OT and Industrial Cybersecurity — Asset Discovery and Threat Detection for Plants, Grids and Hospitals
Entry signal — what decides who wins here
Structure decidesThe binding constraint is not executional. Being better than the incumbent does not, by itself, get you in — this one is cleared with capital, an asset, or a permission.
Come with the asset, or buy the business that owns it. Plant, fleet, land or quota decide this market before any operating skill does. Operators here are bought, not started.
Measured, not forecast: the share of US establishments opening in one year that were still active later. It counts good operators and bad ones together, which is exactly why it is the honest answer to “what are the odds”. It is for the whole sector rather than this market, and the ten-year figure comes from an older cohort because no younger one has reached ten years.
This is not a probability of success, and it is not a verdict on you. No survival probability is published per market, and inventing one would be worse than saying so. What the bar reads is how much of the outcome sits inside an operator's control: green means the hurdles are ones a better operator clears, red means the binding constraint is capital, an asset or a permission rather than execution. Someone arriving with an advantage this screen did not assume can win a market shown in red.
Companies named in this market · 18
The binding constraint — capital intensity
In 2026 the category's leading independents were bought, and the buyers were an automation maker, a workflow platform and a consultancy. Mitsubishi Electric agreed in September 2025 to pay US$883M for the 93.0% of Nozomi Networks it did not already own. Nozomi announced on 2026-01-28 that the deal had closed, saying it "recently surpassed $100M in revenue" and would run as a wholly owned subsidiary [A for the price, from Mitsubishi Electric's release; C for the revenue claim]. ServiceNow agreed on 2025-12-23 to buy Armis for $7.75B in cash. That came weeks after Armis's $435M pre-IPO round valued it at $6.1B [B, SecurityWeek], and the deal completed in April 2026 [B, SecurityBrief]. Accenture announced on 2026-06-18 that it would take a majority stake in Dragos at a $3.25B price and buy runZero and NetRise outright, $4.18B in all [B, CyberScoop]. That deal closed by 2026-09-21 [B, The Next Web]. Earlier, Honeywell had announced in July 2023 that it would buy SCADAfence [A, Honeywell release title], and Advent International took Forescout private in August 2020 at $29.00 a share [A, SEC exhibit]. Canada's one visible industrial-networking security vendor, iS5 Communications, raised C$22M in 2018 [B, SecurityWeek]. Its site now says it "is now: Phoenix Contact Network Communications Inc." [C]. The one large independent left is Claroty. It raised a $150M Series F led by Golub Growth on 2026-01-22, taking it to roughly $900M raised [A for the round, B for the total]. Its $400M Series E in December 2021 came with the purchase of Medigate, which is how hospitals and medical-device (IoMT) security came into this category [B]. TXOne Networks, a Trend Micro–Moxa joint venture, has disclosed about $145M across its Series A, Series B and B extension [B]. The listed platforms already sell an OT line inside their main product: Tenable OT Security, Fortinet's OT Security Platform, Palo Alto Networks' Device Security, Cisco Cyber Vision and Microsoft Defender for IoT. Each is one product in a filing that reports a single figure: Tenable $999.4M, Fortinet $6.80B, Palo Alto $11.48B [A, 10-Ks]. Demand comes from rules that apply by sector. In the US these are NERC CIP for the bulk power system and TSA Security Directive Pipeline-2021-02G, listed on TSA's site [A]. ISA/IEC 62443 is the cross-industry standard [A, ISA]. In Canada, Bill C-8 received royal assent on 2026-06-15 as S.C. 2026, c. 9, covering the finance, telecom, energy and transport sectors [A, LEGISinfo and Public Safety Canada]. How this differs from its neighbours. CNAPP (541514) secures cloud workloads, and IAM (541514) secures human and machine identities. Both live in IT. Industrial IoT and predictive maintenance (333) uses the same plant data to predict machine failure, not attacks. Utility metering, billing and customer systems (2211) is the utility's revenue system. This record covers the passive network sensors that learn industrial protocols such as Modbus, DNP3 and S7, then inventory every PLC, RTU and infusion pump and flag abnormal commands. It also covers the remote-access brokers and one-way gateways that control the way into a plant. The 2211 anchor is navigation only. The buyers are electric utilities, oil and gas pipelines and refineries, water and wastewater systems, manufacturers, and hospitals. Capital intensity decides it. An entrant needs protocol parsers for decades of vendor-specific equipment, a threat-intelligence team that utilities will trust, and certification and audit evidence for NERC CIP and IEC 62443. It would be selling against vendors that each have raised or been bought for hundreds of millions to billions of dollars, and that are now owned by companies selling into the same plants.
Sectors joined: Cleantech · ClimaTech · Energy · Renewable Energy · Energy Storage · Energy AI
[UNVERIFIED] Sector-to-NAICS mapping is analyst judgment — see data/angel-sector-map.json. Counts are a per-record cross-reference and are not additive across records.
The incumbent
Who owns this market and who is coming for it. Fields a screen never reached say so rather than guessing.
Financials & market size — sourced
Figures that came from a filing, a results release or reputable reporting, each carrying its evidence tier.
The field
Every vendor named on this record, and what each one discloses. Most disclose nothing, which is why the market is not sized.
Competitor set · 12 named · 0 disclose revenue
| Name | Revenue | Share | Note |
|---|---|---|---|
| ClarotyB | not disclosed | — | Private; no revenue published. $150M Series F led by Golub Growth (2026-01-22, New York), taking total raised to about $900M [B, SecurityWeek]; $400M Series E and the Medigate purchase in December 2021 [B]. A reported $3B valuation has not been confirmed by Claroty — The largest independent left; covers industrial (xDome, Secure Access) and healthcare IoMT after buying Medigate |
| Dragos (Accenture)B | not disclosed | — | Private; no revenue published. $200M Series D at $1.7B (2021-10-28), led by Koch Disruptive Technologies and BlackRock-managed funds [A, Dragos release]. Accenture majority stake at a $3.25B price announced 2026-06-18 and closed by 2026-09-21, together with Dragos absorbing runZero and NetRise [B] — Hanover, Maryland. Threat detection plus ICS threat intelligence and incident response; continues as an independent business under Accenture |
| Nozomi Networks (Mitsubishi Electric)A | not disclosed | — | Says it 'recently surpassed $100M in revenue' at close [C]. Mitsubishi Electric bought the 93.0% it did not hold for US$883M through a reverse triangular merger [A]; closed 2026-01-28 [A, Nozomi release] — San Francisco. OT/IoT asset visibility and threat detection; runs as a wholly owned, vendor-neutral subsidiary |
| Armis (ServiceNow)NYSE: NOWB | not disclosed | — | Not disclosed. ServiceNow agreed to pay $7.75B in cash (2025-12-23), weeks after a $435M round at $6.1B [B, SecurityWeek]; completed April 2026 [B, SecurityBrief] — Asset intelligence across IT, IoT, OT and medical devices; now one source of asset data for ServiceNow's workflows |
| ForescoutA | not disclosed | — | Private since 2020-08-17, when Advent International completed its $29.00-a-share tender, with Crosspoint Capital Partners as co-investor [A, SEC exhibit 99.(a)(1)(I)]. No revenue published since — Began in network access control; now sells OT and IoMT visibility and publishes OT vulnerability research |
| Tenable OT Security (Tenable)NASDAQ: TENBA | not disclosed | — | Not broken out. Tenable reported FY2025 revenue of $999.405M (+11.0%) in a 10-K filed 2026-02-27 and states one operating segment [A] — Exposure-management vendor (Columbia, Maryland) with an OT line for converged OT/IoT networks |
| Fortinet OT Security (Fortinet)NASDAQ: FTNTA | not disclosed | — | Not broken out. Fortinet reported FY2025 revenue of $6,799.6M in a 10-K filed 2026-02-25, which names OT as a customer vertical and describes an 'OT Security Platform' [A] — Sells ruggedised firewalls plus FortiGuard OT services; segmentation is the entry point in plants |
| Palo Alto NetworksNASDAQ: PANWA | not disclosed | — | Conglomerate scale; OT not broken out. FY ended 2026-07-31 revenue $11,480M (prior year $9,221M) per the 10-K filed 2026-09-10, which describes a Device Security service covering IoT, medical and OT devices [A] — Sells OT visibility as a subscription on its firewalls |
| Cisco Cyber Vision (Cisco)NASDAQ: CSCOC | not disclosed | — | Not broken out; a product inside Cisco's industrial IoT networking line [C, product page] — Runs as a sensor inside Cisco industrial switches and routers. Its distribution reaches any plant already on Cisco networking |
| Microsoft Defender for IoT (Microsoft)NASDAQ: MSFTC | not disclosed | — | Not broken out [C, Microsoft Learn overview] — Agentless network sensors that identify OT protocols and devices, feeding Microsoft's security stack |
| Honeywell (SCADAfence)NASDAQ: HONC | not disclosed | — | Not broken out. Honeywell announced the SCADAfence purchase in July 2023 to add to Honeywell Forge Cybersecurity+ [A, release title opened; body did not render]. Price not opened — The automation-OEM route: OT security sold with the control system |
| TXOne NetworksB | not disclosed | — | Private. $12.9M Series A (total $23.7M then), $70M Series B led by TGVest Capital (2022), $51M Series B extension (May 2024) — about $145M disclosed [B, SecurityWeek and Industrial Cyber; extension from trade reprints] — Trend Micro–Moxa joint venture with HQ in Taiwan and Texas; endpoint lockdown and inline protection for production lines and semiconductor fabs |
Nobody here publishes revenue. The market is not sized for that reason — an estimate built on nothing would only look like knowledge.
Startups & challengers
Newer and smaller vendors going at the incumbent — funded challengers first. Named, not researched to the depth of the field above; a company with a page here links to it.
| Company | Stage | What it does | Raised |
|---|---|---|---|
| iS5 Communications | Funded challenger | Canadian industrial networking and cyber vendor; raised C$22M in 2018; its site says it is now Phoenix Contact Network Communications Inc. | C$22m |
| NetRise | Funded challenger | Firmware and software supply-chain analysis (SBOMs from compiled code); acquired by Dragos, 2026 | — |
| runZero | Funded challenger | Asset discovery and exposure management; acquired by Dragos alongside Accenture's majority investment, 2026 | — |
| Shift5 | Funded challenger | Rosslyn, Virginia. OT data and cyber monitoring for rail, aviation and defence fleets; founded 2019; says $185M in venture funding | $185m |
| Waterfall Security | Funded challenger | Hardware-enforced unidirectional gateways for power, oil and gas, water and rail; 'protecting critical industrial networks since 2007'. Funding not opened | — |
| Industrial Defender | Scrappy competitor | OT asset and NERC CIP compliance management; bought from Capgemini America by TELEO Capital (Jan 2020). Not Accenture. Site returned 403 | — |
Evidence
Evidence. Opened 2026-10-18 to 2026-10-20. Tier A: Mitsubishi Electric's September 2025 acquisition release, mirrored on us.mitsubishielectric.com: 7.0% held, 93.0% bought, US$883M, reverse triangular merger. Nozomi Networks' own release of 2026-01-28 confirming the close, the wholly owned subsidiary and the 'surpassed $100M in revenue' line, which is a company claim [C]. Dragos's Series D release of 2021-10-28 ($200M at $1.7B, Koch Disruptive Technologies and BlackRock-managed funds, Hanover MD). Claroty's own Series F release (NEW YORK, 2026-01-22, Golub Growth). From EDGAR: Tenable's FY2025 10-K ($999.405M; one operating segment; Tenable OT Security; Columbia, Maryland), Fortinet's FY2025 10-K ($6,799.6M; OT as a vertical; OT Security Platform; Sunnyvale) and Palo Alto Networks' FY2026 10-K ($11,480M; Device Security covering OT; Santa Clara). Revenue was taken from XBRL company facts. The Advent–Forescout tender-completion exhibit (2020-08-17, $29.00, Crosspoint co-investor). TSA's Security Directives page (SD Pipeline-2021-02G and the rail directives). ISA's 62443 series page. LEGISinfo for Bill C-8 (royal assent 2026-06-15, S.C. 2026, c. 9) and Public Safety Canada's release of 2026-06-16 (finance, telecom, energy and transport). Honeywell's SCADAfence release: only the title rendered. Tier B, opened: SecurityWeek on Claroty's Series F (about $900M total) and Series E plus Medigate (2021-12-08), on ServiceNow–Armis ($7.75B; $435M at $6.1B; expected close H2 2026), on TXOne's $70M Series B, and on iS5Com (2018). SecurityBrief NZ on the Armis completion (2026-04-22). CyberScoop on Accenture–Dragos (2026-06-18; $4.18B, $3.25B for the majority). The Next Web on the Dragos close (2026-09-21). Private Equity Wire on TELEO–Industrial Defender (2020-01-27). Tier C: vendor pages for Claroty, Dragos, Forescout, Waterfall, Shift5 ($185M, founded 2019), TXOne, runZero, NetRise, Cisco Cyber Vision, Microsoft Defender for IoT, and iS5's notice that it is now Phoenix Contact. NOT opened or NOT sourced: NERC CIP was not fetched because nerc.com's robots.txt bars Claude, and ferc.gov returned 403, so CIP is named but not cited. Bill C-8's in-force status and designated operator classes were not checked on the statute itself. The TXOne $51M extension and the Mitsubishi closing release (with Nozomi's revenue table) sit on businesswire.com, which returned 403, so they rest on search snippets. Dragos's total raised after 2021 was not opened. SCADAfence's price and close were not opened. Armis's, Claroty's and Dragos's revenue are unpublished. Market size and OT segment revenue are UNVERIFIED: no vendor breaks OT out, and the only figure found is Honeywell's own projection of more than $10B. Prices are UNVERIFIED. No verifiable Canadian pure-play OT-security vendor was found. iS5 is now part of Phoenix Contact.
Where the industry talks
The associations, forums and events where people in this trade actually talk shop — where to listen before entering, and where the first customers are found. Each link was opened on the date shown.
ICS security conference; S4x27 is 8–11 Feb 2027 in Tampa, per the site
Long-running conference where ICS users, vendors and government meet; 'USA 2026' edition listed
ISA's alliance promoting ISA/IEC 62443 adoption, conformance and ISASecure certification
Information sharing and analysis centre for drinking-water and wastewater utilities; membership-based
The North American electricity sector's threat-sharing centre; public site loads behind a portal
National association of Canadian utilities; the operators most likely to be designated under Bill C-8
Trade news site for OT/ICS and SCADA security, covering deals, regulation and threats
r/SCADA and r/ICS were not checked because reddit.com's robots.txt disallows all agents. The SANS ICS Summit and Health-ISAC were not opened. No Canadian OT-security user group was found.