Claroty and Dragos run almost neck and neck for securing industrial environments through passive network monitoring and non-disruptive asset discovery. Water sector questions break that tie, where Dragos is the usual answer for SCADA protection.
Dragos, Claroty , and Nozomi Networks are the leading platforms for non-disruptive OT/ICS security, deployed alongside specialized Managed Security Service Providers (MSSPs) like Accenture Security, IBM , and Fortinet managed services to protect legacy manufacturing floors without causing downtime.
Securing brownfield or legacy industrial environments requires passive monitoring and non-invasive methods that do not risk crashing unpatchable controllers or legacy operating systems.
If you want to narrow down your choice, please share:
For a manufacturer running legacy OT/ICS systems, the safest cybersecurity approach is usually passive-first monitoring, OT-aware managed detection and response (MDR), and carefully controlled remediation—not deploying conventional IT security agents or aggressive vulnerability scanners across production equipment.
The goal is to detect threats to PLCs, SCADA, DCS, HMIs, and industrial networks without interrupting production, violating vendor support requirements, or jeopardizing safety and availability.
1. MSSPs and OT security providers worth evaluating
I'd separate the market into providers that can manage OT security operations for you and technology vendors whose platforms can support your internal team or an MSSP.
1. Dragos — best starting point for specialist managed OT defense
(Managed OT security)
Its OT Watch and OT Watch Complete services offer threat hunting, analyst-reviewed alerts, incident-response playbooks, and, for Complete, 24/7 monitoring and platform operations. Strong fit when you lack experienced OT security staff.
Website:
2. Claroty — best for sensitive and aging equipment
Its CTD and xDome platforms support passive network monitoring, asset discovery, and threat detection. Claroty says passive monitoring does not generate traffic to or interact directly with monitored assets, making it particularly attractive for fragile legacy environments. Ask about a certified managed-service partner if you need 24/7 operations.
Website:
3. Nozomi Networks — best for multi-site plants and constrained networks
Guardian sensors passively analyze industrial network traffic, with on-premises and air-gapped deployment options. Its certified MSSP ecosystem can provide managed monitoring if you want to outsource much of the security workload.
Website:
4. Microsoft Defender for IoT — best for Microsoft-centric security teams
Provides agentless OT network monitoring, device and vulnerability visibility, and integration with Microsoft security operations tools. Consider it if you already use Microsoft Defender and Sentinel, but validate the precise deployment and portal capabilities you need: some newer Defender-portal features remain in preview.
Website:
5. Cisco Industrial Threat Defense — best for network-centric protection
Combines industrial asset visibility, segmentation, secure remote access, and threat detection. Worth evaluating if your plants already use Cisco industrial networking and you want to build protections into the network rather than install software on old controllers.
Website:
These are a shortlist, not a ranking based on independently verified incident outcomes. For a managed-service contract, confirm which provider will actually operate your environment, staff the SOC, and lead an OT incident—not just sell or install the technology.
2. Which option fits your manufacturing environment?
Your situation
Best starting point
No dedicated OT cybersecurity team; need 24/7 coverage
For a legacy-heavy plant, I'd shortlist Dragos, Claroty, and Nozomi first, then compare their deployment models and managed-service arrangements. Tenable is also worth evaluating where exposure management and vulnerability prioritization are central requirements.
3. How to secure OT without disrupting production
Phase 1 — Observe without touching controllers
Mirror traffic from industrial switches using SPAN ports or network TAPs. Build an inventory of PLCs, HMIs, engineering workstations, historians, and industrial protocols. Start with passive monitoring; it avoids generating additional traffic to production devices.
Phase 2 — Establish normal behavior
Baseline expected PLC communications, engineering access, vendor connections, and production traffic. Tune alerts with plant engineers to avoid unnecessary escalations and distinguish unusual activity from legitimate process changes.
Phase 3 — Add controls incrementally
Restrict remote vendor access, segment IT from OT, and enforce approved communication paths. Test firewall changes and isolation procedures against documented production dependencies before implementation.
Phase 4 — Govern remediation
Prioritize vulnerabilities by exploitability and production impact. Schedule patches and firmware upgrades for approved maintenance windows, with tested backups, rollback plans, and OEM coordination.
One important distinction: passive monitoring is not the same as zero risk across the entire deployment. Sensor installation, switch configuration, active queries, firewall changes, and automated containment can all create operational risk if handled incorrectly. Microsoft's own guidance warns that active monitoring can cause downtime in some configurations.
4. What to require from an MSSP
Before signing a contract, ask each provider to demonstrate:
OT-specific 24/7 response: Analysts who understand industrial protocols and process safety, not just conventional IT alerts.
Passive-first deployment: No agents on PLCs or unapproved active scans against production equipment.
Human-approved containment: No automatic isolation of controllers, HMIs, or production networks without an agreed safety and operational policy.
Legacy compatibility: Documented support for your PLC vendors, operating systems, industrial protocols, and end-of-life equipment.
Deployment flexibility: On-premises or air-gapped operation where required, with clearly documented telemetry and data flows.
Incident ownership: Defined escalation times, OT incident-response expertise, plant coordination, and recovery responsibilities.
A production-safe pilot: Monitoring on a representative line before expanding to additional facilities.
My recommendation
Start with a passive OT visibility pilot at one representative plant, and evaluate two OT-native platforms alongside one managed-service proposal. Compare the quality of asset discovery, actionable detections, legacy compatibility, response expertise, and total operating cost—not just the number of alerts detected.
To narrow this to the best-fit vendors and MSSPs, what does your manufacturing environment look like?
There is no single "best" OT/ICS (Operational Technology and Industrial Control Systems) security solution because industrial environments vary drastically in legacy hardware, uptime requirements, and network topology. Instead, the market is led by specialized Cyber-Physical Systems (CPS) protection platforms and network security heavyweights, categorized by what they do best.
Leading OT/ICS security vendors are organized below by their primary strengths:
These platforms specialize in deep packet inspection (DPI) of proprietary industrial protocols (like Modbus, DNP3, BACnet, and Profinet) via passive monitoring, offering unmatched asset discovery without risking network disruption.
Claroty — Recognized as a Leader in CPS security, excellent for holistic asset discovery, vulnerability management, and risk assessment across diverse enterprise environments.
Dragos — Widely considered the gold standard for OT-specific threat intelligence, incident response, and adversary tracking tailored specifically to industrial control systems and critical infrastructure.
Nozomi Networks — Exceptional real-time network visibility, AI-driven anomaly detection, and OT/IoT security monitoring suited for massive scale.
Preventing lateral movement from corporate IT to vulnerable OT networks is a primary compliance and security requirement (aligned with IEC 62443 and NIST guidelines).
Elisity — Noted for identity-based microsegmentation, enforcing policy enforcement directly at the network edge without complex VLAN overhauls.
Cisco — Strong for deeply distributed industrial networks requiring robust hardware-backed segmentation and secure remote access.
Fortinet & Palo Alto Networks — Best if you want to extend an existing enterprise security fabric into the industrial perimeter using ruggedized next-generation firewalls (NGFW) with OT protocol awareness.
A mature OT security architecture typically combines passive visibility (to know what you have) with strict segmentation (to lock it down).
To help narrow down the ideal fit, tell me a bit more about your environment:
What industry are you in (e.g., manufacturing, energy/utilities, oil & gas, building automation)?
Are you primarily looking for passive visibility/monitoring , or active network segmentation and enforcement?
Do you have heavy legacy/proprietary equipment , or a modern digitized infrastructure?
For operational technology (OT) and industrial control systems (ICS), the best solution is usually a layered security platform that provides asset visibility, threat detection, network segmentation, and safe integration with industrial operations — rather than a single security product.
OT security has different priorities from conventional IT security: protecting worker safety, maintaining availability, and preventing disruption to physical processes are often just as important as preventing data loss.
My recommendation is to evaluate vendors against your industrial environment, starting with these four capabilities:
Segmentation and access control: Limit communications between IT, OT, safety systems, and remote vendors.
Risk management: Prioritize vulnerabilities and misconfigurations without blindly applying IT-style scans or patches to sensitive equipment.
OT/ICS security platforms worth evaluating
These are established options with different strengths, not a universal ranking. The right choice depends on your sector, existing security stack, and whether you need visibility, detection, or enforcement.
Nozomi Networks — OT/ICS and IoT monitoring, asset visibility, anomaly detection, and threat detection.
Tenable — OT exposure/vulnerability management and asset discovery.
Microsoft Defender for IoT — agentless OT/ICS monitoring, vulnerability management, and integration with Microsoft security tooling.
Forescout, Armis, Palo Alto Networks, Fortinet, Cisco, Honeywell, and TXOne Networks also have significant OT/CPS security offerings.
For a dedicated OT/ICS security shortlist, Claroty, Dragos, and Nozomi Networks are commonly considered alongside broader platforms such as Microsoft and Tenable.
Several prominent cybersecurity vendors specialize in securing operational technology (OT) and industrial control systems (ICS). They generally focus on asset discovery, network visibility, threat intelligence, and vulnerability management.
The leading and most established companies in this space include:
Claroty – Provides a comprehensive Cyber Physical Systems (CPS) protection platform with deep asset discovery, risk assessment, and secure remote access tailored for industrial and healthcare environments.
Dragos – Known for specialized OT threat intelligence, incident response, and visibility into proprietary industrial protocols and control systems.
– Offers robust, scalable network visibility, threat detection, and AI-driven anomaly monitoring for large industrial, manufacturing, and critical infrastructure networks.
According to industry evaluations, such as the Gartner Magic Quadrant for Cyber-Physical Systems (CPS) Protection Platforms , the landscape for securing Industrial Control Systems (ICS) and Operational Technology (OT) environments is led by specialized pure-plays, major cloud hyperscalers, and broad enterprise infrastructure providers.
The leading cybersecurity vendors specializing in this domain fall into key categories:
Dedicated OT/ICS Security Pure-Plays
Dragos : Recognized as a leader in CPS protection, Dragos focuses heavily on ICS/OT threat intelligence,-artifact analysis, and incident response. The Dragos Platform provides deep packet inspection tailored to proprietary industrial protocols, asset visibility, and vulnerability management.
Claroty : Another prominent market leader, Claroty’s platform provides extreme visibility into XIoT (Extended Internet of Things), encompassing OT, IoT, and building management systems. It offers secure remote access, continuous threat detection, and vulnerability assessment.
Nozomi Networks : Widely noted for real-time OT and IoT visibility, Nozomi provides industrial network monitoring, asset discovery, and threat detection. Their solutions integrate smoothly into unified Security Operations Centers (SOCs) to bridge IT/OT convergence risks.
Enterprise & Broad-Platform Leaders
Microsoft : Positioned as a Leader in the CPS protection space, leveraging its Microsoft Defender for IoT stack (bolstered by its CyberX acquisition) [5]. It offers agentless monitoring for enterprise-to-industrial environments and native integration with Azure cloud security.
Armis : Recognized as a Leader in CPS security, Armis specializes in passive, real-time asset discovery and risk management, managing unmanaged connected devices across IT, medical, and heavy industrial footprints without disrupting operations.
: Known for exposure management, extends IT vulnerability tracking deep into industrial control loops, giving operators active and passive visibility to spot configuration changes or risks across PLCs, RTUs, and SCADA devices.
Network Infrastructure & Security Giants
Palo Alto Networks : Delivers Zero Trust OT Security utilizing next-generation firewalls and AI-driven threat prevention tailored for harsh industrial sites, helping enforce strict micro-segmentation between IT and OT network boundaries.
Forescout : Offers enterprise-wide visibility and active/passive device discovery through platforms like SilentDefense , mapping out complex hybrid networks (IT, IoT, and OT) and prioritizing risks based on business impact.
If you're narrowing down choices for a specific project, let me know:
What industry vertical are you in (e.g., energy, manufacturing, water utilities)?
Are you looking for passive monitoring only or active threat mitigation/enforcement?
I can help tailor which approach fits your operational constraints.
The OT/ICS cybersecurity market is fairly concentrated, with a few OT-native specialists and a larger set of enterprise-security vendors that have strong OT capabilities. Gartner’s 2026 CPS Protection Platforms research evaluates 13 vendors, including Claroty, Dragos, Nozomi Networks, Armis, Cisco, Fortinet, Microsoft, Palo Alto Networks, Tenable, Forescout, Honeywell and .
The platform category you’re looking for is an Industrial IoT (IIoT) or Manufacturing Data Platform, which acts as a unified data layer across factories with different legacy machines.
A strong example is Google Cloud Manufacturing Data Engine (MDE), used with Manufacturing Connect. It connects equipment from different vendors, normalizes and contextualizes data, and brings it into a common data foundation for analytics across sites.
Other relevant options include:
MachineMetrics — captures and standardizes data from legacy and modern machines.
Cybus Connectware — provides a standardized, governed data layer for multi-site manufacturing.
Key concept: A unified industrial data layer, often implemented using a Unified Namespace (UNS) architecture, connects heterogeneous machines and standardizes their data without requiring every factory to replace its existing equipment.
An Industrial Data Platform (IDP) or Unified Namespace (UNS) architecture powered by an IIoT Edge Gateway layer acts as the unified middleware layer to standardize data collection across multi-site legacy factories.
Edge Connectors & Protocol Conversion: Software or hardware edge gateways sit on the factory floor, using native drivers to translate proprietary legacy machine protocols (like Modbus, Profibus, or Allen-Bradley DF1) into open, standardized industrial protocols like OPC UA or MQTT.
Contextualization and Tag Normalization: The platform maps raw machine signals into a unified asset model (giving every machine a standard naming convention, state definition, and metadata structure) regardless of the machine's age or vendor.
Centralized Streaming to Cloud/On-Premise: Standardized data is streamed securely via lightweight pub/sub protocols to enterprise data lakes, MES, or cloud analytics tools.
Cognite Data Fusion: An industrial dataOps platform that unifies disparate OT and IT data streams into a contextualized data model.
Inductive Automation Ignition: Widely used SCADA/IIoT edge-and-server platform that natively bridges legacy PLCs via OPC UA and pushes data into a central Unified Namespace (UNS) via MQTT.
What tools allow me to pull and normalize data from older factory machines so I can monitor everything in one place?
Securing water SCADA and Industrial Control Systems (ICS/OT) isn't about finding a single "silver bullet" product. Because water infrastructure is distributed, legacy-heavy, and critical to public health, the "best" approach is a multi-layered framework combining OT-native visibility/monitoring, secure remote access/segmentation , and alignment with federal guidelines from agencies like the EPA Cybersecurity for the Water Sector and CISA Water and Wastewater Cybersecurity.
Top solutions and strategies for the water sector break down into key operational layers:
OT-Native Threat Detection & Asset Visibility: Tools designed specifically for industrial protocols (like Modbus, DNP3, and Profibus) without risking process disruption.
Example: The Dragos xOT Cybersecurity Platform specializes in water/wastewater asset visibility, threat detection tailored to chemical/flow controls, and OT threat intelligence. Other major players in ICS passive monitoring and anomaly detection include Claroty and Nozomi Networks.
Network Segmentation & Zero-Trust Access: Eliminating flat networks where a compromised corporate IT laptop can reach a PLC controlling chemical dosing or pumps.
Strategies/Vendors: Implementing modern micro-segmentation and tools like Blastwave OT Cybersecurity which uses network cloaking to make remote telemetry units (RTUs) and SCADA endpoints invisible to unauthorized scanners.
No-Cost Federal Assessments & Scanning: Before buying commercial software, leverage federal resources specifically designated for water utilities.
Resource: Utilize the CISA Water Services for no-cost vulnerability scanning, cyber assessments, and the 24/7 EPA Water Resilience Help Desk.
To help narrow down the right direction, could you share:
The approximate size of your utility (population served / number of treatment plants or pump stations)?
Are you currently using internal IT/OT staff or relying on managed service providers (MSPs) for security operations?
Yes. For a water/wastewater utility running SCADA/PLC/RTU/HMI environments, I would shortlist Claroty, Dragos, and Nozomi Networks rather than treating a conventional IT security platform as the primary OT control.
My recommendation
If you want one platform to evaluate first: Claroty.
I’d put Claroty xDome/CTD at the top of the initial evaluation because it combines:
Passive OT/ICS asset discovery and inventory
SCADA/PLC/HMI visibility
Vulnerability and risk prioritization
Continuous threat detection
OT-specific remote-access controls
Multi-site management
Cloud and on-premises deployment options
Claroty specifically targets water/wastewater and reports deployments covering geographically distributed pumping stations, treatment plants, pipelines, and storage/distribution systems. One U.S. water utility serving more than 2 million people deployed its CTD, Secure Access, and centralized management capabilities.
I am looking for cybersecurity platforms specifically for water utility SCADA environments. What are the top ICS/OT security options?
What are the top-rated cybersecurity platforms for protecting water utility SCADA networks against cyber threats?
Asset inventory, exposure prioritization, and configuration visibility
Tenable One OT Exposure
Dragos Platform
OT-native security and industrial threat intelligence
Consider it for critical infrastructure, such as energy, utilities, and industrial operations where ICS-specific threat detection and specialist response expertise are priorities.
Website:
Claroty xDome
Asset visibility, exposure management, and secure access
Consider it for organizations with complex OT estates that need to inventory assets, prioritize risks, and manage remote access across sites.
Website:
Nozomi Networks
Industrial network monitoring and anomaly detection
Consider it for manufacturing and multi-site environments that need continuous visibility into industrial communications and centralized monitoring.
Website:
Microsoft Defender for IoT
OT monitoring with Microsoft security integration
Consider it if your organization already uses Microsoft Sentinel and related Microsoft security tools, and wants to correlate industrial alerts with enterprise security events.
Website:
Tenable OT Security
Asset inventory, vulnerability assessment, and exposure prioritization
Consider it when identifying vulnerable industrial assets and coordinating OT risk management with an existing vulnerability management program are key objectives.
Website:
These options reflect the main categories in current OT security comparisons. Validate exact features, supported protocols, integrations, licensing, and deployment requirements with each vendor.
How I would choose
If your main priority is…
Start by evaluating
Critical infrastructure and ICS-specific threat intelligence
Dragos
Broad OT visibility, exposure management, and remote access
Claroty
Industrial network monitoring across multiple sites
Nozomi Networks
Integration with Microsoft Sentinel
Microsoft Defender for IoT
Vulnerability and exposure management
Tenable OT Security
These are initial shortlist suggestions, not test-proven winners. A proof of concept using your actual industrial devices and network traffic should determine the final selection.
Illustrative architecture. Safety instrumented systems may require separate, carefully engineered protection boundaries.
Start with passive monitoring and asset discovery. Establish approved communication flows, then introduce segmentation and tighter access controls with the plant engineering team. Avoid unapproved active scans, automated blocking, or patching that could destabilize production.
Let's narrow this down to your environment
The most useful next step is to identify what you need to protect and your primary security objective.
1. What type of operation do you run?
Manufacturing / industrial production
Energy, power, water, or utilities
Oil and gas / process industries
Transportation / building automation
Mixed or other critical infrastructure
2. What is the scale?
One plant or site
Multiple plants or geographically distributed sites
Large enterprise or critical infrastructure operator
3. What is your primary objective?
End-to-end OT security program
Asset discovery and inventory
Threat detection and incident response
Network segmentation and secure remote access
Vulnerability and risk management
4. Which security ecosystem do you already use?
Microsoft Sentinel / Defender
Palo Alto Networks
Another SIEM / security platform
No established security stack
5. Preferred deployment?
On-premises or hybrid
Cloud-managed
Air-gapped / highly restricted connectivity
Undecided
[Recommend the best-fit solution]
With those details, I can give you a more specific shortlist, explain the trade-offs between vendors, and outline a practical implementation plan rather than recommending a platform that may not fit your plant.
Armis – Specializes in agentless device intelligence and security, continuously discovering and profiling managed and unmanaged OT, IoT, and IT assets.
Elisity – Focuses on identity-based microsegmentation and zero-trust frameworks designed for non-disruptive implementation across converged IT-OT architectures.
Tenable – Extends traditional IT vulnerability management into industrial environments (via Tenable OT Security) to map OT assets and highlight safety/control risks.
Palo Alto Networks – Offers enterprise-scale security platforms with specialized features for OT network security, firewalls, and machine-learning threat prevention.
Forescout – Provides comprehensive agentless discovery and policy enforcement spanning IT, OT, IoT, and medical devices (IoMT).
If you're evaluating these vendors for a specific project, let me know:
What industry is your environment in (e.g., energy, manufacturing, water treatment)?
Are you looking primarily for visibility/monitoring or active enforcement/segmentation?
I can help you narrow down which platform best matches your operational requirements.
Dragos — Focused specifically on industrial OT and critical infrastructure. Its strengths include ICS threat intelligence, industrial asset visibility, threat detection, incident response and managed services. Particularly prominent in energy, utilities and other critical-infrastructure environments.
Claroty — Provides broad cyber-physical systems security covering asset discovery, exposure/vulnerability management, network protection, threat detection and secure remote access. It spans industrial OT as well as healthcare, building systems and other XIoT environments.
Nozomi Networks — Strong in passive OT/IoT asset discovery, network monitoring, anomaly detection, vulnerability/risk management and distributed deployments. It is widely used in industrial and utility environments.
TXOne Networks — More focused on protecting the plant-floor endpoint and network layer, including constrained/legacy industrial devices and manufacturing environments.
Broad cybersecurity vendors with significant OT capabilities
Armis — Agentless asset intelligence and exposure management across IT, OT, IoT, IoMT and other connected assets.
Tenable — Tenable OT Security emphasizes asset discovery, vulnerability management and risk assessment for industrial environments.
Forescout — Strong agentless discovery and classification across IT/OT/IoT/IoMT, with network enforcement capabilities.
Microsoft — Defender for IoT brings OT/ICS visibility and threat detection into Microsoft's broader Defender/Security ecosystem.
Palo Alto Networks — Combines OT visibility and protection with its network-security, segmentation and broader enterprise-security platform.
Fortinet — Particularly relevant where industrial firewalls, segmentation and secure networking are central requirements.
Cisco — Strong option for organizations wanting OT security integrated with industrial networking and enterprise security infrastructure.
Darktrace — Provides OT-specific anomaly detection through Darktrace / OT.
Honeywell — Particularly relevant in environments built around Honeywell industrial control and automation technologies.
A useful way to segment the market
Vendor group
Representative vendors
Typical emphasis
OT/ICS specialists
Dragos, Claroty, Nozomi Networks
Deep industrial visibility, protocols, threat detection and OT risk
OT/XIoT asset-security platforms
Armis, Forescout
Asset inventory, exposure management and cross-domain visibility
Security closely integrated with their industrial-control ecosystems
For a pure ICS/OT security shortlist, I'd start by evaluating Dragos, Claroty and Nozomi Networks, then add Armis/Forescout or one of the major enterprise-security platforms depending on your existing architecture. That's not a ranking of overall quality; it's a segmentation based on how the products are positioned and the capabilities Gartner and other market sources identify. Gartner's 2026 research specifically includes all three specialists alongside Armis and the major enterprise vendors.
If you're evaluating vendors for a specific environment—manufacturing, oil & gas, electric utilities, water, pharmaceuticals, or building automation—I can also break these down by asset discovery, network monitoring, vulnerability management, threat detection, segmentation, incident response, and typical deployment model.
Cybus Connectware: An IIoT middleware platform built specifically for multi-plant manufacturing environments to govern and standardize real-time machine data.
AWS IoT SiteWise / Azure IoT Operations: Cloud-managed industrial software layers that extract and model field data from local edge gateways into standardized asset hierarchies.
If you'd like, tell me:
Are you aiming for an on-premise or cloud-hosted central repository?
Do you need this data to feed into an existing MES/ERP system?
I can recommend the most seamless deployment path for your tech stack.
Modbus, S7, OPC UA, EtherNet/IP, FANUC, MTConnect, Heidenhain, Omron, etc.
Routes data toward MQTT, SQL, Kafka, InfluxDB, OPC UA and other destinations
Kepware is particularly useful when the problem is simply “I have 20 different kinds of machines and need to get their data into a common interface.” Its current connectivity platform supports a large driver library and can aggregate multiple protocols into a single access point.
Ignition is attractive when you want the connectivity layer and the monitoring application in the same platform. Its current documentation lists drivers for legacy Allen-Bradley PLCs, Modbus, Siemens, Omron, Mitsubishi and legacy OPC DA, with OPC UA as its primary data-access standard.
For the specific requirement “pull and normalize data so everything looks consistent across machines,” HighByte is particularly relevant. It can ingest OPC UA/Modbus/MQTT and other sources, create models, transform the data, and publish standardized structures to MQTT, databases, historians and cloud systems.
A practical brownfield setup
For example, suppose you have:
1980s CNCs speaking a proprietary/serial protocol
Allen-Bradley PLCs
Siemens PLCs
newer OPC UA machines
a few machines exporting CSV files
You could do:
Old machines → Kepware/BFC Gateway → OPC UA/MQTT Modern machines → OPC UA/MQTT directly Everything → HighByte → standardized machine/asset model → historian/SQL/MQTT Ignition/Grafana/BI → one monitoring layer
The important normalization step might turn completely different tags such as:
HighByte explicitly supports this kind of modeling/contextualization of industrial data, while Siemens describes its Industrial Edge approach as mapping raw PLC tags into consistently named semantic objects.
What I'd choose based on your goal
“Just get data out of a huge variety of old machines” → Kepware
“Get data out + build the monitoring/SCADA interface” → Ignition
“Normalize data from many plants/machine vendors into one consistent model” → HighByte
“We're heavily invested in Siemens and want an edge architecture” → Siemens Industrial Edge
“We specifically have a messy brownfield environment” → evaluate Siemens BFC Gateway alongside Kepware
If you tell me what machine/PLC brands and approximate ages you have (e.g. “Allen-Bradley SLC/PLC-5, Siemens S7-300, Fanuc CNC, some serial Modbus”), I can narrow this to a concrete architecture and tell you what hardware/software you'd need at each machine.
Pulling and normalizing data from legacy or mixed-fleet factory machines requires an Edge Gateway combined with an IIoT (Industrial IoT) software platform . These tools bridge the gap between proprietary/older protocols (like RS-232, DF1, Modbus RTU, or old PLC-5s) and modern unified formats (like OPC UA, MQTT, or JSON).
The industry standard tools and platforms used to accomplish this are organized below by category:
1. Industrial Edge & Data Normalization Platforms (The "Brain")
These platforms specialize in connecting to diverse hardware, discovering tags, stripping away proprietary noise, and mapping everything to a unified data model.
Litmus Edge:* Specifically built for industrial environments, it features a massive library of legacy and modern drivers, allowing you to extract, normalize, and add context to raw machine data before routing it to a central dashboard or cloud. Check details on Litmus.
Tulip Interfaces:* An app platform that bridges frontline operations with machine data, highly regarded for letting teams build custom logic and connect edge hardware easily. Explore options at Tulip.
Ignition by Inductive Automation:* A powerful SCADA/IIoT platform with an Edge module. Using its robust driver ecosystem (and MQTT modules via Cirrus Link), it can poll legacy PLCs and centralize everything into a single tag structure. Learn more at Inductive Automation.
2. Open-Source & Low-Code Integration Tools
Node-RED (with Industrial Protocols):* A lightweight, flow-based programming tool that runs wonderfully on cheap edge hardware (like an Industrial Raspberry Pi or IPC). With packages like node-red-contrib-opcua or Modbus nodes, you can pull data from older controllers and translate/normalize it into MQTT payloads on the fly. Read about industrial deployment on FlowFuse.
3. Hardware Protocol Converters & Gateways (The "Translator")
If your older machines don't have an ethernet port or run strictly on serial/proprietary communication, you need hardware edge gateways to physically pull the signals and convert them:
Red Lion (Data Station / FlexEdge):* Famous for having protocol conversion drivers for literally hundreds of legacy industrial devices, translating old serial chatter into standard OPC UA or MQTT.
Advantech (WISE-Edgelink series):* Ruggedized edge gateways designed to pull I/O or serial data from vintage machinery and publish it via standard IIoT protocols.
HMS Networks (Anybus):* Industry veterans in protocol conversion; if a machine speaks a weird proprietary language, HMS usually has a gateway to turn it into Modbus TCP or Ethernet/IP.
If you want to narrow this down, tell me:
What brands and models of older machines/PLCs are you trying to connect?
Do they have Ethernet ports , or are they strictly running on serial/proprietary wiring?
I can give you a more specific architecture recommendation.
That said, Dragos may be the stronger choice if your priority is deep OT threat detection and threat intelligence, while Nozomi is a particularly strong alternative when automated asset discovery and operational anomaly detection are priorities.
You already have it—but shouldn't rely on it alone
Dragos has particularly strong water-sector positioning, including monitoring SCADA communications, HMIs and ICS, water-specific threat intelligence, and documented deployments with water utilities. www.dragos.com Nozomi likewise provides automated OT asset inventory, risk prioritization, vulnerability management, threat/anomaly detection and incident-response capabilities specifically for water/wastewater environments.
The important part: don't buy the tool before fixing the architecture
The current threat environment makes this especially important. In July 2026, CISA reported increased targeting of water-sector PLCs, including attacks that changed PLC passwords/IP addresses and disrupted operations. CISA's immediate recommendation was to remove PLCs and other OT from direct Internet exposure and put remote access through a VPN/gateway instead.
NIST's newly published SP 1800-45 for water/wastewater specifically addresses secure OT remote access, while EPA guidance emphasizes asset inventory, authentication, reducing Internet exposure, segmentation and incident response.
So I'd architect the solution roughly like this:
Internet / IT
→ firewall + IT security
→ OT DMZ
→ jump server / secure remote-access gateway
→ OT firewall / segmentation
→ SCADA servers
→ PLC/RTU networks
→ field devices
with the OT security platform receiving passive network telemetry throughout the OT environment.
The key is that the monitoring system should not actively scan or probe sensitive PLCs by default. You want visibility without creating operational risk.
What I would put in the RFP
I'd make these requirements mandatory:
Passive discovery of every PLC, RTU, HMI, SCADA server and engineering workstation
Native visibility into protocols such as Modbus, DNP3, EtherNet/IP and common water-sector protocols
Identification of Internet-exposed OT
Detection of unauthorized PLC/HMI configuration changes
Detection of anomalous commands and communications
OT vulnerability prioritization based on actual asset criticality/exploitability, not just CVSS
Secure vendor/contractor remote access with MFA and session auditing
Network segmentation/Purdue-model visibility
Integration with your existing SIEM/SOC
Offline/known-good PLC configuration backup and recovery capability
Multi-site support for remote pump stations
Reporting aligned with NIST CSF, CISA Cross-Sector Cybersecurity Performance Goals, and EPA/AWIA requirements
CISA has specifically identified asset inventory, segmentation, strong authentication and removal of Internet exposure as important controls for water-sector PLC environments.
Bottom line
If I were running the procurement:
1. Claroty — first platform I'd pilot 2. Dragos — strongest alternative, particularly for threat hunting/IR 3. Nozomi Networks — strong alternative for visibility/asset management
But I would not select purely on vendor demos. I'd run a 30–60 day proof of concept against your actual SCADA network and score each vendor on asset coverage, PLC protocol visibility, detection quality, false positives, remote-access security, deployment impact, and integration with your existing SOC.
And given the 2026 water-sector attacks, I'd make "no directly Internet-exposed PLC/HMI + controlled remote access" a prerequisite, not something the OT security product is expected to compensate for.
If you tell me your SCADA vendor (e.g., Ignition, AVEVA/Wonderware, Rockwell, Siemens, Schneider), approximate number of sites/PLCs, and whether you have a SOC/SIEM, I can turn this into a vendor comparison/RFP matrix with specific technical requirements and scoring weights.
