Claroty, Nozomi, Armis Top Cyber-Physical Security Rankings

Asset management expert Armis and behemoth Microsoft joined pure-play OT specialists Claroty, Nozomi and Dragos atop Gartner’s first-ever ranking of cyber-physical systems vendors.

See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge

A wide range of vendors from data diode providers to asset discovery firms historically have been grouped under the broad umbrella of “OT security.” But firms are now recognizing the unique challenges posed by industrial and cyber-physical environments, including knowing what assets they have, how those assets communicate, identifying vulnerabilities, and determining if those are exploitable.

They “were all lumped into sort of this amorphous category,” said Gartner Distinguished VP Analyst Katell Thielemann. “What we started seeing in the last five years is end users are looking for very specific pain points and use cases to solve for.”

For years, cyber-physical security relied on multiple standalone tools, but as environments grew more complex, organizations demanded platform-based solutions that provide end-to-end security visibility. Thielemann said the ideal cyber-physical systems platform should offer comprehensive asset discovery, vulnerability management with prioritization, segmentation enforcement, and compliance reporting.

“You don’t want to do all of these things with point solutions,” Thielemann told Information Security Media Group, “It’s incredibly difficult to manage in complex to deploy. So there is the same appetite for platform solutions.”

Pros, Cons of Different Cyber-Physical Security Approaches

Thielemann said pure-play vendors like Dragos, Claroty and Nozomi Networks bring deep expertise in critical infrastructure, manufacturing and industrial environment, allowing them to provide highly specialized solutions. Pure-plays can tailor their solutions to specific industry needs, but they lack control over network enforcement, making them dependent on third-party infrastructure.

“Pure-plays, because they come from the industrial heritage, they really value and invest in vertical-specific strategies,” Thielemann said. “They go deep in being thought leaders, like Dragos in critical infrastructure and utilities. Their approach is very much in sync with that industrial heritage.”

Companies like Cisco, Palo Alto Networks and Fortinet approach cyber-physical systems security from a network standpoint, using firewalls, routers and switches to provide security insights and enforcement mechanisms. While network-centric vendors can implement segmentation and firewall policies natively, she said their primary goal is selling more network equipment, which limits their focus on broad issues.

“Network-centric vendors have an inherent advantage in that they can enforce policies right within their equipment for network segmentation, which a pure-play would not be able to do, because they don’t control the switches and routers and firewalls,” Thielemann said.

Firms like Honeywell, which traditionally focused on automation and industrial control systems, have moved into security by acquiring specialized firms like SCADAfence, Thielemann said. While industrial automation companies bring domain knowledge and strong relationships with OT professionals, she said they may struggle to build out a full-fledged cybersecurity strategy due to being new entrants (see: Honeywell to Buy SCADAfence to Strengthen OT Security Muscle).

Broad IT security vendors like Microsoft have recognized the importance of cyber-physical systems security and expanded into the space through the acquisition of CyberX. While broad IT security firms provide seamless integration with existing enterprise security tools, their solutions must adapt to the nuances of industrial environments, which Thielemann said can be challenging.

What’s Next for Cyber-Physical Systems Security?

Thielemann said the rise of autonomous robots and IoT devices means that security platforms must account for wireless assets and non-traditional networked devices. While secure remote access is often a standalone tool today, the next-generation of cyber-physical platforms will integrate it natively. AI-driven technology will improve real-time monitoring and anomaly detection.

“One of the things that helped Nozomi score high in the asset discovery is they made investments in detecting wireless assets, where more and more CPS environments will have semi-autonomous robots in warehouses that communicate via private or wireless,” Thielemann said.

From a completeness of vision perspective, Gartner gave Claroty the gold, with Armis edging out Nozomi for the silver. Dragos, Darktrace and Microsoft received the fourth, fifth and sixth-highest marks, respectively. Claroty also captured the gold for execution ability, with Nozomi besting Armis for the silver. Forescout, Dragos and Microsoft received the fourth, fifth and sixth-highest scores, respectively (see: Palo Alto Networks, Cisco Dominate OT Defense Forrester Wave).

Outside of the leaders, here’s how Gartner sees the cyber-physical systems market:

• Visionary: Darktrace;
• Challengers: Forescout, Palo Alto Networks, OTORIO;
• Niche Players: Fortinet, Cisco, TXOne Networks, Sepio, Radiflow, Honeywell, Tenable, OPSWAT.

Claroty Moves Beyond OT Security Into Larger Opportunity

OT security traditionally focused on protecting industrial systems like manufacturing plants, utilities and transportation infrastructure, but Claroty identified a larger market opportunity by addressing cyber-physical systems across healthcare, retail and smart buildings, said Chief Strategy Officer Grant Geyer. The company’s bet on SaaS has proven successful, with 80% of new business now cloud-based.

While several companies compete in cyber-physical systems, Geyer said Claroty differentiates itself by focusing on fully mapping assets in a given environment. Threat detection is only as good as the data collected, and if a system fails to identify assets within an environment, security blind spots are created, which Geyer said increases the risk of attacks (see: Claroty Gets $100M for Global Growth, Microsegmentation M&A).

“Visibility quality is essential because it’s not only important to get cybersecurity value, it’s also what gives our security practitioner customers credibility with the engineering teams,” Geyer told ISMG. “And if they don’t have credibility with the engineering teams, then the platform is rejected. And so we put our thumb on the scale in every way possible to ensure we had the best visibility quality.”

Gartner criticized Claroty for confusing pricing options, limited reach outside of North America, and lag for feature parity with its on-premises offering. Geyer said Claroty has bet on regions where demand is strongest, deliberately lags its on-premises version since enterprise customers often prefer quarterly updates, and has found pricing standardization tough since infrastructure measures differ by industry.

“In terms of revenue generation, we’ve been very purposeful that we invest in terms of sales and marketing investments based upon where the markets are,” Geyer said. “If you look at the GDP of the top countries in the world, that is a direct reflection of where our business and revenue has grown.”

Nozomi Takes On Wireless, Endpoint Defense, Threat Intel in OT

Nozomi has launched tools that address cyber-physical challenges around wireless security, endpoint security for industrial control systems, enhanced threat intelligence, and risk assessment, said CEO Edgard Capdevielle. The shift toward wireless networks and IoT in industrial environments has boosted the attack surface, making it crucial for firms to adopt new security measures to protect CPS systems.

The company’s approach to cybersecurity is unique because it has stayed focused on OT while competitors have diversified into healthcare and broader IoT markets, according to Capdevielle. He said Nozomi is in a strong financial position with cash reserves still intact from its last funding round, while competitors are operating at a loss due to their aggressive growth strategies (see: Schneider Electric and Mitsubishi Give Nozomi Networks $100M).

“Before, Nozomi was telling you that a vulnerability in this PLC versus that PLC were equal, but now with this additional threat intelligence, we can tell you that one is being actively exploited by Chinese agents in your industry,” Capdevielle said. “So obviously, you’re going to pay more attention to that one.”

Gartner criticized Nozomi for a lack of sales resources, requiring a strict process for the proof of concept process, and customer difficulties in adapting new tools to their environments. Capdevielle sees Nozomi’s products are user-friendly and easy to deploy, believes the company’s innovations will be adopted over time, and has focused on sustainable profitability by not over-investing in sales.

“Is it true that our customers have not been able to absorb every one of our products that we just launched? Absolutely,” Capdevielle said. “The adoption is going to be lagging or less than desirable for the number of products that we have.”

Armis Combines Passive, Active Signals to See Threats Sooner

Armis introduced a hybrid approach to security monitoring, combining passive detection with active queries to achieve faster, more comprehensive visibility into their assets, security gaps, and potential vulnerabilities, said CEO Yevgeny Dibrov. Zero Trust principles have been a major focus, particularly in CPS environments where security risks are high due to interconnected operational technologies.

The company introduced a proprietary system that prioritizes threats based on their impact and relevance, which Dibrov said allows companies to detect threat patterns before they become incidents. Unlike some competitors that focus only on detecting vulnerabilities, Armis prioritizes risk management, mitigation, and enforcement since customers should measure success based on what they fixed (see: Armis Secures $200M to Drive M&A and Federal Market Growth).

“Customers love to start in a passive way,” Dibrov said. “But also, when you have something that we’ve been working for a long, long time – when it’s a very safe active query – this is something that provides extra data. This is something that can address devices which are not talkative and provide a complete, complete view. You also can adjust it into specific, specific environments.”

Gartner criticized Armis for selling advanced features separately, not prioritizing deep vertical industry knowledge, and cutting into profit with large investments. Dibrov said pricing has never been a deal-breaker, Armis’ cloud-first strategy will eventually cover all industries, and successful acquisitions and sustained growth are evidence of financial stability.

“I have yet to see a customer deal fall through because some license costs something,” Armis CTO Nadir Izrael told ISMG. “I don’t think that has happened in our business history, and that’s because we are very, very much about long-term value for our customers, both existing and new ones.”

Active Monitoring, Lightweight Collector Among Key Dragos Bets

Dragos traditionally relied on monitoring network traffic without directly probing assets, but this has limitations in identifying device attributes that are not transmitted over the network, said VP of Product Management Mike Schuricht. By introducing active asset discovery, Dragos can query assets directly, getting more detailed information about their configurations, firmware versions, and security issues.

The company has also debuted a lightweight collector to extend asset visibility by collecting data from remote or constrained environments and forwarding it to central analysis platforms. And by introducing modular chassis support, Schuricht said Dragos now groups these components together, accurately representing the parent-child relationships between a controller and its connected modules (see: Dragos Boosts OT Defense with Network Perception Acquisition)

“Generally, our focus is really hardcore on OT, and so this CPS expanded this artificial systems into not just that focus, but also IoT and IT as well. So you see some of the other vendors in there that had more focus on the IT side get pulled in, like Armis for example,” Schuricht told ISMG.

Gartner criticized Dragos for limited reach outside North America and into channel partners as well as a more narrow industry strategy. Schuricht said Dragos plans to broaden its focus beyond electric, oil and gas and manufacturing, and is actively working to expand its global footprint through increased channel partnerships.

“One of the things we’re really focusing on for this next year and beyond is a pure channel focus so that we can get more of that breadth in that region, work with more partners globally, beyond just the focus in North America,” Schuricht said.