Dragos

What is Dragos?

Dragos is an American cybersecurity company that focuses exclusively on OT and industrial control systems (ICS), offering a monitoring platform for OT networks, threat intelligence on industrial threat groups and services such as incident response and threat hunting. The company was founded in December 2016 by Robert M. Lee, Jon Lavender and Justin Cavinee, who previously worked on critical infrastructure protection for US government agencies. Dragos is best known for its analyses of ICS malware such as CRASHOVERRIDE, TRISIS and PIPEDREAM and for its annual OT Cybersecurity Year in Review. Within OT convergence, Dragos is, alongside Claroty, Nozomi and Tenable OT, one of the best-known vendors of OT monitoring.

🧠 What exactly does Dragos do?

Dragos combines three things that are often sold separately in the OT security market: technology, threat intelligence and people.

• Dragos Platform - software that passively monitors the OT network, inventories assets, prioritises vulnerabilities and detects attacks.
• Threat intelligence - under the name WorldView, Dragos tracks threat groups that target industrial environments and publishes reports and advisories.
• Services - incident response, OT assessments, red teaming, tabletop exercises and the threat hunting service OT Watch (since April 2020).

The company focuses on sectors with cyber-physical systems where an attack can have physical consequences: electricity, oil and gas, water, chemicals, pharmaceuticals, transport and manufacturing. Dragos uses the term xOT for all operational technology, from industrial sensors, PLCs and SCADA to building management and industrial IoT.

🔧 How does the Dragos Platform work?

The platform works largely through passive monitoring. Sensors listen to copies of network traffic via SPAN ports or network TAPs in the OT network, the control network and the supervisory network. A central server per site collects the data; with multiple sites, an aggregating layer sits above it, often in or next to the IDMZ.

Because the sensors only listen, they put no load on the process network. That matters in OT: active scans can crash older PLCs and HMIs, cause network congestion and so disturb the latency of control traffic. Where passive listening does not yield enough information, the platform can perform targeted, limited active queries.

Using deep packet inspection, the platform dissects industrial protocols, including:

• Modbus and Modbus TCP
• IP and CIP
• DNP3 and IEC 61850 in the energy sector
• S7 from Siemens
• OPC UA and BACnet

From that traffic the platform automatically builds an asset inventory with manufacturer, type, firmware version, protocols used and communication relationships. This is the basis for asset discovery, vulnerability management and lifecycle management of ageing equipment.

🔐 How does Dragos detect threats?

Dragos emphasises detection based on threat behaviour rather than anomalies alone. Detections are based on techniques from MITRE ATT&CK for ICS and on what Dragos analysts see in real incidents. The platform also uses anomaly detection, configuration checks and indicators of compromise (IOCs).

Alerts go to a SIEM, SOAR or XDR, so a SOC or OT SOC can correlate OT and IT events. Dragos supplies playbooks with investigation steps for its detections, because SOC analysts with an IT background often struggle to assess OT alerts otherwise. An AI assistant (EmberAI) supports analysts in summarising and investigating alerts.

🧠 What role does Dragos play in OT threat intelligence?

Dragos is one of the most important public sources on industrial attackers and therefore on the security of critical infrastructure. The company names threat groups after minerals, such as ELECTRUM, XENOTIME, CHERNOVITE, VOLTZITE and BAUXITE. According to the OT Cybersecurity Year in Review of February 2026, Dragos tracks 26 OT threat groups, 11 of which were active in 2025.

In 2015 Robert M. Lee published the ICS variant of the Cyber Kill Chain with Michael Assante at SANS, and in 2022 he wrote the SANS ICS Five Critical Controls with Tim Conway. These frameworks are reflected in Dragos products and advice. Do read vendor figures critically, though: they come from the vendor’s own customer base and incidents.

🏭 What does the 2026 Year in Review show?

The ninth Year in Review (17 February 2026) paints a picture of practice that European organisations will also recognise:

• Ransomware is growing - Dragos tracked 119 ransomware groups that hit around 3,300 industrial organisations, up from 80 groups a year earlier. More than two thirds of victims were in manufacturing.
• Access via remote access - in 73% of all incident response cases to date, stolen VPN or jump host credentials played a role.
• Segmentation and monitoring fall short - 81% of assessments found weak separation between IT and OT, and only 46% had adequate OT network monitoring.
• Attackers go unnoticed - 56% of penetration tests used living-off-the-land tools without triggering an alert, and 88% of tabletop exercises revealed weaknesses in detection.
• Prioritising vulnerabilities - only 3% of OT vulnerabilities required immediate action, 71% could be handled with compensating controls or at the next maintenance window, and 27% did not need remediating.

That split matches the OT reality of vulnerability management: patching is often only possible during a shutdown, so network segmentation, monitoring and compensating controls carry a lot of weight.

🧱 How do you deploy Dragos in an industrial environment?

A typical deployment at, for example, a grid operator or drinking water company proceeds in steps:

1. Scope and architecture - map the network according to the Purdue Model and decide which zones and conduits (Zones and Conduits Model) need monitoring.
2. Sensor placement - place sensors at SPAN or TAP points at levels 1 to 3: at the core switches of the process network, around SCADA servers and on the conduits to the IDMZ. Make sure traffic between controllers is visible too.
3. Baseline and inventory - let the platform learn for a few weeks and check the asset inventory together with the process owners. Unknown devices often turn out to be temporary vendor laptops.
4. Integration - connect alerts to the SIEM, ticketing and CMDB, and agree who assesses OT alerts outside office hours.
5. Prepare response - draw up an OT-specific incident response plan and exercise it, because in OT you cannot simply switch systems off without process consequences.

In the Netherlands this supports the duty of care and reporting obligation of the Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026), the Dutch transposition of NIS2. Detection and an up-to-date asset inventory are also baseline requirements in IEC 62443, NIST SP 800-82 and the NIST CSF. For organisations that also manage information security according to ISO 27001, the platform provides evidence for the OT side of compliance. ISA-95 and Defense in Depth remain the architectural framework in which monitoring is one of the layers.

🔄 How does Dragos compare with other OT security vendors?

The best-known OT monitoring platforms offer similar core functions: passive monitoring, asset inventory, vulnerability management and detection. The differences lie mainly in emphasis.

Dragos grew quickly: in October 2021 it raised 200 million dollars at a valuation of 1.7 billion dollars. In July 2025 Dragos acquired Network Perception for segmentation validation, followed in 2026 by Phosphorus for managing OT and IoT devices. In June 2026 Accenture announced it would take a majority stake in Dragos and fully acquire runZero (asset discovery) and NetRise (firmware and SBOM analysis), for around 4.2 billion dollars in total. runZero and NetRise were then brought under Dragos, which continues as an independent business under CEO Robert M. Lee.

❓ Frequently asked questions

Is Dragos a product or a company?

Dragos is a company, Dragos Inc., that provides both software and services. Its main product is the Dragos Platform for OT monitoring; in addition, Dragos offers threat intelligence (WorldView) and services such as incident response and OT Watch.

Does Dragos work without disrupting the OT network?

Yes, the Dragos Platform works mainly passively via SPAN ports and network TAPs and then sends no traffic to PLCs or other controllers. This makes it suitable for production networks in which active scans can cause outages.

What is the Dragos Year in Review?

The Dragos Year in Review is an annual report on the OT threats of the previous year, based on Dragos incidents, assessments and intelligence. The February 2026 edition lists 26 tracked threat groups and 119 ransomware groups that hit industrial organisations.

Why does Dragos name threat groups after minerals?

Dragos uses mineral names such as ELECTRUM, XENOTIME and VOLTZITE to track groups based on observed behaviour in OT, independent of political attribution. As a result, Dragos names often overlap partly, but not always fully, with names used by other companies, such as Sandworm or Volt Typhoon.

Is Dragos suitable for smaller organisations?

The Dragos Platform is aimed mainly at medium-sized and large asset owners with an in-house or outsourced SOC. For smaller utilities and industrial organisations, Dragos offers free resources, training and support through OT-CERT and the Community Defense Program.

Does Dragos help with NIS2 and the Dutch Cybersecurity Act?

Dragos can help with NIS2 and the Dutch Cybersecurity Act by providing an up-to-date asset inventory, incident detection and evidence for the reporting obligation. The law itself does not prescribe a specific product: it requires appropriate measures, and OT monitoring is one part of those.

📌 In summary

Dragos is a specialist OT cybersecurity company that combines a passive monitoring platform, threat intelligence on industrial threat groups and OT incident response. Its strength lies in its knowledge of real attacks on ICS, from CRASHOVERRIDE to FrostyGoop. The platform works best as part of a broader approach with segmentation, detection, monitoring and an exercised response plan in line with IEC 62443.