Dragos cybersecurity in context
Dragos cybersecurity refers to a specialized approach to protecting operational technology, industrial control systems and the physical processes those systems support. In 2026, the term took on added significance after Accenture’s majority investment in Dragos closed and Dragos announced the acquisition of NetRise and runZero on September 21, 2026. For industrial defenders, the practical message is straightforward: OT security is no longer limited to passive monitoring of plant networks. It now needs to account for connected devices, industrial networks, software supply chain exposure, cloud-linked operations, remote access and the operational core.
That shift matters because industrial disruption does not always require direct manipulation of a programmable logic controller or safety system. Dragos’s 2026 reporting on industrial ransomware indicated that attackers often create downtime through enterprise IT, remote access, virtualization and ERP dependencies that OT teams rely on during daily operations.
For more security coverage, visit the Cybersecurity section.
What Dragos does in OT and ICS security
Dragos is best known as a cybersecurity company focused on operational technology and industrial control system environments. In practical terms, its platform, intelligence and services are built for sectors where cyber risk can affect physical operations, including manufacturing, electric power, oil and gas, water, transportation, chemicals, pharmaceuticals, mining and data centers.
This positioning is different from conventional enterprise security. Most IT security tools are optimized for laptops, servers, identities, cloud workloads and business applications. OT environments bring a different set of constraints: legacy controllers, safety requirements, vendor-managed systems, fragile protocols, uptime commitments and equipment lifecycles that can run far beyond standard IT refresh cycles.
Dragos describes its platform around several OT-native capabilities:
- Asset visibility: identifying controllers, engineering workstations, HMIs, network devices, connected industrial assets and other systems whose failure could affect physical operations.
- Threat detection: monitoring industrial protocols and behavior to detect adversary activity that generic tools may miss.
- Vulnerability prioritization: helping teams decide which weaknesses need action now, which can wait and which may require compensating controls instead of immediate patching.
- Response workflows: supporting investigations, playbooks and incident response designed for OT constraints.
- Threat intelligence: tracking adversary groups, ransomware activity, ICS malware and techniques relevant to industrial environments.
The point is not that every industrial organization needs the same product stack. It is that OT security requires operational context. A vulnerability on an internet-facing business server is not the same as a vulnerability on an aging controller that cannot be patched during production. Dragos cybersecurity, as a category, is built around that distinction.
Why the 2026 xOT expansion matters
On June 18, 2026, Accenture announced plans to acquire a majority stake in Dragos while also acquiring runZero and NetRise. On September 21, 2026, Dragos said it had officially acquired NetRise and runZero, following the close of Accenture’s majority investment. Dragos also said Robert M. Lee would serve as chairman in addition to CEO, and that the company would continue operating independently with its existing leadership team.
The acquisitions are important because they broaden the working definition of OT security. Dragos uses the term xOT, or extended operational technology, to describe the wider environment around physical operations. That includes connected devices, networks, cloud links, software supply chain risk and the operational core itself.
runZero brings asset intelligence and exposure assessment. NetRise brings device security and software supply chain visibility. Combined with Dragos’s OT monitoring and threat intelligence, the expanded approach reflects a market trend: defenders want a more complete view of what exists, what is exposed, what software is inside devices and which risks actually matter to operations.
For industrial security leaders, the xOT framing is useful because many disruptions begin outside the controller layer. Attackers may exploit edge devices, abuse remote management tools, steal credentials, move through enterprise systems or compromise supporting infrastructure. The plant floor can feel the impact even when the initial intrusion starts elsewhere.
What recent threat data says about OT risk
Dragos’s 2026 OT Cybersecurity Year in Review reported that adversaries targeting industrial environments were moving beyond simple access and pre-positioning toward a deeper understanding of control loops and physical processes. The report also highlighted ransomware as a major operational risk for industrial organizations, with thousands of affected organizations during 2025.
Dragos’s Industrial Ransomware Analysis for Q2 2026 provided more current detail. The company identified 1,140 ransomware incidents affecting industrial organizations worldwide in the second quarter of 2026, up from 1,020 in the first quarter. Manufacturing accounted for 747 of those incidents, or 65%, followed by ICS-related organizations such as engineering firms, system integrators and equipment manufacturers with 117 incidents. Transportation and logistics ranked third with 95 incidents.
The same Q2 2026 analysis said the United States accounted for 431 incidents, or 38% of the global total identified by Dragos for that quarter. North America and Europe remained the most affected regions, while Germany saw a notable increase from Q1 to Q2.
One nuance is important. Dragos said it did not observe a Q2 2026 ransomware case in which an operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system. Instead, operational disruption typically followed encryption, data theft, precautionary shutdowns or failures in enterprise systems that OT relies on, such as ERP platforms, virtualization infrastructure and remote access tooling.
That distinction should shape board-level risk discussions. OT cyber risk is not only the high-consequence scenario of direct controller manipulation. More often, the business impact comes from losing systems that plants, distribution centers, utilities and industrial operators need to schedule work, view process data, ship products, manage maintenance or operate safely. See also: AI.
Where Dragos fits in an industrial defense program
A mature OT security program usually includes governance, engineering input, secure architecture, asset inventory, vulnerability management, remote access controls, monitoring, incident response and recovery planning. Dragos cybersecurity fits most naturally in the visibility, detection, prioritization and response layers. It should not be treated as a substitute for governance, segmentation or safe engineering design.
The following table summarizes where Dragos-style capabilities map to common industrial security problems.
| Industrial security problem | Why it matters | Relevant Dragos-style capability |
|---|---|---|
| Unknown assets in plants and field environments | Teams cannot protect, segment or patch systems they cannot identify. | OT asset discovery and inventory |
| Too many vulnerabilities with limited downtime | Industrial operators cannot patch everything immediately without disrupting production. | Risk-based vulnerability prioritization |
| Limited visibility below the IT/OT boundary | Attackers may move through industrial networks before defenders understand what is happening. | OT-native network monitoring and protocol-aware detection |
| Ransomware disrupting operations through IT dependencies | Production can stop even when controllers are not directly manipulated. | Threat intelligence, monitoring and incident response workflows |
| Connected devices and software supply chain exposure | Modern industrial environments include embedded devices, firmware and third-party components. | xOT asset intelligence and device security context |
This is also where government guidance aligns with the market trend. CISA’s cross-sector cybersecurity performance goals emphasize prioritized practices for critical infrastructure, including both IT and OT owners. CISA and partner agencies have also urged OT owners to consider security during procurement and to improve asset inventory, remote access protections and defensible architecture. Those recommendations reinforce the same basic principle: industrial security starts with knowing what exists and understanding how it connects to operations.
A practical timeline of the shift
The Dragos story sits within a larger timeline in industrial cybersecurity. The dates below show how the market has moved from OT visibility toward broader xOT exposure management.
- October 1, 2024: CISA and international partners released guidance on principles of operational technology cybersecurity for critical infrastructure organizations.
- January 13, 2025: CISA and partners published Secure by Demand guidance encouraging OT owners and operators to consider cybersecurity during industrial product procurement.
- 2025: Dragos’s annual OT report tracked growing ransomware pressure and adversary activity affecting industrial organizations.
- April 14, 2026: Dragos announced Platform 3.1 updates, including expanded analyst workflows, asset lifecycle management, communications analysis and deployment flexibility.
- June 18, 2026: Accenture announced its majority investment in Dragos and acquisitions of runZero and NetRise as part of an end-to-end OT security strategy.
- September 21, 2026: Dragos announced it had officially acquired NetRise and runZero, expanding its platform toward xOT cybersecurity.
For security teams, the takeaway is that OT security is becoming less siloed. Defenders still need deep industrial knowledge, but they also need to understand exposure across connected devices, identities, remote access, software components and business systems that support operations.
What buyers should evaluate before choosing an OT security platform
Dragos has strong visibility in the OT security market, but industrial buyers should still evaluate any platform against their own environment rather than brand recognition alone. Useful questions include:
- Does the platform understand the industrial protocols and equipment used in the environment?
- Can it map assets without disrupting fragile systems or violating safety constraints?
- Does it distinguish between theoretical vulnerabilities and risks that are actually exploitable or operationally urgent?
- Can the security team investigate incidents with enough engineering context to avoid unsafe response actions?
- Does it support distributed sites, low-bandwidth facilities and environments with limited local security staff?
- How does it integrate with existing SOC tools, identity systems, ticketing workflows and incident response processes?
- Can it provide useful reporting for plant managers, executives, auditors and security analysts without forcing every stakeholder into the same technical view?
Cost, deployment model, staffing and operational ownership also matter. OT monitoring creates value only when someone is responsible for triage, escalation and response. In some organizations, that may be an internal security operations center. In others, it may require a managed service, a hybrid IT/OT team or support from an outside incident response provider.
Frequently asked questions
What is Dragos cybersecurity?
Dragos cybersecurity is a common way to describe Dragos’s approach to protecting OT, ICS and xOT environments. It typically includes asset visibility, industrial threat detection, vulnerability prioritization, threat intelligence and response support for environments where cyber incidents can affect physical operations.
Is Dragos only for critical infrastructure?
No. Dragos is closely associated with critical infrastructure, but its focus also applies to industrial companies such as manufacturers, transportation operators, mining companies, chemical producers, food and beverage firms and data center operators. The common factor is operational technology risk, not only formal critical infrastructure status.
What does xOT mean?
xOT stands for extended operational technology. In Dragos’s 2026 framing, it refers to the broader environment around physical operations, including connected devices, networks, cloud links, software supply chain components and the operational core.
Did Accenture acquire Dragos?
Accenture announced on June 18, 2026 that it would acquire a majority stake in Dragos. Dragos later said the majority investment had closed and that it had officially acquired NetRise and runZero on September 21, 2026. Dragos also said it would continue operating independently with its existing leadership team.
Why is OT security different from IT security?
OT security protects systems that control or monitor physical processes. These environments often include legacy assets, safety constraints, limited maintenance windows and equipment that cannot be patched or scanned like standard IT systems. That makes context, segmentation, safe monitoring and coordinated response especially important.
The bottom line
Dragos cybersecurity matters because industrial risk is now broader than the traditional OT perimeter. The 2026 xOT expansion reflects a market shift toward seeing and defending the full operational environment, from controllers and engineering workstations to connected devices, software components, cloud-linked systems and enterprise dependencies. For readers following industrial defense trends, the main development is not a single acquisition or platform release. It is the recognition that physical operations now depend on a wider digital ecosystem, and security programs have to be designed around that reality.