Claroty and Dragos run almost neck and neck for securing industrial environments through passive network monitoring and non-disruptive asset discovery. Water sector questions break that tie, where Dragos is the usual answer for SCADA protection.
Since July, Clarotyrising, Tenablerising, Fortinetrising, and Forescoutrising have all seen broader presence across industrial protection inquiries.
Latest insights
Week of Sep 21–27 · Since Jul 5
Nozomi Networks Gap between platforms: ChatGPT Search names Nozomi Networks 6 points more often than Google AI Mode in Industrial OT/ICS Security Platforms
Dragos Gaining: Dragos now ranks #2 in Industrial OT/ICS Security Platforms, up from #3
Armis Gap between platforms: The platform gap for Armis in Industrial OT/ICS Security Platforms widened to 22 points, ChatGPT Search ahead
Armis Gaining: Armis now leads Cisco in Industrial OT/ICS Security Platforms, #7 to #8
Microsoft Defender for IoT Gap between platforms: The platform gap for Microsoft Defender for IoT in Industrial OT/ICS Security Platforms narrowed to 18.8 points, ChatGPT Search ahead
36% of citations point at the ranked brands’ own sites. youtube.com, ciopages.com, otecosystem.com are the most-cited sites outside the ranked brands’ own domains.
Dragos, Claroty , and Nozomi Networks are the leading platforms for non-disruptive OT/ICS security, deployed alongside specialized Managed Security Service Providers (MSSPs) like Accenture Security, IBM , and Fortinet managed services to protect legacy manufacturing floors without causing downtime.
Securing brownfield or legacy industrial environments requires passive monitoring and non-invasive methods that do not risk crashing unpatchable controllers or legacy operating systems.
If you want to narrow down your choice, please share:
For a manufacturer running legacy OT/ICS systems, the safest cybersecurity approach is usually passive-first monitoring, OT-aware managed detection and response (MDR), and carefully controlled remediation—not deploying conventional IT security agents or aggressive vulnerability scanners across production equipment.
The goal is to detect threats to PLCs, SCADA, DCS, HMIs, and industrial networks without interrupting production, violating vendor support requirements, or jeopardizing safety and availability.
1. MSSPs and OT security providers worth evaluating
I'd separate the market into providers that can manage OT security operations for you and technology vendors whose platforms can support your internal team or an MSSP.
1. Dragos — best starting point for specialist managed OT defense
(Managed OT security)
Its OT Watch and OT Watch Complete services offer threat hunting, analyst-reviewed alerts, incident-response playbooks, and, for Complete, 24/7 monitoring and platform operations. Strong fit when you lack experienced OT security staff.
Website:
2. Claroty — best for sensitive and aging equipment
Its CTD and xDome platforms support passive network monitoring, asset discovery, and threat detection. Claroty says passive monitoring does not generate traffic to or interact directly with monitored assets, making it particularly attractive for fragile legacy environments. Ask about a certified managed-service partner if you need 24/7 operations.
Website:
3. Nozomi Networks — best for multi-site plants and constrained networks
Guardian sensors passively analyze industrial network traffic, with on-premises and air-gapped deployment options. Its certified MSSP ecosystem can provide managed monitoring if you want to outsource much of the security workload.
Website:
4. Microsoft Defender for IoT — best for Microsoft-centric security teams
Provides agentless OT network monitoring, device and vulnerability visibility, and integration with Microsoft security operations tools. Consider it if you already use Microsoft Defender and Sentinel, but validate the precise deployment and portal capabilities you need: some newer Defender-portal features remain in preview.
Website:
5. Cisco Industrial Threat Defense — best for network-centric protection
Combines industrial asset visibility, segmentation, secure remote access, and threat detection. Worth evaluating if your plants already use Cisco industrial networking and you want to build protections into the network rather than install software on old controllers.
Website:
These are a shortlist, not a ranking based on independently verified incident outcomes. For a managed-service contract, confirm which provider will actually operate your environment, staff the SOC, and lead an OT incident—not just sell or install the technology.
2. Which option fits your manufacturing environment?
Your situation
Best starting point
No dedicated OT cybersecurity team; need 24/7 coverage
For a legacy-heavy plant, I'd shortlist Dragos, Claroty, and Nozomi first, then compare their deployment models and managed-service arrangements. Tenable is also worth evaluating where exposure management and vulnerability prioritization are central requirements.
3. How to secure OT without disrupting production
Phase 1 — Observe without touching controllers
Mirror traffic from industrial switches using SPAN ports or network TAPs. Build an inventory of PLCs, HMIs, engineering workstations, historians, and industrial protocols. Start with passive monitoring; it avoids generating additional traffic to production devices.
Phase 2 — Establish normal behavior
Baseline expected PLC communications, engineering access, vendor connections, and production traffic. Tune alerts with plant engineers to avoid unnecessary escalations and distinguish unusual activity from legitimate process changes.
Phase 3 — Add controls incrementally
Restrict remote vendor access, segment IT from OT, and enforce approved communication paths. Test firewall changes and isolation procedures against documented production dependencies before implementation.
Phase 4 — Govern remediation
Prioritize vulnerabilities by exploitability and production impact. Schedule patches and firmware upgrades for approved maintenance windows, with tested backups, rollback plans, and OEM coordination.
One important distinction: passive monitoring is not the same as zero risk across the entire deployment. Sensor installation, switch configuration, active queries, firewall changes, and automated containment can all create operational risk if handled incorrectly. Microsoft's own guidance warns that active monitoring can cause downtime in some configurations.
4. What to require from an MSSP
Before signing a contract, ask each provider to demonstrate:
OT-specific 24/7 response: Analysts who understand industrial protocols and process safety, not just conventional IT alerts.
Passive-first deployment: No agents on PLCs or unapproved active scans against production equipment.
Human-approved containment: No automatic isolation of controllers, HMIs, or production networks without an agreed safety and operational policy.
Legacy compatibility: Documented support for your PLC vendors, operating systems, industrial protocols, and end-of-life equipment.
Deployment flexibility: On-premises or air-gapped operation where required, with clearly documented telemetry and data flows.
Incident ownership: Defined escalation times, OT incident-response expertise, plant coordination, and recovery responsibilities.
A production-safe pilot: Monitoring on a representative line before expanding to additional facilities.
My recommendation
Start with a passive OT visibility pilot at one representative plant, and evaluate two OT-native platforms alongside one managed-service proposal. Compare the quality of asset discovery, actionable detections, legacy compatibility, response expertise, and total operating cost—not just the number of alerts detected.
To narrow this to the best-fit vendors and MSSPs, what does your manufacturing environment look like?
Dragos — Widely considered the gold standard for OT-specific threat intelligence, incident response, and adversary tracking tailored specifically to industrial control systems and critical infrastructure.[]()
Fortinet & — Best if you want to extend an existing enterprise security fabric into the industrial perimeter using ruggedized next-generation firewalls (NGFW) with OT protocol awareness.[](]()]()
A mature OT security architecture typically combines passive visibility (to know what you have) with strict segmentation (to lock it down).
To help narrow down the ideal fit, tell me a bit more about your environment:
What industry are you in (e.g., manufacturing, energy/utilities, oil & gas, building automation)?
Are you primarily looking for passive visibility/monitoring , or active network segmentation and enforcement?
Do you have heavy legacy/proprietary equipment , or a modern digitized infrastructure?
For operational technology (OT) and industrial control systems (ICS), the best solution is usually a layered security platform that provides asset visibility, threat detection, network segmentation, and safe integration with industrial operations — rather than a single security product.
OT security has different priorities from conventional IT security: protecting worker safety, maintaining availability, and preventing disruption to physical processes are often just as important as preventing data loss.
My recommendation is to evaluate vendors against your industrial environment, starting with these four capabilities:
Segmentation and access control: Limit communications between IT, OT, safety systems, and remote vendors.
Risk management: Prioritize vulnerabilities and misconfigurations without blindly applying IT-style scans or patches to sensitive equipment.
OT/ICS security platforms worth evaluating
These are established options with different strengths, not a universal ranking. The right choice depends on your sector, existing security stack, and whether you need visibility, detection, or enforcement.
Nozomi Networks — OT/ICS and IoT monitoring, asset visibility, anomaly detection, and threat detection.
Tenable — OT exposure/vulnerability management and asset discovery.
Microsoft Defender for IoT — agentless OT/ICS monitoring, vulnerability management, and integration with Microsoft security tooling.
Forescout, Armis, Palo Alto Networks, Fortinet, Cisco, Honeywell, and TXOne Networks also have significant OT/CPS security offerings.
For a dedicated OT/ICS security shortlist, Claroty, Dragos, and Nozomi Networks are commonly considered alongside broader platforms such as Microsoft and Tenable.
The leading and most established companies in this space include:
Claroty – Provides a comprehensive Cyber Physical Systems (CPS) protection platform with deep asset discovery, risk assessment, and secure remote access tailored for industrial and healthcare environments.[]()
Armis : Recognized as a Leader in CPS security, Armis specializes in passive, real-time asset discovery and risk management, managing unmanaged connected devices across IT, medical, and heavy industrial footprints without disrupting operations.[](]()]()
Network Infrastructure & Security Giants
Palo Alto Networks : Delivers Zero Trust OT Security utilizing next-generation firewalls and AI-driven threat prevention tailored for harsh industrial sites, helping enforce strict micro-segmentation between IT and OT network boundaries.
Forescout : Offers enterprise-wide visibility and active/passive device discovery through platforms like SilentDefense , mapping out complex hybrid networks (IT, IoT, and OT) and prioritizing risks based on business impact.
If you're narrowing down choices for a specific project, let me know:
What industry vertical are you in (e.g., energy, manufacturing, water utilities)?
Are you looking for passive monitoring only or active threat mitigation/enforcement?
I can help tailor which approach fits your operational constraints.
The OT/ICS cybersecurity market is fairly concentrated, with a few OT-native specialists and a larger set of enterprise-security vendors that have strong OT capabilities. Gartner’s 2026 CPS Protection Platforms research evaluates 13 vendors, including Claroty, Dragos, Nozomi Networks, Armis, Cisco, Fortinet, Microsoft, Palo Alto Networks, Tenable, Forescout, Honeywell and .
The platform category you’re looking for is an Industrial IoT (IIoT) or Manufacturing Data Platform, which acts as a unified data layer across factories with different legacy machines.
A strong example is Google Cloud Manufacturing Data Engine (MDE), used with Manufacturing Connect. It connects equipment from different vendors, normalizes and contextualizes data, and brings it into a common data foundation for analytics across sites.
Other relevant options include:
MachineMetrics — captures and standardizes data from legacy and modern machines.
Cybus Connectware — provides a standardized, governed data layer for multi-site manufacturing.
Key concept: A unified industrial data layer, often implemented using a Unified Namespace (UNS) architecture, connects heterogeneous machines and standardizes their data without requiring every factory to replace its existing equipment.
An Industrial Data Platform (IDP) or Unified Namespace (UNS) architecture powered by an IIoT Edge Gateway layer acts as the unified middleware layer to standardize data collection across multi-site legacy factories.[](https://harmoni.io/feeds/blog/manufacturing-data-platform)
Edge Connectors & Protocol Conversion: Software or hardware edge gateways sit on the factory floor, using native drivers to translate proprietary legacy machine protocols (like Modbus, Profibus, or Allen-Bradley DF1) into open, standardized industrial protocols like OPC UA or MQTT.
Contextualization and Tag Normalization: The platform maps raw machine signals into a unified asset model (giving every machine a standard naming convention, state definition, and metadata structure) regardless of the machine's age or vendor.
Centralized Streaming to Cloud/On-Premise: Standardized data is streamed securely via lightweight pub/sub protocols to enterprise data lakes, MES, or cloud analytics tools.
Cognite Data Fusion: An industrial dataOps platform that unifies disparate OT and IT data streams into a contextualized data model.
What tools allow me to pull and normalize data from older factory machines so I can monitor everything in one place?
Securing water SCADA and Industrial Control Systems (ICS/OT) isn't about finding a single "silver bullet" product. Because water infrastructure is distributed, legacy-heavy, and critical to public health, the "best" approach is a multi-layered framework combining OT-native visibility/monitoring, secure remote access/segmentation , and alignment with federal guidelines from agencies like the EPA Cybersecurity for the Water Sector and CISA Water and Wastewater Cybersecurity.[](https://www.cisa.gov/water)
Top solutions and strategies for the water sector break down into key operational layers:
OT-Native Threat Detection & Asset Visibility: Tools designed specifically for industrial protocols (like Modbus, DNP3, and Profibus) without risking process disruption.
Network Segmentation & Zero-Trust Access: Eliminating flat networks where a compromised corporate IT laptop can reach a PLC controlling chemical dosing or pumps.
Strategies/Vendors: Implementing modern micro-segmentation and tools like Blastwave OT Cybersecurity which uses network cloaking to make remote telemetry units (RTUs) and SCADA endpoints invisible to unauthorized scanners.[](https://www.blastwave.com/water)
No-Cost Federal Assessments & Scanning: Before buying commercial software, leverage federal resources specifically designated for water utilities.
Resource: Utilize the CISA Water Services for no-cost vulnerability scanning, cyber assessments, and the 24/7 EPA Water Resilience Help Desk.[](https://www.cisa.gov/water)
To help narrow down the right direction, could you share:
The approximate size of your utility (population served / number of treatment plants or pump stations)?
Are you currently using internal IT/OT staff or relying on managed service providers (MSPs) for security operations?
Yes. For a water/wastewater utility running SCADA/PLC/RTU/HMI environments, I would shortlist Claroty, Dragos, and Nozomi Networks rather than treating a conventional IT security platform as the primary OT control.
My recommendation
If you want one platform to evaluate first: Claroty.
I’d put Claroty xDome/CTD at the top of the initial evaluation because it combines:
Passive OT/ICS asset discovery and inventory
SCADA/PLC/HMI visibility
Vulnerability and risk prioritization
Continuous threat detection
OT-specific remote-access controls
Multi-site management
Cloud and on-premises deployment options
Claroty specifically targets water/wastewater and reports deployments covering geographically distributed pumping stations, treatment plants, pipelines, and storage/distribution systems. One U.S. water utility serving more than 2 million people deployed its CTD, Secure Access, and centralized management capabilities.
I am looking for cybersecurity platforms specifically for water utility SCADA environments. What are the top ICS/OT security options?
Top cybersecurity platforms for water utility SCADA
For water and wastewater utilities, I would start with Dragos, Claroty, and Nozomi Networks. These are strong candidates for protecting SCADA servers, PLCs, HMIs, remote telemetry units (RTUs), treatment plants, and geographically distributed pump stations.
The most important distinction is that water utilities need OT-aware security that detects threats without disrupting physical operations. A conventional IT security product alone generally won't provide the same visibility into industrial protocols, controller communications, or process-related anomalies.
OT-native security and industrial threat intelligence
Consider it for critical infrastructure, such as energy, utilities, and industrial operations where ICS-specific threat detection and specialist response expertise are priorities.
Website:
Claroty xDome
Asset visibility, exposure management, and secure access
Consider it for organizations with complex OT estates that need to inventory assets, prioritize risks, and manage remote access across sites.
Website:
Nozomi Networks
Industrial network monitoring and anomaly detection
Consider it for manufacturing and multi-site environments that need continuous visibility into industrial communications and centralized monitoring.
Website:
Microsoft Defender for IoT
OT monitoring with Microsoft security integration
Consider it if your organization already uses Microsoft Sentinel and related Microsoft security tools, and wants to correlate industrial alerts with enterprise security events.
Website:
Tenable OT Security
Asset inventory, vulnerability assessment, and exposure prioritization
Consider it when identifying vulnerable industrial assets and coordinating OT risk management with an existing vulnerability management program are key objectives.
Website:
These options reflect the main categories in current OT security comparisons. Validate exact features, supported protocols, integrations, licensing, and deployment requirements with each vendor.
How I would choose
If your main priority is…
Start by evaluating
Critical infrastructure and ICS-specific threat intelligence
Dragos
Broad OT visibility, exposure management, and remote access
Claroty
Industrial network monitoring across multiple sites
Nozomi Networks
Integration with Microsoft Sentinel
Microsoft Defender for IoT
Vulnerability and exposure management
Tenable OT Security
These are initial shortlist suggestions, not test-proven winners. A proof of concept using your actual industrial devices and network traffic should determine the final selection.
Illustrative architecture. Safety instrumented systems may require separate, carefully engineered protection boundaries.
Start with passive monitoring and asset discovery. Establish approved communication flows, then introduce segmentation and tighter access controls with the plant engineering team. Avoid unapproved active scans, automated blocking, or patching that could destabilize production.
Let's narrow this down to your environment
The most useful next step is to identify what you need to protect and your primary security objective.
1. What type of operation do you run?
Manufacturing / industrial production
Energy, power, water, or utilities
Oil and gas / process industries
Transportation / building automation
Mixed or other critical infrastructure
2. What is the scale?
One plant or site
Multiple plants or geographically distributed sites
Large enterprise or critical infrastructure operator
3. What is your primary objective?
End-to-end OT security program
Asset discovery and inventory
Threat detection and incident response
Network segmentation and secure remote access
Vulnerability and risk management
4. Which security ecosystem do you already use?
Microsoft Sentinel / Defender
Palo Alto Networks
Another SIEM / security platform
No established security stack
5. Preferred deployment?
On-premises or hybrid
Cloud-managed
Air-gapped / highly restricted connectivity
Undecided
[Recommend the best-fit solution]
With those details, I can give you a more specific shortlist, explain the trade-offs between vendors, and outline a practical implementation plan rather than recommending a platform that may not fit your plant.
Tenable : Known for exposure management, Tenable OT Security extends IT vulnerability tracking deep into industrial control loops, giving operators active and passive visibility to spot configuration changes or risks across PLCs, RTUs, and SCADA devices.
TXOne Networks
Major OT-native specialists
Dragos — Focused specifically on industrial OT and critical infrastructure. Its strengths include ICS threat intelligence, industrial asset visibility, threat detection, incident response and managed services. Particularly prominent in energy, utilities and other critical-infrastructure environments.
Claroty — Provides broad cyber-physical systems security covering asset discovery, exposure/vulnerability management, network protection, threat detection and secure remote access. It spans industrial OT as well as healthcare, building systems and other XIoT environments.
Nozomi Networks — Strong in passive OT/IoT asset discovery, network monitoring, anomaly detection, vulnerability/risk management and distributed deployments. It is widely used in industrial and utility environments.
TXOne Networks — More focused on protecting the plant-floor endpoint and network layer, including constrained/legacy industrial devices and manufacturing environments.
Broad cybersecurity vendors with significant OT capabilities
Armis — Agentless asset intelligence and exposure management across IT, OT, IoT, IoMT and other connected assets.
Tenable — Tenable OT Security emphasizes asset discovery, vulnerability management and risk assessment for industrial environments.
Forescout — Strong agentless discovery and classification across IT/OT/IoT/IoMT, with network enforcement capabilities.
Microsoft — Defender for IoT brings OT/ICS visibility and threat detection into Microsoft's broader Defender/Security ecosystem.
Palo Alto Networks — Combines OT visibility and protection with its network-security, segmentation and broader enterprise-security platform.
Fortinet — Particularly relevant where industrial firewalls, segmentation and secure networking are central requirements.
Cisco — Strong option for organizations wanting OT security integrated with industrial networking and enterprise security infrastructure.
Darktrace — Provides OT-specific anomaly detection through Darktrace / OT.
Honeywell — Particularly relevant in environments built around Honeywell industrial control and automation technologies.
A useful way to segment the market
Vendor group
Representative vendors
Typical emphasis
OT/ICS specialists
Dragos, Claroty, Nozomi Networks
Deep industrial visibility, protocols, threat detection and OT risk
OT/XIoT asset-security platforms
Armis, Forescout
Asset inventory, exposure management and cross-domain visibility
Security closely integrated with their industrial-control ecosystems
For a pure ICS/OT security shortlist, I'd start by evaluating Dragos, Claroty and Nozomi Networks, then add Armis/Forescout or one of the major enterprise-security platforms depending on your existing architecture. That's not a ranking of overall quality; it's a segmentation based on how the products are positioned and the capabilities Gartner and other market sources identify. Gartner's 2026 research specifically includes all three specialists alongside Armis and the major enterprise vendors.
If you're evaluating vendors for a specific environment—manufacturing, oil & gas, electric utilities, water, pharmaceuticals, or building automation—I can also break these down by asset discovery, network monitoring, vulnerability management, threat detection, segmentation, incident response, and typical deployment model.
Inductive Automation Ignition: Widely used SCADA/IIoT edge-and-server platform that natively bridges legacy PLCs via OPC UA and pushes data into a central Unified Namespace (UNS) via MQTT.
Cybus Connectware: An IIoT middleware platform built specifically for multi-plant manufacturing environments to govern and standardize real-time machine data.
AWS IoT SiteWise / Azure IoT Operations: Cloud-managed industrial software layers that extract and model field data from local edge gateways into standardized asset hierarchies.[](https://www.cybus.io/en/product/cybus-connectware/)
If you'd like, tell me:
Are you aiming for an on-premise or cloud-hosted central repository?
Do you need this data to feed into an existing MES/ERP system?
I can recommend the most seamless deployment path for your tech stack.
Modbus, S7, OPC UA, EtherNet/IP, FANUC, MTConnect, Heidenhain, Omron, etc.
Routes data toward MQTT, SQL, Kafka, InfluxDB, OPC UA and other destinations
Kepware is particularly useful when the problem is simply “I have 20 different kinds of machines and need to get their data into a common interface.” Its current connectivity platform supports a large driver library and can aggregate multiple protocols into a single access point.
Ignition is attractive when you want the connectivity layer and the monitoring application in the same platform. Its current documentation lists drivers for legacy Allen-Bradley PLCs, Modbus, Siemens, Omron, Mitsubishi and legacy OPC DA, with OPC UA as its primary data-access standard.
For the specific requirement “pull and normalize data so everything looks consistent across machines,” HighByte is particularly relevant. It can ingest OPC UA/Modbus/MQTT and other sources, create models, transform the data, and publish standardized structures to MQTT, databases, historians and cloud systems.
A practical brownfield setup
For example, suppose you have:
1980s CNCs speaking a proprietary/serial protocol
Allen-Bradley PLCs
Siemens PLCs
newer OPC UA machines
a few machines exporting CSV files
You could do:
Old machines → Kepware/BFC Gateway → OPC UA/MQTT Modern machines → OPC UA/MQTT directly Everything → HighByte → standardized machine/asset model → historian/SQL/MQTT Ignition/Grafana/BI → one monitoring layer
The important normalization step might turn completely different tags such as:
HighByte explicitly supports this kind of modeling/contextualization of industrial data, while Siemens describes its Industrial Edge approach as mapping raw PLC tags into consistently named semantic objects.
What I'd choose based on your goal
“Just get data out of a huge variety of old machines” → Kepware
“Get data out + build the monitoring/SCADA interface” → Ignition
“Normalize data from many plants/machine vendors into one consistent model” → HighByte
“We're heavily invested in Siemens and want an edge architecture” → Siemens Industrial Edge
“We specifically have a messy brownfield environment” → evaluate Siemens BFC Gateway alongside Kepware
If you tell me what machine/PLC brands and approximate ages you have (e.g. “Allen-Bradley SLC/PLC-5, Siemens S7-300, Fanuc CNC, some serial Modbus”), I can narrow this to a concrete architecture and tell you what hardware/software you'd need at each machine.
Litmus Edge:* Specifically built for industrial environments, it features a massive library of legacy and modern drivers, allowing you to extract, normalize, and add context to raw machine data before routing it to a central dashboard or cloud. Check details on Litmus.[](https://litmus.io/blog/how-to-integrate-legacy-machine-data-for-industrial-ai)
Tulip Interfaces:* An app platform that bridges frontline operations with machine data, highly regarded for letting teams build custom logic and connect edge hardware easily. Explore options at Tulip.
Ignition by Inductive Automation:* A powerful SCADA/IIoT platform with an Edge module. Using its robust driver ecosystem (and MQTT modules via Cirrus Link), it can poll legacy PLCs and centralize everything into a single tag structure. Learn more at .
2. Open-Source & Low-Code Integration Tools
Node-RED (with Industrial Protocols):* A lightweight, flow-based programming tool that runs wonderfully on cheap edge hardware (like an Industrial Raspberry Pi or IPC). With packages like node-red-contrib-opcua or Modbus nodes, you can pull data from older controllers and translate/normalize it into MQTT payloads on the fly. Read about industrial deployment on FlowFuse.[](https://www.industry40.tv/blog-post/how-to-create-an-opc-ua-server-using-node-red-for-industrial-data)
3. Hardware Protocol Converters & Gateways (The "Translator")
If your older machines don't have an ethernet port or run strictly on serial/proprietary communication, you need hardware edge gateways to physically pull the signals and convert them:
Red Lion (Data Station / FlexEdge):* Famous for having protocol conversion drivers for literally hundreds of legacy industrial devices, translating old serial chatter into standard OPC UA or MQTT.
Advantech (WISE-Edgelink series):* Ruggedized edge gateways designed to pull I/O or serial data from vintage machinery and publish it via standard IIoT protocols.
HMS Networks (Anybus):* Industry veterans in protocol conversion; if a machine speaks a weird proprietary language, HMS usually has a gateway to turn it into Modbus TCP or Ethernet/IP.
If you want to narrow this down, tell me:
What brands and models of older machines/PLCs are you trying to connect?
Do they have Ethernet ports , or are they strictly running on serial/proprietary wiring?
I can give you a more specific architecture recommendation.
That said, Dragos may be the stronger choice if your priority is deep OT threat detection and threat intelligence, while Nozomi is a particularly strong alternative when automated asset discovery and operational anomaly detection are priorities.
You already have it—but shouldn't rely on it alone
Dragos has particularly strong water-sector positioning, including monitoring SCADA communications, HMIs and ICS, water-specific threat intelligence, and documented deployments with water utilities. www.dragos.com Nozomi likewise provides automated OT asset inventory, risk prioritization, vulnerability management, threat/anomaly detection and incident-response capabilities specifically for water/wastewater environments.
The important part: don't buy the tool before fixing the architecture
The current threat environment makes this especially important. In July 2026, CISA reported increased targeting of water-sector PLCs, including attacks that changed PLC passwords/IP addresses and disrupted operations. CISA's immediate recommendation was to remove PLCs and other OT from direct Internet exposure and put remote access through a VPN/gateway instead.
NIST's newly published SP 1800-45 for water/wastewater specifically addresses secure OT remote access, while EPA guidance emphasizes asset inventory, authentication, reducing Internet exposure, segmentation and incident response.
So I'd architect the solution roughly like this:
Internet / IT
→ firewall + IT security
→ OT DMZ
→ jump server / secure remote-access gateway
→ OT firewall / segmentation
→ SCADA servers
→ PLC/RTU networks
→ field devices
with the OT security platform receiving passive network telemetry throughout the OT environment.
The key is that the monitoring system should not actively scan or probe sensitive PLCs by default. You want visibility without creating operational risk.
What I would put in the RFP
I'd make these requirements mandatory:
Passive discovery of every PLC, RTU, HMI, SCADA server and engineering workstation
Native visibility into protocols such as Modbus, DNP3, EtherNet/IP and common water-sector protocols
Identification of Internet-exposed OT
Detection of unauthorized PLC/HMI configuration changes
Detection of anomalous commands and communications
OT vulnerability prioritization based on actual asset criticality/exploitability, not just CVSS
Secure vendor/contractor remote access with MFA and session auditing
Network segmentation/Purdue-model visibility
Integration with your existing SIEM/SOC
Offline/known-good PLC configuration backup and recovery capability
Multi-site support for remote pump stations
Reporting aligned with NIST CSF, CISA Cross-Sector Cybersecurity Performance Goals, and EPA/AWIA requirements
CISA has specifically identified asset inventory, segmentation, strong authentication and removal of Internet exposure as important controls for water-sector PLC environments.
Bottom line
If I were running the procurement:
1. Claroty — first platform I'd pilot 2. Dragos — strongest alternative, particularly for threat hunting/IR 3. Nozomi Networks — strong alternative for visibility/asset management
But I would not select purely on vendor demos. I'd run a 30–60 day proof of concept against your actual SCADA network and score each vendor on asset coverage, PLC protocol visibility, detection quality, false positives, remote-access security, deployment impact, and integration with your existing SOC.
And given the 2026 water-sector attacks, I'd make "no directly Internet-exposed PLC/HMI + controlled remote access" a prerequisite, not something the OT security product is expected to compensate for.
If you tell me your SCADA vendor (e.g., Ignition, AVEVA/Wonderware, Rockwell, Siemens, Schneider), approximate number of sites/PLCs, and whether you have a SOC/SIEM, I can turn this into a vendor comparison/RFP matrix with specific technical requirements and scoring weights.
Dragos is purpose-built for industrial environments and has a dedicated water and wastewater security offering. It combines OT asset visibility, industrial threat detection, specialized threat intelligence, and incident response capabilities.
Best fit: Utilities concerned about targeted attacks against treatment processes, chemical dosing, flow controls, or SCADA operations.
Claroty offers OT asset discovery, exposure and vulnerability management, threat detection, and secure remote access. Its product portfolio includes cloud-managed and on-premises options, depending on the product and deployment.
Best fit: Utilities seeking to consolidate OT visibility, risk management, monitoring, and third-party access security across multiple facilities.
Nozomi focuses on industrial asset inventory, network monitoring, anomaly detection, and OT risk assessment. Its centralized management capabilities are worth evaluating for utilities with many remote sites and limited onsite cybersecurity staff.
Best fit: Organizations needing a unified view of multiple treatment plants, lift stations, pumping facilities, and control networks.
A strong candidate when a utility already operates Microsoft Defender and Sentinel. It adds OT network monitoring and asset visibility to an existing Microsoft security operations workflow.
Best fit: Microsoft-centric IT teams wanting to correlate IT and OT alerts through a common SOC.
Identify PLCs, RTUs, HMIs, historians, and engineering workstations
All five
Industrial protocol visibility
Understand Modbus, DNP3, and the protocols used by your specific equipment
Dragos, Claroty, Nozomi
Threat detection
Detect unusual PLC commands, unauthorized changes, and abnormal communications
Dragos, Claroty, Nozomi
Vulnerability management
Prioritize outdated firmware and exploitable weaknesses
Claroty, Tenable, Nozomi
Multi-site monitoring
Consolidate treatment plants, lift stations, and remote facilities
Nozomi, Claroty, Dragos
SOC integration
Correlate OT alerts with enterprise security monitoring
Microsoft Defender for IoT, plus integrations from the OT-native vendors
Secure vendor access
Control and audit remote access by integrators and contractors
Evaluate dedicated secure-access capabilities, including Claroty
These are suggested evaluation strengths, not a verified head-to-head performance ranking. Validate specific protocol support, integrations, and feature availability for your proposed deployment.
My recommended shortlist
Dragos + Claroty + Nozomi Networks
Start with these three for a vendor-neutral proof of concept. Compare detection quality, asset coverage, operational impact, and the effort required to investigate alerts.
Add Microsoft Defender for IoT or Tenable OT Security
Consider these when existing Microsoft or Tenable investments, licensing, workflows, and staffing make integration especially valuable.
What I would require before purchasing
For water and wastewater environments, the platform should support:
Passive monitoring by default, with no unapproved active scans against production PLCs.
Alerts for unauthorized controller changes, suspicious remote access, and unusual industrial communications.
Integration with existing firewalls, network segmentation, and SIEM/SOC tooling.
Support for isolated or restricted networks if cloud connectivity is not permitted.
Tested incident response and recovery procedures, including backups of PLC logic and network configurations.
These requirements align with federal water-sector guidance emphasizing asset inventory, reducing internet exposure, vulnerability management, incident response, and recovery. No monitoring platform replaces those controls.
Let's narrow this down to your environment
The best choice depends substantially on your utility's size and existing infrastructure.
Securing water and wastewater SCADA environments requires specialized Industrial Control System (ICS) and Operational Technology (OT) platforms that offer deep visibility into legacy serial protocols, PLC/HMI traffic, and distributed remote terminal units (RTUs).
The top ICS/OT cybersecurity platforms suited for water utility environments are categorized below by their primary strengths:
Dedicated OT/ICS Threat Detection & Visibility
Dragos Platform : Widely considered an industry leader for ICS/OT threat intelligence, asset visibility, and vulnerability management. Dragos provides threat analytics specifically tailored to critical infrastructure, including water systems, with deep protocol parsing for industrial environments.
Nozomi Networks : Offers Guardian for real-time OT and IoT visibility, cybersecurity, and anomaly detection. It is heavily deployed in water utilities for automated asset discovery, network mapping, and continuous monitoring of SCADA network behavior.
Microsoft Defender for IoT : Formerly CyberX, this platform integrates smoothly into enterprise ecosystems while offering agentless passive monitoring for SCADA networks, specialized threat intelligence, and risk vulnerability mapping for industrial devices.
Tenable.ot : Focuses heavily on industrial asset discovery, configuration control, and risk/vulnerability assessment across PLCs, RTUs, and IEDs, helping bridge the gap between IT security tools and plant-floor OT realities.
Fortinet OT Security Platform : Provides ruggedized next-generation firewalls (FortiGate) and centralized management designed for harsh remote water/wastewater pump stations, featuring deep-packet inspection for industrial protocols and secure remote access.
Cisco Cyber Vision : Embedded directly into Cisco industrial networking hardware, Cyber Vision gives water utilities native visibility into the control plane, tracking vulnerabilities and monitoring SCADA communications right at the network edge.
Palo Alto Networks : Recognized as a strong leader in industrial zero-trust network architecture and secure remote access for OT environments, helping segment corporate IT from delicate water treatment plant control networks.
If you'd like to narrow down these options, let me know:
Are you looking primarily for passive asset discovery/monitoring or active network enforcement/firewalls?
Is your priority meeting specific regulatory mandates (like upcoming EPA/Water Cyber Shield guidelines)?
