OT security is sold as a frontier, all exotic protocols and nation-state saboteurs. The evidence tells a more domestic story: most attacks that stop a plant walk in through the office. So is the Purdue model Over The Top, and do Nozomi Networks and Claroty earn their keep when the attacker arrives through the VPN?
Status: correct as at 25 October 2026. Cyber-Threat.net has not tested any of the products mentioned. Prices are public list prices as displayed on the dates given; real deals are negotiated. No vendor sponsored, reviewed or saw this article before publication, and there are no affiliate links.
The front door is usually IT’s
The incident everyone cites as an OT attack wasn’t one. Colonial Pipeline’s chief executive told the US Senate in June 2021 that DarkSide “encrypted our IT systems” after getting in through a “legacy VPN profile” protected by a single password. He said Mandiant “has not confirmed any evidence that they were in the OT system”, but “if there was one percent chance that that OT system was compromised, it was worth shutting the pipeline system down”. Colonial paid $4.4m (Senate HSGAC hearing transcript, 8 June 2021).
Norsk Hydro tells the same story with a different accent. LockerGoga ransomware (Microsoft, 16 December 2019) hit the aluminium maker’s entire global organisation in March 2019. Extruded Solutions took the worst of it; the other business areas produced close to normal on “work-intensive workarounds and manual procedures”. Hydro puts the total cost at around NOK 800m (Hydro, page updated 15 May 2024).
The surveys agree. In SANS’s 2025 ICS/OT budget survey of more than 180 professionals, 58% named IT compromise spreading into OT as the leading initial attack vector. Internet-exposed devices (33%) and transient devices such as vendor laptops (27%) followed, though SANS counts those two as shares of attacks rather than of respondents (SANS, March 2025). Dragos describes 2025 affiliates logging in to VPNs with stolen credentials, then moving to the ESXi hosts running SCADA and HMI workloads. In one Fog case “no PLCs or field devices were touched”, yet operators lost view and control until the hosts were rebuilt (Dragos 2026 OT Cybersecurity Year in Review, February 2026). Dragos and Claroty both sell OT security, and their figures come from their own customers and engagements; nobody else publishes this much.
States play a longer game. The Volt Typhoon advisory describes actors pre-positioning on IT networks to “enable lateral movement to OT assets”, in some cases keeping access for at least five years (CISA AA24-038A, 7 February 2024).
How rare is a purely OT attack?
Rare enough that the industry can count them. When Dragos disclosed FrostyGoop in July 2024, it called it the ninth known ICS-specific malware and the first to use Modbus TCP to cause impact (Dragos intelligence brief, July 2024). It had cut heating to more than 600 apartment buildings in Lviv for nearly two days (TechCrunch, 23 July 2024). Nine families in the decade and a half since Stuxnet: fewer than a cricket side, and nobody’s declared. Even FrostyGoop possibly got in through an internet-facing router, according to Dragos, which also found the router, servers and controllers were not adequately segmented.
Mandiant, writing in 2022, noted that “in most cases victims have suffered damages exclusively restricted to enterprise systems”, then added that this “does not mean that operational technology (OT) systems are not at risk”, and spent the rest of the post showing how a FIN11-style crew could reach OT servers (Mandiant, 26 July 2022).
The caveat is large. Dragos estimates that “fewer than 10 percent of OT networks worldwide have network visibility and monitoring”. It also warns that ransomware is routinely labelled “IT only” because a Windows HMI looks like any other PC (Dragos, February 2026). OT-native attacks are rare among the attacks we can see, and we can’t see much. Nobody publishes a reliable count of purely OT-originated incidents; the data is thin.
Hygiene is boring. So is a seatbelt
If the attack path runs through IT, the cheapest controls are IT controls applied with OT discipline. Dragos’s figures read like a charge sheet:
- 73% of its incident response cases (all time) involved exploitation of VPNs or jump hosts, or reuse of valid credentials on them.
- 49% of its 2025 service reports found weaknesses in remote access.
- 53% found public or internet-facing systems.
- Fewer than 5% of Dragos services engagements found PowerShell execution logging switched on.
All from the 2026 Year in Review. Claroty’s Team82 found known-exploited vulnerabilities on 12% of the 940,000-plus OT devices it studied across 270 organisations, and 40% of those organisations had some of those devices insecurely connected to the internet (Claroty Team82 report; press release, 4 February 2025).
The fixes are unglamorous:
- Phishing-resistant MFA on every remote path into OT, vendor tunnels included.
- A separate OT identity domain.
- Hardened, monitored hypervisors.
- Offline, tested backups of PLC logic and HMI builds.
Detection and response is where the money shows, or so the sellers say. Dragos, which sells OT monitoring, says organisations with comprehensive OT visibility contained OT ransomware in five days on average, against 42 days industry-wide (Dragos press release, 17 February 2026). Its own report frames the five days as the 2025 average across Dragos OT ransomware cases and the 42 as an all-time figure, so the two numbers come from different case sets (Year in Review). Treat it as a sales argument with data behind it. SANS’s 2025 State of ICS/OT Security, drawing on more than 330 professionals, found that 21.5% had an incident in the past year, four in ten of those disrupted operations, and nearly one in five took more than a month to remediate (SANS, 20 November 2025).
Segregation: walls that actually stop things
In January 2026 the NCSC, CISA, the FBI and five other agencies issued eight Secure Connectivity Principles for OT (CISA, 14 January 2026; NCSC PDF). Among them: harden the boundary, broker IT-to-OT data through a DMZ, segment, log, and keep an isolation plan for cutting OT off on purpose. That last is the Colonial lesson: decide in advance how to island the plant, not at 5am with the lawyers on the phone.
Dragos found shared IT and OT domains in 12% of its 2025 reports overall, but in 46% of manufacturing reports, against 14% in oil and gas and 12% in electric (Dragos, February 2026). A plant that shares Active Directory with head office has a firewall in the way the Maginot Line had a flank.
Is the Purdue model Over The Top?
The Purdue model stacks an industrial estate in levels: field devices at the bottom, enterprise IT at the top, a DMZ between levels 3 and 4. It dates from Purdue University work published in 1989 and still appears in NIST SP 800-82 Rev. 3 (September 2023). NIST’s draft Rev. 4 (21 September 2026, out for comment until 30 November 2026) still uses the Purdue levels and suggests applying zero trust to the upper ones. The fashionable complaint is that it is Over The Top for an age of cloud historians, and the tidy layer cake was never built anyway.
Half of that is fair. Level 2 and level 3 workloads may share one ESXi cluster, and a cloud connection skips three floors at once. But the evidence above shows attackers succeeding where the boundary was absent or porous, not where Purdue-style separation was enforced and failed. The model isn’t OTT; it is under-enforced. The better tool is the zones and conduits approach of ISA/IEC 62443, which the NCSC guidance points to: group assets by security need, then control and monitor every permitted path between groups. Keep the levels as vocabulary; enforce the conduits.
The vendors, side by side
Gartner’s Magic Quadrant for CPS Protection Platforms (Katell Thielemann, Ruggero Contu, Wam Voster, Sumit Rajput, 3 March 2026) evaluated 13 vendors. It named Armis, Claroty, Dragos and Nozomi Networks as Leaders (Claroty, 9 March 2026; Armis, 9 March 2026; Dragos, 9 March 2026). Nozomi says it was placed highest on both axes (Nozomi, 16 March 2026). Several Leaders, Nozomi, Armis and Dragos among them, offer a licensed copy of the report in exchange for registration (Nozomi; Armis; Dragos). Microsoft and Tenable were among the 13 evaluated; we haven’t confirmed their quadrant positions from a licensed copy, so we don’t state them. Peer Insights ratings below were read from Gartner’s market page on 25 October 2026. Reviews are self-selected. See the Gartner note at the end.
| Vendor | Gartner MQ 2026 | Peer Insights (25 Oct 2026) | Public list price | Ownership | Best fit |
|---|---|---|---|---|---|
| Nozomi Networks | Leader | 4.9 (328 ratings) | $218,880 a year for 5,000 assets, sensors included (AWS Marketplace, read 25 Oct 2026) | Mitsubishi Electric, completed 28 Jan 2026; says it stays vendor-agnostic | Multi-site, protocol-heavy estates |
| Claroty | Leader | 4.9 (363 ratings) | From $100,000 to $1.2m a year by tier; threat detection from the $350,000 tier; unit not defined (AWS Marketplace, read 25 Oct 2026) | Private; Series F, 22 Jan 2026 | Buyers who want secure remote access in the same contract |
| Dragos | Leader | 4.6 (119 ratings) | $100,000 a year for CentralStore, up to 50 SiteStores; site components not itemised (AWS Marketplace, read 25 Oct 2026) | Accenture majority stake, agreed 18 Jun 2026, closed 16 Sep 2026 | Operators who want threat intelligence and incident response from one supplier |
| Armis (ServiceNow) | Leader | 4.7 (120 ratings) | Minimum only: $39,000 for 12 months (“Centrix Standard minimum”; private offers) (AWS Marketplace, read 25 Oct 2026) | ServiceNow, closed 20 Apr 2026 | Mixed IT, OT and IoT asset estates; ServiceNow shops |
| Microsoft Defender for IoT | Evaluated; position not confirmed | 4.3 (29 ratings) | From £53.80 to £1,153.40 a site a month, ex VAT, on an annual commitment (XS up to 100 devices; XL up to 5,000) (Microsoft UK, read 25 Oct 2026) | Microsoft | Smaller or single-site estates already committed to Microsoft security tooling |
| Tenable OT Security (now sold as Tenable One OT Exposure) | Evaluated; position not confirmed | 4.9 (39 ratings) | Not public (BYOL on AWS); licensed per IP-addressed device | Tenable | Tenable vulnerability-management customers adding OT |
All the AWS listings invite private offers, and the list prices aren’t comparable like for like. Nozomi’s bundle counts assets across sites. Claroty’s tiers add capability rather than scale. Dragos’s listing covers the central management layer. Armis publishes only a minimum on AWS Marketplace; the real number comes by private offer. Microsoft’s licence is per site, and you supply the sensor appliances. On the Armis and Dragos ownership changes, see our acquisitions scorecard.
Cost versus risk: does it stack up?
The arithmetic, with health warning: Nozomi’s public bundle works out at about $44 an asset a year. Microsoft’s largest site licence works out at £13,840.80 a year before VAT for up to 5,000 devices at one site, under £3 a device. Claroty’s entry tier is $100,000 a year; threat detection starts at the $350,000 tier, and the listing doesn’t say what a unit is. Against that, Norsk Hydro’s bill was about NOK 800m, and Colonial’s ransom alone was $4.4m, before counting the days with the pipeline shut.
Neither attack reached the controllers, so an OT network sensor would not have stopped either. At Colonial it might have shortened the shutdown, by showing the OT side was clean. That is the best case for the tooling, and it is not nothing. But if the threat mostly arrives through IT, the first pound goes on IT hygiene and the second on the boundary.
The third pound has a better case than sceptics allow.
- Asset inventory. You cannot segment, patch or isolate what you cannot list.
- Detecting the pivot. Watching the boundary and protocols tells you the attacker has arrived before the HMIs go dark. Endpoint tools generally don’t decode a Modbus write.
- Evidence. Without OT telemetry, “it wasn’t cyber” is a hope rather than a finding.
A middle path for the budget-constrained: CISA’s free Malcolm network-analysis suite, built on Zeek and other open-source tools, parses common industrial protocols if you have people to run it.
Verdict on Nozomi and Claroty
Nozomi Networks: worth shortlisting, once the basics are in. Gartner placed it among four Leaders, Peer Insights reviewers rate it 4.9 from 328 ratings, and it has the clearest public price of the specialists. None of that replaces a proof of value on your own network. If you run a rival’s controllers, ask about Mitsubishi Electric ownership at renewal; Nozomi says it remains vendor-agnostic.
Claroty: worth shortlisting, especially if you want secure remote access from the same supplier. Its Peer Insights rating (4.9 from 363) and Leader placement match Nozomi’s, and the same caveat applies. On the public tiers, Secure Access comes only in the top one, $1.2m a year, and the listing does not define a billing unit, so insist on a written quote that does.
Does it stack up? For a multi-site operator with regulatory duties, a staffed security operations team and hygiene already done, yes, provided a proof of value on your own network bears it out: at list prices either costs a fraction of what Hydro or Colonial lost. For a single plant that still shares a domain with head office, not yet. Spend on MFA, segregation and backups first, try Defender for IoT or Malcolm, and revisit in a year. Buying a sensor before fixing the VPN is installing a smoke alarm in a house with the front door off its hinges.
The OT team is not a SOC with a hard hat
Only 9% of the professionals SANS surveyed spend all their time on ICS/OT security (SANS, March 2025). The skills that matter don’t come with an IT security background:
- Process engineering. Knowing which alarm is a nuisance and which is a reactor heading somewhere it shouldn’t.
- Functional safety. Safety instrumented systems, and why nobody touches them without a safety engineer.
- IEC 62443. The ISA/IEC 62443 certificate programme and GIAC’s GICSP are the recognised routes.
- Industrial protocols. Modbus, DNP3 and friends are mostly unauthenticated and very literal.
- Change windows. Patches wait for planned outages, and a vendor warranty can forbid the agent your SOC wants. Dragos found that 26% of 2025 ICS advisories offered no patch at all.
The workable shape is a pairing: an analyst who knows how attackers move through Windows beside an engineer who knows what the plant does when a controller misbehaves. The tooling is only as good as the pair reading its alerts.
What to do on Monday
- Inventory every remote path into OT and put phishing-resistant MFA on each.
- Split the OT identity domain from IT, and harden and monitor the hypervisors.
- Write and rehearse an isolation plan, following NCSC principle 8.
- Map zones and conduits, and enforce the conduits.
- Only then run a proof of value with two OT vendors, with your own engineers judging.
Cyber-Threat.net has not tested the products named. List prices say nothing about what you will be quoted. No sponsorship, no affiliate links.
Gartner, Magic Quadrant for CPS Protection Platforms, Katell Thielemann, Ruggero Contu, Wam Voster, Sumit Rajput, 3 March 2026. Gartner® and Magic Quadrant™ are trademarks of Gartner, Inc. and/or its affiliates. Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.
Gartner and Peer Insights™ are trademarks of Gartner, Inc. and/or its affiliates. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.