Dragos Platform 3.0 faces a crowded market

Dragos estimates the worst-case global costs for OT cyber incidents involving business interruption could reach $172.4 billion in a single year. This figure comes from a 2025 report produced with Marsh McLennan. Most of those losses come from indirect costs rather than direct incident losses. In Q1 2025 alone, 708 ransomware incidents hit industrial entities. Ransomware activity in 2026 shows no slowdown, as threat actors target manufacturing and healthcare with precision. I find the "Now, Next, Never" risk prioritisation methodology in Platform 3.0 useful for preventing security teams from drowning in useless alerts. The Insights Hub provides an aggregated view of risks, vulnerabilities, and threat alerts. This tool uses AI-enhanced vulnerability analysis to speed up back-end processing. Dragos also includes the STS-50 device and Sensor/SiteStore configuration to help smaller facilities extend security coverage. Expanded Active Collection functionality supports air-gapped sites or environments with intermittent connectivity. These updates address the fact that attack timelines for adversaries have shortened to weeks or even days. In the past year, 22% of organisations saw an ICS or OT incident, and 40% of those incidents caused disruption.

Dragos secured a massive valuation after Accenture agreed to buy a majority stake in the company as part of a $4.175 billion deal in June 2026. Robert Lee stated that Dragos holds a $3.25 billion valuation within that package. Meanwhile, Claroty holds a Leader designation in the 2026 Gartner Magic Quadrant for CPS Protection Platforms. Claroty’s platform includes xDome, which is delivered as software-as-a-service, along with Continuous Threat Detection and xDome Secure Access. At the S4 Conference in Miami, Claroty demonstrated its discovery approach in a test manufacturing environment to show how it achieves asset visibility. Claroty also secured a Representative Vendor spot in the 2026 Gartner Market Guide for CPS Secure Remote Access. Claroty holds a 4.9 out of 5 score on Gartner Peer Insights based on 119 ratings from the last 12 months. However, I notice Claroty’s mindshare in the Operational Technology (OT) Security category fell to 12.7% from 24.3% last year. You should consider if a platform can manage the convergence of IT and OT without creating more complexity. The increasing frequency of ransomware campaigns, which now use AI to accelerate the kill chain and improve malware evasion, forces organizations to choose between investing in specialized OT tools or relying on inadequate IT-centric solutions. Claroty uses its $150 million Series F financing to invest in research and AI adoption.

Iranian-affiliated threat actors target unsecure internet-connected devices, including programmable logic controllers from Siemens and Schneider Electric. Unplanned downtime from OT security incidents costs organizations an average of $288,563 per hour. Most operators lack a complete inventory of their networked devices, which makes assessing exposure nearly impossible.

Censys counted more than 145,000 internet-exposed ICS services worldwide, with 48,000 of them in the United States. Dragos counted more than 46,000 internet-exposed devices speaking Modbus globally. This protocol dates back to 1979 and lacks a password field. About 34% of exposed HMIs trace to water and wastewater, while 23% belong to agriculture. Attackers often use living off the land techniques, using built-in administrative tools and valid credentials to hide in a network. Identifying the true owner of an exposed device is difficult because IP addresses often only reveal a network operator like Verizon. One question remains: can a software-only solution effectively protect a facility with decades of legacy hardware? I recommend checking if a vendor’s collection method requires new hardware that could interrupt production.