OT/ICS and Cyber-Physical Security

In 2025 ServiceNow agreed to buy Armis for $7.75B, a deal it said would more than triple its security-and-risk market opportunity, and in June 2026 Accenture bought a majority of Dragos (valuing it ~$3.25B) plus runZero and NetRise in a ~$4.18B package. Two of the largest independent asset-visibility franchises changed hands inside twelve months. Operational-technology security — the domain that protects factories, grids, pipelines, hospitals, and weapons systems — has moved from a niche specialist field to a focus of acquisition activity among the largest platforms in software and services.

What "OT / ICS security" actually is

Operational technology (OT) is the computing that runs the physical world: industrial control systems (ICS), SCADA, programmable logic controllers (PLCs), distributed control systems, building-management systems, and the broader universe of cyber-physical systems (CPS) that now includes IoT and connected medical devices (IoMT). Securing it is a fundamentally different problem from IT security, and that difference shapes the segment:

• Devices usually cannot be patched, rebooted, or fitted with an agent. A turbine controller or an infusion pump runs proprietary, decades-old, safety-certified firmware that the operator will not touch. OT security is therefore built around passive techniques — monitoring the network rather than instrumenting the device.
• Availability and safety outrank confidentiality. In IT a breach leaks data; in OT a breach can stop a production line or endanger lives. The operator's first question is never whether a product can block a threat but whether it will ever interfere with the process.
• The estate is invisible by default. Most operators do not know what is on their plant network. The foundational product is therefore asset discovery and visibility — and that, not threat detection, is the value the strategics are paying for.

The product stack, layer by layer:

• Asset discovery & inventory — passively (or via safe active queries) build a real-time map of every device, firmware version, protocol, and communication path. The control plane everything else runs on.
• Network monitoring & threat detection — deep packet inspection of industrial protocols (Modbus, DNP3, EtherNet/IP, S7, BACnet) to baseline normal process behavior and flag anomalies and known ICS threats.
• Vulnerability & exposure management — match the discovered firmware to CVEs and prioritize the handful that actually matter in a network that can't be freely patched.
• Secure remote access — control the single most common breach path: third-party integrators and engineers dialing into the plant.
• Network segmentation / protection — enforce the Purdue-model zones (and increasingly micro-segmentation) that keep IT compromise from crossing into OT.

How each actor makes money and how they differ

The market splits into pure-play cyber-physical platforms, IT-security and networking vendors reaching down into OT, and the industrial automation OEMs defending their own installed base.

This market is fundamentally a contest over who owns the asset graph. The pure-play platforms (Claroty, Armis, Nozomi, Dragos) earned the trust and built the protocol depth that IT vendors can't easily replicate — but they sell into a buyer (the plant/operations side) with smaller and slower budgets than the CISO, which historically capped their growth and is exactly why the scaled ones are selling to bigger platforms that can cross-sell the CISO. The IT-security and networking vendors (Microsoft, Cisco, Fortinet, Palo Alto, Tenable) reach into OT to make their platform "see everything," and they have the distribution and the CISO relationship — their weakness is depth and the operations team's distrust of anything that might touch the process. The automation OEMs (Honeywell, Siemens, Rockwell, Schneider) own the installed base and the operator's trust but are conflicted vendors securing their own gear. The strategic logic of both mega-deals is identical: a horizontal platform (ServiceNow's workflow/CMDB, Accenture's services) buys the asset graph because asset intelligence is the connective tissue that makes exposure management, ITSM, and remediation work across the whole physical estate.

Where the value pool is migrating

Signature deals & events

• ServiceNow → Armis ($7.75B, announced 2025, closed Apr 20 2026) — the deal that institutionalized OT security. ServiceNow folds Armis's agentless asset graph into its CMDB/ITSM to build an "AI control tower" spanning IT, OT, and medical devices; says it more than triples its security/risk TAM. The bellwether transaction. See Deals.
• Accenture → Dragos (majority, ~$3.25B) + runZero + NetRise (~$4.18B package, Jun 2026) — the services giant's answer: assemble an asset-centric "xOT" stack (ICS threat intel + active asset discovery + firmware analysis) and wrap it in Accenture's delivery muscle. Dragos stays independent under Robert M. Lee. ~20x combined ARR (~$208M, +53% YoY). The competitive response that confirmed OT visibility is now a two-platform race.
• Honeywell → SCADAfence (2023) and the OEMs' build-out — automation incumbents buying or building OT-security capability around their installed base; the conflicted-but-trusted channel.
• Microsoft → CyberX, Cisco's Cyber Vision, Palo Alto → Zingbox, Tenable → Indegy — the earlier wave of IT/networking vendors absorbing OT-visibility startups as platform features; the precedent for "OT as a feature."
• Remaining independents — with Nozomi (→Mitsubishi Electric, completed Jan 28 2026), Armis (→ServiceNow, completed Apr 20 2026), and Dragos+runZero (→Accenture, announced Jun 18 2026) all acquired inside six months, Claroty is now the main remaining independent; the long tail (OTORIO, Shield-IoT, Mission Secure, Frenos, and the IoMT specialists) becomes tuck-in supply.

OT consolidation: three independents acquired in six months

The independent OT/asset-visibility set compressed sharply inside one roughly six-month window (Jan–Jun 2026). Each exit removes a comparable and re-rates the remaining independents.

The IoT-edge extension — a fourth buyer archetype enters (Jun–Jul 2026)

The consolidation is no longer confined to plant-floor OT: the same asset-centric logic is being applied one ring out, at the connected-device / IoT edge, and it has pulled a fourth buyer archetype into the race — the silicon/edge platform.

Read together with ServiceNow–Armis (IoT/IoMT breadth) and Accenture–Dragos/runZero/NetRise (firmware/supply-chain), the acquirer set for device-layer security now spans four archetypes: automation OEM · horizontal software platform · services integrator · silicon/edge platform. This widens the realistic buyer list for every remaining device-security independent (Claroty's IoMT franchise, Shield-IoT, the Cylera/Asimily/Medcrypt cluster, and the consumer/telco-CPE niche SAM occupied), and it means the "who owns the asset graph" contest is being joined from below the OS as well as from the workflow layer above.

What remains independent: Claroty is now essentially the lone scaled independent (>$100M ARR, ~80% cloud-new-revenue) — the marquee remaining prize, re-rating on scarcity. Below it, the tuck-in long tail: OTORIO, Shield-IoT, Mission Secure, Frenos, Verve (Rockwell-owned) and the IoMT specialists (Cylera, Asimily, Medcrypt). Three distinct buyer archetypes are now demonstrably live — automation OEM (Mitsubishi), horizontal software platform (ServiceNow), and services integrator (Accenture) — alongside the standing IT/networking bundlers (Microsoft, Cisco, Palo Alto, Fortinet, Tenable).

Rob Lee on the Accenture structure and the AI-into-OT wave (E25 transcript, Jul 2 2026)

The Inside the Network E25 transcript (recorded ~2 weeks before the Jun 18 announcement, published Jul 2 2026) provides seller-side detail on the year's defining OT transaction:

• Why a majority stake, not an IPO or platform sale: "I knew I wanted to build a hundred year kind of company, and it didn't matter to me… is there a PE leader? Is there an IPO leader?… you could divorce control and equity. You could divorce autonomy from structure." (21:54–22:26). The Accenture structure — majority stake, Dragos independent under Lee, runZero + NetRise operating under Dragos — is the autonomy-preserving path. For founder-led OT assets, structure terms (autonomy, brand, operating control) can outrank headline form, and buyers who can offer them widen the sellable universe.
• The demand thesis in one line: the attacks that matter in OT are misoperation, not exploits ("if the electric operator can open up a circuit breaker, so can the adversary"), and one capability now scales across hundreds of sites; Lee reports observed state→non-state capability transfer (Internet-connected-HMI defacement to PLC implants/ladder-logic manipulation "a month later") (48:17–50:08).
• AI-into-OT is outrunning validation: boards are pushing AI vendors into process-control environments in ~3 months versus the normal 12–18-month testing cycle, and "the market's gonna reset to some degree… you're gonna have startups that are now part of critical infrastructure that are no longer in existence the next day" (51:52–52:31) — both a risk datum and a consolidation predictor for the AI-in-OT startup cohort. The durable budget line is pre-incident data collection/visibility ("you can use that same data for operational value… cybersecurity value… root cause analysis"), i.e., the asset-graph thesis underlying this domain.

The bear case

The OT bull case is powerful: critical-infrastructure attacks are rising, regulation (NIS2, CIRCIA, TSA pipeline directives, the EU CRA) is forcing spend, IT and OT are converging, and the asset graph is a durable, defensible control plane — so the pure-plays compound into strategic infrastructure, as the ServiceNow and Accenture prices attest. The bear case has two prongs. First, OT security may be a feature of a bigger platform, not a standalone market. That is precisely the thesis behind both mega-deals — neither ServiceNow nor Accenture believes Armis or Dragos is a durable independent business; they believe asset intelligence is connective tissue that belongs inside a workflow/CMDB platform or a services wrapper. If they're right, Microsoft (Defender for IoT in E5), Cisco (visibility in the switch), and Palo Alto (OT on the firewall) commoditize the monitoring layer for the CISO, and standalone OT valuations compress. Second, the budget problem never fully went away — OT security is bought by operations teams with capital-budget cycles and safety conservatism, not by the fast-moving CISO software budget; demand is real but lumpier and slower than IT security, which is why even the leaders took years to cross $100M ARR. Falsifiable test: watch whether Claroty — now essentially the last marquee independent — reaches a clean public listing at a premium multiple, or whether it too gets absorbed by a platform/OEM below a standalone-IPO mark (the path Nozomi took into Mitsubishi Electric, ~$1B, Jan 2026) while Microsoft/Cisco/Palo Alto quietly win the net-new asset-visibility budget bundled into deals already signed. If the independents all sell into bundles rather than scaling to public-market independence, "OT security is its own durable platform" is breaking — and the strategics were buying a feature.

→ Cross-references: Vendors, Network & SASE, Sovereign & Government, Regulation, Deals & Comps, Valuation, Bear Case.

Adjacent market: the physical-security and IoT industry whose devices this segment defends is mapped on Physical Security & IoT.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.