Operational technology cybersecurity company Dragos has acquired runZero and NetRise as it moves to develop a broader security platform for interconnected industrial, operational and cyber-physical environments.
The acquisitions coincide with the completion of Accenture’s majority investment in Dragos, first announced in June 2026. Dragos will continue operating as an independent business under co-founder and chief executive Robert M. Lee, who has also been appointed chairman of the company’s board.
The expanded business will combine Dragos’ operational technology threat detection and intelligence capabilities with runZero’s asset discovery and exposure management technology and NetRise’s software supply-chain and firmware analysis capabilities.
Dragos describes the broader environment as extended operational technology, or xOT. The term encompasses systems capable of influencing physical processes, regardless of whether they are traditionally classified as OT, information technology, Internet of Things infrastructure or cloud services.
Examples include cloud-connected industrial analytics platforms, supervisory control and data acquisition systems, building management technology, data-centre cooling and power systems, industrial control systems, sensors and connected devices.
The expansion reflects the increasing difficulty of drawing clear security boundaries between enterprise IT and operational environments. Industrial systems are becoming more connected to cloud platforms, remote services and corporate networks, creating additional dependencies and potential pathways for attackers.
runZero brings technology designed to identify and assess devices across IT, OT, IoT, cloud, mobile and remote environments. Its platform uses active scanning, passive discovery and data from existing security systems to create an inventory of assets and associated exposures.
The technology is intended to help organisations locate unmanaged, unidentified and difficult-to-monitor devices without requiring an agent to be installed on every asset. This is particularly relevant in industrial environments, where legacy systems and equipment with long operational lifecycles may not support conventional endpoint security tools.
NetRise focuses on the software operating inside connected products and industrial devices. Its technology analyses firmware and compiled software to identify embedded components, vulnerabilities and software supply-chain risks that may not be visible through network monitoring alone.
This capability is intended to address a persistent challenge for operational technology teams: determining what software is running inside equipment and understanding whether that software contains vulnerable, outdated or compromised components.
Dragos said the acquired technologies would contribute additional information to its Intelligence Fabric, which combines OT-specific telemetry, threat intelligence and incident response findings to support the company’s security platform.
The additional data is also expected to support EmberAI, Dragos’ artificial intelligence capability for operational technology environments. The company says wider asset, exposure and firmware visibility will provide the system with more information to assist analysts with investigations and security decisions.
The acquisitions follow Dragos’ earlier purchase of Phosphorus Cybersecurity, which provides discovery, credential management and remediation capabilities for connected and embedded devices. Integration of the Phosphorus technology is already underway.
Together, Dragos, runZero, NetRise and Phosphorus are intended to provide visibility across xOT environments, identify the software operating on connected assets, assess associated risks and support remediation and threat response.
The combination also signals continued consolidation within the operational technology security market as vendors seek to address the convergence of industrial systems, enterprise networks, cloud services and connected devices through integrated platforms.
For critical infrastructure operators, the practical challenge extends beyond detecting malicious activity. Organisations need accurate asset inventories, visibility into device software, an understanding of vulnerabilities and exposures, and the ability to respond without disrupting safety-critical or time-sensitive operations.
Dragos said it would retain its vendor-neutral approach and continue supporting multi-vendor industrial environments. This will be important for operators whose infrastructure may include equipment and software from numerous manufacturers, deployed across several decades.
Existing runZero and NetRise customers are expected to retain access to their current products and services while integration work proceeds. Dragos said further information about how the two platforms will connect with its existing technology would be released over the coming months.
The company also plans to direct new capital into research and development. More than 100 positions are currently open, with Dragos indicating that additional roles will follow and that most of the planned recruitment will support product development.
The expansion comes as critical infrastructure operators face a changing threat environment involving state-sponsored groups, financially motivated criminals and less experienced actors able to use artificial intelligence to improve their capabilities.
AI is also being introduced into industrial operations for automation, analysis and decision support. While these technologies may improve productivity, their integration can create additional identities, data flows, cloud connections and dependencies requiring protection.
The acquisitions position Dragos to address a wider section of this environment, extending beyond conventional OT monitoring into asset intelligence, exposure management, embedded software analysis and connected-device remediation.
However, integrating multiple specialist technologies into a unified platform will be a significant undertaking. The value for customers will depend on how effectively Dragos can combine the acquired capabilities while maintaining product depth, interoperability and support for complex industrial environments.
