical infrastructure sectors. It was last updated on July 22, 2026.
- CISA guidance. CISA and partner agencies published OT asset inventory guidance on August 13, 2025, Secure Connectivity Principles for Operational Technology on January 14, 2026, and Adapting Zero Trust Principles to Operational Technology on April 29, 2026. On July 28, 2026, CISA and the Australian Signals Directorate published CI Fortify, advice on isolating vital OT from all other networks during a crisis.
Four kinds of product
- OT specialists. Claroty sells xDome as a SaaS platform and Continuous Threat Detection (CTD) as its on-premises platform. Nozomi Networks sells Guardian network sensors, Arc endpoint sensors and Guardian Air for wireless, with Vantage in the cloud or a Central Management Console on premises. Dragos runs OT-CERT, which gives free OT security resources to organizations that own or operate OT.
- OT modules from IT security vendors. Microsoft Defender for IoT sensors connected to the cloud send alerts to Azure, which connects to Microsoft Sentinel. Tenable sells Tenable One OT Exposure in cloud, on-premises and hybrid deployments, and says the on-premises option suits regulated or air-gapped networks. Palo Alto Networks says OT Device Security gives OT asset visibility without adding sensors.
- Monitoring built into network equipment. Cisco says the Cyber Vision sensor is embedded in its switches and routers, removing the need for visibility appliances or SPAN collection networks.
- Broad device platforms. Armis, now part of ServiceNow, covers IT, OT and medical devices. Forescout says eyeInspect covers OT, IoT, medical and building systems, and runs fully air-gapped, on premises, hybrid or in the cloud.
If your SOC already runs one of these IT security platforms, compare its OT module with a specialist on your own protocols and sites, not on the vendor's list.
Passive and active discovery
NIST SP 800-82 Rev. 3, its guide to OT security, describes both methods.
Passive discovery reads traffic copied from switches or network taps. It adds no traffic to the network. NIST says it can identify manufacturers, part numbers and firmware versions. It cannot see devices that are not communicating or read encrypted traffic, and it can take days to complete.
Active discovery probes devices directly. NIST says active scans may cause device instability or interfere with the process, and should be scheduled during planned outages where possible. It also describes safe active scanning, which learns about equipment passively first and then queries it in its own protocol.
Vendors use both. Claroty lists passive monitoring and safe queries among its discovery methods. Tenable combines passive monitoring with what it calls Safe Active Querying.
What it costs where prices are published
List prices as published on October 17, 2026.
- Microsoft Defender for IoT. OT monitoring is licensed per site, on an annual commitment, by the number of devices at the site: $70 a month for up to 100 devices, $150 for up to 250, $250 for up to 500, $400 for up to 1,000 and $1,500 for up to 5,000. For more than 5,000 devices at a site, Microsoft says to contact its sales team. A device with modules or backplane components counts as one device. Devices inactive for more than 60 days do not count.
- Cisco Cyber Vision. Cisco includes it at no extra cost with IE3500 Rugged, IE3500 Heavy Duty and Catalyst IE9300 Rugged switches bought with a Network Advantage license. The Cyber Vision page lists no prices.
- Claroty, Nozomi Networks, Tenable, Forescout and Palo Alto Networks. Their OT product pages list no prices.
Ask each vendor what it counts: sites, sensors or devices. Ask how the count changes when discovery finds devices you did not know you had.
What a deployment requires
NIST says network monitoring in OT is typically deployed on boundary protection devices, using SPAN ports or passive network taps. Microsoft's OT sensors run on a virtual machine or a physical appliance and connect to a SPAN port or tap. They can be connected to the cloud or managed locally, in which case threat intelligence updates are uploaded by hand.
The CISA-led asset inventory guidance sets out the steps: define scope and objectives, identify assets, collect attributes, build a taxonomy, manage the data and manage the asset life cycle. Its high-priority attributes include communication protocols, asset criticality, manufacturer, model, operating system and physical location. It recommends a physical inspection alongside the logical survey.
The same guidance organizes assets into zones and conduits, as the ISA/IEC 62443 series does, and cites ISA/IEC 62443-3-2. It defines a zone as a group of assets that share common security requirements. Conduits are assets dedicated to communications, and they allow only authorized traffic between zones. IEC 62443-3-2 sets requirements for dividing a system into zones and conduits and assessing the risk of each.
Questions to settle first
Settle these before shortlisting.
- Who owns the decision to act on a controller: engineering, the SOC, or both?
- Which sites need on-premises or air-gapped management, and which can send data to a vendor's cloud?
- Where can you take a SPAN or tap feed at each site, and what will each site need in sensors or switches?
- Which regulations apply to you: NIS2, NERC CIP-015, or neither?
- For a vendor that changed owners this year, what changes in its roadmap, support and partnerships?
- What must a pilot on one site find, compared with your own asset register, before you sign?
Ask to contribute
Vendors in this market can ask to answer the six questions for State of Play 2026: OT and ICS Security. Use an email address on your company’s own domain: answers come from the company itself, not from an agency. We email a link to confirm the request.