What is Nozomi Networks?
Nozomi Networks is an OT and IoT cybersecurity vendor whose platform passively monitors industrial networks, inventories every connected device, maps vulnerabilities and detects anomalous behaviour or attacks in industrial control systems. The company was founded in 2013 by the Italians Andrea Carcano and Moreno Carullo and has been a wholly owned subsidiary of Mitsubishi Electric since January 2026. Within OT convergence, Nozomi is, alongside Claroty, Dragos and Tenable OT, one of the best-known platforms for OT monitoring and network detection.
🧠 What exactly does Nozomi Networks do?
Nozomi targets environments where an ordinary IT security tool does not work well: production lines, power plants, water treatment, oil and gas, transport, building management and data centres. These sites run legacy systems that may stay in service for twenty years, have strict availability and real-time requirements, and often cannot be patched for months.
The platform combines four functions:
- Asset Discovery and asset inventory - an automatic overview of PLCs, HMIs, SCADA servers, RTUs, DCS components, sensors, switches and IoT devices, including vendor, model, firmware version and serial number
- Network visibility - a topology map of who talks to whom, over which protocol and how often
- Threat detection - signatures, threat intelligence and behavioural analysis against a learned baseline, comparable to an OT-specific IDS
- Vulnerability management - matching discovered assets to known CVEs and prioritising them by risk
Mitsubishi Electric announced on 9 September 2025 that it would acquire Nozomi in full and completed the acquisition at the end of January 2026. Nozomi continues to operate as an independent brand with a vendor-neutral roadmap, so the platform also monitors environments built on equipment from Siemens, Schneider Electric or ABB. The company reports annual revenue above 100 million US dollars and customers including seven of the ten largest pharmaceutical manufacturers and seven of the ten largest utilities.
🔧 What are the components of the Nozomi platform?
| Component | Type | Function |
|---|---|---|
| Guardian | Network sensor (hardware, virtual, embedded or container) | Passive traffic analysis, asset discovery and detection |
| Guardian Air | Wireless sensor | Visibility into Wi-Fi, Bluetooth and other wireless links on the plant floor |
| Arc | Endpoint sensor | Runs on hosts such as engineering workstations; sees USB use and malicious software, among other things |
| Remote Collector | Lightweight collector | Captures traffic at small or remote sites and forwards it to a Guardian |
| Central Management Console (CMC) | On-premises management | Central view across multiple sensors, including air-gapped networks without internet access |
| Vantage | SaaS platform | Cloud-based management and analysis for large, distributed organisations |
On top of these come subscriptions: Threat Intelligence (detection rules and indicators from Nozomi Networks Labs), Asset Intelligence (enrichment of asset profiles), Smart Polling (targeted active querying) and Vantage IQ (AI-assisted alert analysis). The Nozomi Networks Labs research team investigates ICS threats, responsibly discloses vulnerabilities in industrial products to their vendors and periodically publishes OT/IoT security reports.
📡 How does Nozomi collect data without disrupting production?
The foundation is passive monitoring. A Guardian sensor listens via a SPAN port on a switch or a network TAP and sends no traffic onto the network itself. This matters because active scans in OT can cause controller faults, frozen HMIs, network congestion and, in the worst case, production stops or safety incidents. For environments where any active querying is prohibited, such as nuclear plants or NERC CIP sites, Nozomi can be deployed strictly passively.
Using deep packet inspection, Guardian decodes industrial protocols down to individual commands, including Modbus, Modbus TCP, IP, DNP3, BACnet, OPC UA, IEC 61850 and S7. The platform therefore sees not only that an engineering workstation is talking to a PLC, but also that a program is being downloaded or a firmware update is being started.
Passive listening has a limit: a device that never communicates stays invisible, and some firmware details never cross the network. Two additions address this:
- Smart Polling - low-volume active querying that you can restrict to specific segments or assets, adding operating system, firmware and patch status
- Arc - a lightweight endpoint sensor that runs mostly in user space and analyses local events with Sigma rules, YARA and STIX indicators
Because the sensor only receives a copy of the traffic, it has no effect on the latency, jitter or packet loss of the process network. With a SPAN port, do keep an eye on the load on the switch; a TAP is the most neutral option.
⚠️ What does Nozomi detect in an OT network?
Nozomi combines known attack patterns with behavioural analysis. During a learning phase the platform builds a baseline of normal traffic and normal process variables. After that, every deviation stands out:
| Detection | Possible risk |
|---|---|
| Program download or firmware upload to a PLC | Sabotage or unauthorised change |
| New device on the network | Rogue device or unreported installation |
| Unusual protocol use or unknown function codes | Attack, misconfiguration or fault |
| Unknown laptop running engineering software | Insider threat or uncontrolled vendor access |
| Traffic to a known malicious address | Malware or ransomware |
| Unusual process variable | Manipulation or technical defect |
Alerts are mapped to techniques from MITRE ATT&CK for ICS, so an analyst can see which stage an attack has reached. Besides network traffic, detection draws on threat intelligence indicators and, through Arc, local events on hosts.
For vulnerability management, Nozomi takes OT reality into account: patching is often only possible during a maintenance shutdown and sometimes requires revalidation by the vendor. The platform therefore also supports compensating controls such as network segmentation, blocking unnecessary connections and prioritising by exposure. The asset overview with firmware versions and end-of-life equipment also supports lifecycle management and migration planning for assets.
🔄 How does Nozomi compare with Claroty, Dragos and Tenable OT?
| Platform | Background | Strengths |
|---|---|---|
| Nozomi Networks | Founded in 2013, part of Mitsubishi Electric since 2026 | Passive sensors plus endpoint and wireless sensors, choice of on-premises (CMC) or SaaS (Vantage) |
| Claroty | American-Israeli | Broad CPS coverage including building management and medical devices, plus secure remote access |
| Dragos | American, founded in 2016 | In-depth threat intelligence on industrial threat groups and incident response services |
| Tenable OT | Part of Tenable | Combination of passive and active detection, integration with IT vulnerability management |
Functionally these platforms overlap heavily. The differences lie in architecture, service offering, integrations and partnerships with automation vendors. A proof of concept in your own network tells you more than a feature list.
To work with the IT side, Nozomi delivers alerts and asset data to SIEM, SOAR and XDR platforms and synchronises with a CMDB. A converged SOC can then spot lateral movement from IT into OT more quickly.
🧭 How do you implement Nozomi step by step?
- Define the scope - which sites, production lines and network zones need visibility, and which fall under the Dutch Cybersecurity Act?
- Map the monitoring points - choose per zone the switches where you place a SPAN port or TAP, so that both controller-to-controller traffic and traffic to the supervisory network are visible.
- Place sensors and management - Guardians in the OT network and control network, the CMC in a management zone or the IDMZ, or Vantage if cloud management is allowed.
- Let the baseline learn - allow several days to weeks, depending on production cycles, and review the discovered assets together with process engineers.
- Tune the alerts - assess false positives and the scalability of the set-up, and route the most important alerts to the SIEM and incident procedures.
- Put the insights to work - for segmentation according to the zones and conduits model, vulnerability prioritisation and compliance reporting.
A typical placement in the Purdue Model looks like this:
| Purdue level | What sits there | Role of Nozomi |
|---|---|---|
| Level 0-1 | Sensors, actuators, PLCs and RTUs | Traffic is seen via SPAN/TAP on the switch |
| Level 2 | SCADA, HMIs, engineering workstations | Guardian sensor, optionally Arc on hosts |
| Level 3 | Historian, MES, site servers | Guardian sensor, optionally a local CMC |
| Level 3.5 | IDMZ | Passage for the platform’s management and update traffic |
| Level 4-5 | IT, SOC, cloud | CMC or Vantage, integration with SIEM/SOAR |
Nozomi is often deployed within programmes based on IEC 62443, NIST SP 800-82, NIST CSF, ISO 27001 and NIS2. The Dutch Cybersecurity Act (Cyberbeveiligingswet), which transposes NIS2 and entered into force on 15 August 2026, requires essential and important entities to manage risk, detect threats and report incidents. An up-to-date asset inventory and continuous monitoring are a logical foundation for that, although the law does not prescribe any particular product. ISA-95 and Defense in Depth help connect monitoring to the wider IT/OT architecture and its security layers.
❓ Frequently asked questions
Is Nozomi Networks an IDS?
Nozomi Networks Guardian works as an OT-specific intrusion detection system: it passively analyses network traffic and reports anomalies and attacks. The platform also provides asset discovery, vulnerability management and risk analysis. It does not block traffic itself, as a firewall or IPS would.
Who owns Nozomi Networks?
Nozomi Networks has been a wholly owned subsidiary of Mitsubishi Electric since January 2026. The acquisition was announced in September 2025. Nozomi continues to operate independently under its own brand and with a vendor-neutral roadmap.
Does Nozomi run active scans on the OT network?
Nozomi works passively by default through SPAN ports and TAPs and then sends no traffic onto the network. With the optional Smart Polling it can query devices in a targeted, low-volume way for firmware and patch details. You can restrict that querying per segment or asset, or switch it off entirely.
What is the difference between Nozomi Vantage and the CMC?
Vantage is the cloud-based SaaS management platform of Nozomi Networks, suited to organisations with many distributed sites. The Central Management Console (CMC) is the on-premises option that also works in air-gapped networks without an internet connection. Both collect data from Guardian sensors and provide a central overview.
Which protocols does Nozomi support?
Nozomi Networks uses deep packet inspection to decode a large number of industrial protocols, including Modbus TCP, EtherNet/IP, DNP3, BACnet, OPC UA, IEC 61850 and Siemens S7. It also recognises common IT and IoT protocols. As a result the platform can see commands such as program downloads to a PLC.
Does Nozomi help with NIS2 and the Dutch Cybersecurity Act?
Nozomi Networks provides asset visibility, detection and reporting that fit the duty of care and incident reporting obligations of NIS2 and the Dutch Cybersecurity Act. The law does not prescribe a specific product. A monitoring platform is one tool within broader risk management, alongside segmentation, access control and incident processes.
📌 In summary
Nozomi Networks makes industrial networks visible and detects threats by analysing traffic passively, without disrupting production. With Guardian sensors, additional endpoint and wireless sensors, management through the CMC or Vantage and integrations with SIEM and SOC, the platform helps organisations know their OT assets, prioritise vulnerabilities and work towards IEC 62443, NIS2 and the Dutch Cybersecurity Act.