Dragos OT threat detection for industrial control systems

Adversary movement and passive detection

Adversaries move through the ICS Cyber Kill Chain at different speeds. Some groups focus on initial access, while others reach Stage 2 to conduct reconnaissance and testing inside OT environments. This movement allows them to understand control loops for future manipulation. In 2026, three new threat groups emerged and established groups expanded globally. Ransomware causes significant operational disruptions in the manufacturing sector. Only a small number of OT networks have the visibility to detect these threats before they impact operations. The Dragos Platform avoids the risk of crashing fragile devices because it uses passive-first monitoring via SPAN ports or TAPs. Active scans often confuse safety controllers and trigger shutdowns. The platform builds visibility into assets, covering firmware versions, hardware, OS, and open ports. It also monitors communication history and command usage. This visibility helps teams make data-driven decisions and improve incident response times. The platform identifies unauthorized or forgotten devices that remain connected to the network.

Intelligence and protocol capability

The platform understands 600+ ICS protocols and identifies specific behaviors like unauthorized PLC programming or unexpected firmware downloads to ensure users see the difference between normal traffic and a real threat during production. Robert Lee, Jon Laverty, and Justin Cavinee founded Dragos in 2016. Lee led the first USAF ICS cyber defense mission and wrote the original analysis of CRASHOVERRIDE. The platform detects malware such as TRITON, PIPEDREAM, and FrostyGoop. It tracks 20+ activity groups, including Voltzite, which targets electric transmission, and Hexane, which focuses on oil and gas. It also monitors CyberAveng3rs, a group that targeted Unitronics PLCs in the US water sector, and tracks ELECTRUM, which exploited OPC-DA to manipulate circuit breakers. Users receive Knowledge Packs every week. These updates contain new threat detections, updated indicators of compromise, and device fingerprints. The platform identifies vulnerabilities by mapping them against the actual asset inventory. For assets that cannot be patched, the platform recommends alternative mitigations such as network segmentation rules or monitoring rules. Users also use Neighborhood Keeper to share anonymized threat intelligence across a network of customers. You already know the importance of context, so look at how the platform identifies specific commands sent to a PLC. Dragos excels at adversary tracking, but it lacks the automated NERC CIP compliance evidence generation that Industrial Defender provides.

Support through OT-CERT and OT Watch

Dragos provides OT-CERT to help asset owners build security programs. This resource gives members access to training, workshops, and tabletop exercises. Large companies use these tools to improve the security of smaller supply chain partners. Dragos partnered with the National Association of Manufacturers to support 14,000 member companies. For teams without dedicated staff, OT Watch provides managed threat hunting and response. This service uses human experts to hunt for threats and investigate anomalies. It helps organizations bypass alert fatigue by filtering noise. OT-CERT provides free industrial cybersecurity resources for the ICS/OT community. This helps reduce OT risk for small and medium-sized businesses. Claroty focuses on a wide range of cyber-physical systems, while Nozomi has network security roots. The company focuses on the full operational technology environment, which it calls "xOT." The platform detects threats by mapping every finding to the MITRE ATT&CK for ICS framework. This allows users to see the exact tactic and technique that triggered an alert. OT Watch provides the platform’s detection capability plus experienced ICS defenders to work the environment. This service is the only one of its kind in the industry. Can smaller organizations maintain these security levels without continuous external support?