Claroty vs Nozomi Networks vs Dragos vs Armis: OT and industrial security compared
Claroty vs Nozomi vs Dragos vs Armis compared on collection architecture, protocol depth, detection method, remote access and remediation for IT leaders.
Every one of these four platforms will give you an asset list and an alert feed. Sit through four demos in a week and they blur together. The dashboards look similar, the asset counts look similar, and every vendor will show you a Purdue diagram with tidy colour coding.
The differences sit underneath. They show up in where the data comes from, how deeply the traffic is parsed, and what the platform still does when a site has no SPAN port, no spare switch capacity and no route to the internet. Those three questions decide which tool survives contact with your plant floor.
Let's get straight into the comparison.
The architectural split between DPI-first and asset intelligence platforms
Claroty, Nozomi Networks and Dragos are deep packet inspection platforms. Their sensors sit on mirrored traffic and dissect industrial protocols locally. Asset attributes, behavioural baselines and threat detections all derive from that parsed traffic.
Armis works differently. Armis Centrix runs its own passive collectors, but the platform is built around a cloud Asset Intelligence Engine that ingests DPI as one telemetry stream among many. The rest comes from integrations with switches, firewalls, wireless controllers, NAC, EDR, CMDB and cloud providers.
This single design choice drives most of what follows. It explains why Armis has stronger coverage of IT, IoT and medical devices, and why the other three publish more detail about what they see at Purdue Levels 1 and 2.
How OT security platforms collect data: passive monitoring, safe queries and endpoint agents
What passive DPI sees, and what never reaches the SPAN
Passive monitoring reads a copy of the traffic and sends nothing to your devices. That is why it became the default for plant networks, and it works well for anything that crosses a managed switch.
It also has a hard ceiling. Traffic inside a PLC backplane never leaves the chassis. Serial links between an RTU and its field devices never touch Ethernet. Point-to-point engineering connections made with a laptop plugged directly into a controller are invisible.
Every vendor here now ships a second collection method for exactly that reason.
Safe active queries compared
Claroty describes its Safe Queries as sending requests in the asset's own protocol, matching the volume and type of traffic the device already receives from other assets. Claroty states that from a PLC's perspective, an active query is indistinguishable from a standard request sent by an engineering workstation.
Nozomi's Smart Polling is an optional add-on built around identities, strategies and plans. Nozomi describes the queries as concise, safe and effective, and some strategies require credentials to run.
Armis calls its equivalent Smart Active Querying, a read-only native-protocol query that Armis states complements passive traffic inspection.
Treat "safe" as a spectrum rather than a guarantee. All three send packets to production controllers. What differs is the cadence, whether credentials are required, and how closely the query mimics existing traffic. Ask each vendor for the specific function codes used per protocol and the default polling interval, then have your controls engineer review them.
Endpoint agents and project file parsing
Nozomi Arc is a host-based sensor that reaches segments SPAN cannot, and Nozomi makes a practical point about it. A SPAN reconfiguration often waits for a maintenance window weeks or months out, whereas an endpoint sensor can usually be installed immediately.
Dragos uses a lightweight software executable on Windows and Linux for isolated or low-traffic assets, plus a containerised Edge Collector for traffic forwarding.
Claroty is the outlier here. Its AppDB engine parses PLC, RTU and SCADA project and backup configuration files directly. That reaches assets which are air-gapped, powered down, or simply quiet on the network.
Claroty Team82 released an open-source AccessDB Parser to handle the Microsoft Access file formats used by some Rockwell and Schneider SCADA applications.
Industrial protocol coverage and parsing depth
Protocol counts are the least useful number in this market. Claroty states coverage of more than 450 protocols. Dragos cites more than 600 industrial protocols, a figure that has grown from a published 200-plus in earlier material. Both are vendor-stated and neither is independently audited.
Nozomi publishes a named list instead, refreshed every few months, covering Modbus, DNP3, EtherNet/IP and CIP, S7comm, IEC 60870-5-104, IEC 61850 including MMS, GOOSE and Sampled Values, OPC, BACnet, EtherCAT and vendor protocols from ABB, Rockwell, GE, Honeywell, Mitsubishi, Omron, Schneider, SEL, Siemens and Yokogawa. Nozomi states the list is partial and ships a Protocol SDK so customers can add their own.
Armis publishes an OT protocol list organised by industry, covering Modbus, EtherNet/IP, S7comm, DNP3, IEC 60870-5-104, IEC 61850, OPC, BACnet, Profibus, HART and the major DCS families.
What it does not publish is parsing depth. There are no function code coverage tables and no DPI signature specifications, so controller-level capability has to be proven in your own pilot rather than read from documentation.
Depth is what you should actually test. The question is whether the platform reads function codes, tag values and firmware transfers, and whether it can tell a logic download from a routine read.
Claroty's Known Threats engine applies SNORT and YARA rules to code sections downloaded to the PLC, which is a materially different claim from detecting that a write occurred. Team82's research on Rockwell logic handling, published as CVE-2022-1161, shows the underlying protocol knowledge is real.
This is the same discipline you would apply to any ICS and SCADA security programme: verify the mechanism, not the marketing number.
IT Leaders Report 2026
What are your IT peers investing in 2026?
We spoke to about 1,300 IT leaders from various organisations to understand what they're evaluating. Most of it is the kind of thing you'd only hear from a peer you know well enough to ask, so we've put it in one place.
Read the report
OT asset inventory depth: attributes, nested devices and serial segments
An asset inventory that lists an IP address and a vendor name is not an inventory. For NERC CIP-002 asset identification or an IEC 62443 zone definition, you need make, model, firmware version, serial number, and for chassis-based systems the rack and slot position.
Dragos takes a deliberately different position. It treats asset visibility as a means to detection rather than inventory completeness as a goal in itself. If your driver is a regulatory asset register, understand that philosophy before you buy.
Armis leans on a crowd-sourced device knowledge base built across its install base. That gives it classification strength across IT, IoT and connected medical devices that the DPI-first platforms do not match outside OT.
If your estate looks more like a hospital or a large mixed campus than a refinery, that matters more than protocol depth. It is also the point where this decision starts overlapping with your IT asset management tooling, and you should decide deliberately which system holds the record of truth.
Threat detection methodology: anomaly baselining versus threat behaviour analytics
Claroty runs five detection engines: anomaly detection across communications, tag values and HMI code functions; security behaviours covering intrusion patterns such as address scans and man-in-the-middle; known threats using SNORT and YARA; operational behaviour for configuration and logic changes; and custom rules. Alerts are grouped into contextual timelines so an analyst sees a chain rather than a list.
Nozomi runs a hybrid. It baselines during a learning period, then applies anomaly detection alongside signature and indicator matching from Nozomi Networks Labs, delivered as YARA, packet rules, Sigma and STIX content. Vantage IQ adds context-aware AI assistance for triage.
Dragos argues against pure anomaly detection. Its detections are codified threat behaviours derived from its own intelligence and mapped to MITRE ATT&CK for ICS, and each analytic carries an investigation playbook written by OT incident responders.
The technical argument is that a behaviour tied to a known adversary technique gives an analyst context that a statistical deviation cannot.
The counter-argument deserves airtime. Practitioners in this field have pointed out that in practice the entire category leans heavily on signatures applied to passively captured communications, and that Dragos has closed the anomaly gap while positioning competitors inside it. Dragos does ship anomaly detection and a baseline learning mode. Judge the detections on your bench, not on the positioning.
Armis applies behavioural anomaly detection against known-good baselines drawn from its device knowledge base, with response delivered through integrations.
Its own MITRE ATT&CK for ICS whitepaper, covering 94 techniques, states plainly that it generally will not detect the Impact tactic such as property damage. That candour is useful, and it is also a scoping boundary you should read carefully.
One more point on independent validation. MITRE Engenuity ran a single ATT&CK Evaluation for ICS, built around TRITON, with Armis, Claroty, Dragos, Microsoft and the Institute for Information Industry taking part.
It was vendor-funded, produced no scores and named no winner, and it measured how detections occur rather than how well they work. Nozomi did not participate. Any vendor presenting that round as a competitive result is overreading it.
Vulnerability prioritisation in OT environments
CVE matching in OT is unreliable without a precise firmware version, which is exactly why the active query features exist. Match on a device model alone and you inherit a false positive list your team will stop reading within a month.
Dragos publishes the most useful research in this area. Its 2026 OT Cybersecurity Year in Review, covering 2025, applies the Now, Next, Never model and reports that 3% of vulnerabilities required immediate action, 71% could be handled with compensating controls or at the next maintenance cycle, and 27% did not warrant remediation effort at all.
The advisory quality findings matter more than the priority split. Dragos reports that 25% of advisories arrived with no patch or mitigation, 52% required Dragos to supply an alternative mitigation, and 4% covered vulnerabilities already under active exploitation. Separately, it found that 25% of ICS-CERT and NVD vulnerabilities carried incorrect CVSS scores in 2025.
Read that alongside its field findings. Dragos reports that only 46% of its assessments found adequate OT network monitoring deployed, and 81% identified poor IT and OT segmentation. The monitoring platform is the thing you are buying, and roughly half of assessed sites do not have one working properly.
Claroty Team82 approaches the problem from exposure. Its State of CPS Security 2025 report on OT exposures, published February 2025, analysed close to one million OT devices across 270 organisations and found more than 111,000 known exploited vulnerabilities, with 68% of those linked to ransomware groups. Twelve per cent of devices contained a KEV, and 40% of organisations had a subset of those assets insecurely connected to the internet.
The practical takeaway is that raw CVSS is the wrong sorting key. Exploitability, KEV status, network reachability and existing compensating controls should drive the queue. That is a different model from the one your IT team runs in a general vulnerability management platform, and the two queues should stay separate.
Deployment architecture: on-premises, cloud and air-gapped sites
Claroty offers Continuous Threat Detection on-premises with an Enterprise Management Console, or xDome as SaaS. Each CTD server sits at a local site and feeds the EMC for a consolidated cross-site view and a single integration point into SIEM, SOAR, NAC and firewall tooling.
Nozomi splits the same way between Vantage as cloud SaaS and the Central Management Console on-premises. Air-gapped sites update Threat Intelligence by uploading a local file. Remote Collector handles sites with constrained links.
Dragos aggregates sensor data at a per-site SiteStore and rolls up through CentralStore, deployable fully on-premises or on AWS. Dragos states its sensors monitor up to 20 Gbps.
Armis publishes cloud, on-premises and hybrid models. Its on-premises edition targets air-gapped and sequestered environments, and Armis states that no data leaves the customer environment and that the platform provides continuous protection where cloud connectivity is not an option.
Dragos OT Watch is the only OT-native first-party managed threat hunting service among the four, covering monitoring, alert triage, tuning, rogue device identification and vulnerability management.
If your team lacks OT analyst capacity, that changes the shortlist. If you already run a managed detection and response arrangement for IT, check whether your provider has genuine ICS experience before assuming it extends.
Purdue zone mapping, segmentation and enforcement integrations
Claroty CTD maps networks into Virtual Zones, which are logical groups of assets that communicate under normal conditions, and can generate network policies from them.
Dragos includes NP-View for segmentation assessment and architecture review. All four map assets to Purdue levels and produce communication matrices.
All four integrate with enforcement points including Cisco ISE, Fortinet, Palo Alto, Check Point and Forescout. The integration shares asset context and tags, and can trigger dynamic policy or quarantine.
Here is the correction I make in every one of these evaluations. These platforms recommend segmentation, they do not enforce it. The firewall enforces it. The switch enforces it.
If your programme depends on the OT monitoring tool to deliver segmentation, you have a gap in the plan and a budget line you have not raised yet. The same discipline applies as in any OT and IT convergence project, where ownership of enforcement points is the part that gets argued about after the purchase order lands.
Secure remote access for OT and third-party engineer sessions
Two of the four ship a first-party OT remote access product. Claroty and Armis both do. Nozomi and Dragos do not, and rely on integration with third-party access platforms.
Claroty xDome Secure Access provides agentless access with credential vaulting, session recording, live over-the-shoulder monitoring, just-in-time approval for vendor identities, per-asset rather than whole-network scoping, and site survivability so local access continues during a WAN outage.
Armis Centrix Secure Access covers similar ground. Armis states it enforces MFA on all remote users, grants time-bound just-in-time access instead of always-on connections, and monitors, records and logs every session.
Armis describes it as removing the need to open firewall ports for SSH, VNC, RDP, HTTPS, PROFINET and Modbus, and includes the capability in the on-premises edition.
Third-party OEM access into Levels 2 and 3 remains one of the most common intrusion paths into industrial networks. Dragos reports that 73% of its all-time incident response cases involved compromised VPN or jump host credentials. If your machine builders and integrators dial in regularly, weight this heavily.
If you are already migrating remote access toward identity-based controls, the ZTNA comparison covers the IT side of the same problem, though most of those products were not designed for latency-tolerant plant environments.
Threat intelligence and research output
Dragos tracks and names OT threat groups. Its 2026 report covers 26 tracked groups, 11 of them active during 2025, and introduces three new ones: AZURITE, which targets engineering workstations and exfiltrates alarm data and configuration files; PYROXENE, which runs multi-year social engineering campaigns against operational personnel; and SYLVANITE, an initial access provider that weaponises edge device vulnerabilities and hands footholds to Stage 2 adversaries such as VOLTZITE.
Dragos also analysed PIPEDREAM, CHERNOVITE's modular ICS attack framework, and assessed that it can execute 38% of known ICS attack techniques and 83% of known ICS attack tactics measured against MITRE ATT&CK for ICS.
It discovered FrostyGoop, the ninth known ICS malware, a Golang tool that interacts with controllers over Modbus TCP on port 502, identified in April 2024 and linked to a two-day heating outage affecting more than 600 apartment buildings in Lviv.
On ransomware, Dragos tracked 119 groups affecting 3,300 industrial organisations in 2025, up 49% from 80 groups in 2024, with manufacturing accounting for more than two-thirds of victims.
Its point about misclassification is the useful one: incidents get logged as IT incidents when the compromised systems are Windows servers hosting SCADA software, or ESXi hypervisors running OT applications.
Encrypt the virtualisation layer and operators lose visibility and control even though the physical equipment still works. If your incident taxonomy cannot represent that, your own numbers are wrong too, which is a variation on the problem covered in how ransomware and AI are raising the stakes.
Claroty Team82 has disclosed more than 260 vulnerabilities and produced the Evil PLC Attack research, which weaponised PLCs against engineering workstations with working proofs of concept across Rockwell, Schneider, GE, B&R, XINJE, OVARRO and Emerson equipment.
Armis Labs found URGENT/11, eleven zero-day vulnerabilities in the VxWorks IPnet TCP/IP stack, with six rated critical and allowing remote code execution, disclosed at Black Hat in 2019. It also published TLStorm, covering APC Smart-UPS and Aruba and Avaya switch flaws stemming from NanoSSL misuse.
Nozomi Networks Labs runs honeypots and sensors at scale, publishes semi-annual threat and vulnerability analysis, and contributes the Protocol SDK.
The distinction worth drawing: Dragos produces adversary intelligence, Claroty and Armis produce vulnerability research, and both feed products differently. Ask each vendor how intelligence becomes a detection, at what cadence, and what the offline path looks like.
Platform scope is moving, and integration maturity is now a selection criterion
Dragos has expanded well beyond passive monitoring. Its Device Remediation product automates credential rotation, firmware upgrades and downgrades, certificate deployment and configuration hardening across connected devices, scheduled inside maintenance windows and reported against NERC CIP, IEC 62443, NIS2 and NIST 800-53.
That capability arrived through the Phosphorus acquisition, and Dragos states the integration is underway.
On 21 September 2026 Dragos announced the acquisition of runZero, which brings exposure management across IT, IoT and OT, and NetRise, which performs software composition analysis inside device firmware.
Dragos now describes its scope as xOT, covering any system that influences a physical process rather than assets sitting at particular Purdue levels.
Treat this carefully. Announced capability and integrated capability are different things, and Dragos itself says details of how NetRise and runZero fold into the platform will follow in the coming months.
Ask which components ship as one product today, which are separately licensed, which share a console, and what the support path looks like when a problem spans two of them. Ask Claroty, Nozomi and Armis the same question. Every platform in this market is assembling capability faster than it is integrating it.
Where each OT security platform is the wrong choice
Armis
Wrong choice when the requirement is verified deep ICS protocol forensics at Levels 1 and 2. Armis publishes protocol breadth by industry without publishing parsing depth, so controller-level capability has to be proven in your pilot rather than read from documentation. Right choice when unified visibility across IT, IoT, medical devices and OT matters more than protocol depth, which is common in healthcare and large mixed campuses.
Dragos
Historically the narrow OT specialist, now broadening quickly. The expansion into IT, IoT and firmware analysis is recent enough that you should verify what is actually integrated rather than what is announced. Its intelligence and sizing model still suits larger industrial estates in electricity, oil and gas, water and high-volume manufacturing. A single-site mid-size manufacturer is likely over-served.
Claroty
Strongest where asset attribute depth and vendor remote access both matter, which usually means manufacturing, pharmaceutical and healthcare environments. In a converged estate it can overlap with tooling you already run, so define the boundary with your IT security stack before deployment.
Nozomi Networks
Broad protocol coverage and mature multi-site SaaS management make it a good fit across critical infrastructure, rail, mining and building automation. It has no first-party remote access and no automated remediation, so both would be separate purchases.
What they will and will not do for you
They do not enforce segmentation. The firewall and the switch do that, and it is a separate budget line. They do not replace a Management of Change process. And passive monitoring cannot see what does not cross the SPAN, including traffic inside a PLC backplane and serial links below the gateway.
Patching is no longer on that list for all four. Dragos Device Remediation performs automated firmware updates, credential rotation and configuration hardening.
Claroty, Nozomi and Armis still hand remediation back to your engineering team and the equipment vendor. If closing the loop from finding to fixing matters to your programme, that is now a real point of separation rather than a shared limitation.
How to run an OT security platform proof of value
Do not accept a vendor-designed pilot. Design these tests yourself and run the same set against each platform. The general structure of a vendor proof of concept applies, with OT-specific tests layered on top.
- Ground-truth attribute audit. Hand-build a verified list of 30 assets. Score each platform on completeness of make, model, firmware, serial, rack and slot, and project name.
- Logic download detection. Perform a PLC program download. Record whether the platform detects it, attributes it to a user or workstation, and reconstructs the code.
- Firmware change detection. Flash a device and check both detection and attribution.
- Serial device discovery. Test discovery behind a serial gateway.
- Rogue device introduction. Plug in an unknown device and time detection and classification.
- Maintenance window baseline behaviour. Run a legitimate engineering change inside a planned window and count the false positives.
- Alert quality under a simulated engineering change. Measure alerts raised and time to disposition.
- CVE match accuracy audit. Hand-verify 25 reported vulnerabilities and calculate the false positive rate.
- API and export test. Pull assets and alerts into your SIEM platform and confirm the fields you need survive the trip.
- Remediation safety test. Where the platform offers it, rotate credentials and apply a firmware update to a non-critical device inside a maintenance window. Confirm the rollback path, the audit record, and the behaviour when a device rejects the update.
Four questions that produce differentiating answers rather than brochure answers:
- Name the protocols you parse to function code level, and show the function codes.
- How do you distinguish a firmware change from a logic download, technically?
- List exactly what stops working in a fully air-gapped site, and describe the offline update process.
- Which platform components ship as one integrated product today, and which are separately licensed?
Where this leaves the decision
If you run a large regulated industrial estate and want threat detection with analyst context plus automated device remediation, Dragos leads, with the caveat that its newest components are still being integrated.
If you need asset attribute depth plus controlled third-party engineer access, Claroty is the shorter path. If you are distributed across many sites and want mature SaaS management with broad protocol coverage, Nozomi fits.
If your real problem is that nobody can produce one asset list across IT, IoT, medical devices and OT, Armis solves a problem the others handle less completely.
Run the ten tests. The results will diverge more than the demos did.
We'll build you shortlist of industrial security vendors
Talk to one of our account managers and tell them what your estate looks like, deepest Purdue level, SPAN availability, air-gap requirement, and site count. They'll get back to you with a shortlist. You don't pay anything and your info remains private.
FAQ
What is the difference between Claroty, Nozomi Networks, Dragos and Armis?
The difference is collection architecture. Claroty, Nozomi Networks and Dragos are deep packet inspection platforms whose sensors parse industrial protocols from mirrored traffic at each site. Armis Centrix runs passive collectors too, but its Asset Intelligence Engine is fed largely by integrations with switches, firewalls, NAC, EDR and CMDB systems. That single design choice explains why Armis covers IT, IoT and medical devices more completely, and why the other three publish more detail about what they see at Purdue Levels 1 and 2. Claroty adds project file parsing, which reaches assets that are powered down or air-gapped. Dragos builds detections from codified adversary behaviours with analyst playbooks attached.
Which OT security platform works in a fully air-gapped environment?
All four support fully disconnected deployment. Claroty runs Continuous Threat Detection on-premises with an Enterprise Management Console. Nozomi Networks uses the Central Management Console and updates threat intelligence by uploading a local file. Dragos aggregates at an on-premises SiteStore with offline Knowledge Packs. Armis offers a dedicated on-premises edition for air-gapped and sequestered environments, and states that no data leaves the customer environment. What differs is the offline update process, so ask each vendor to describe exactly what stops working without a cloud connection and how detection content reaches the site.
Do OT security platforms enforce network segmentation?
No. Claroty, Nozomi Networks, Dragos and Armis map Purdue levels, generate communication matrices and recommend zone and conduit policies aligned to IEC 62443. Enforcement happens at your firewalls, switches and network access control systems acting on those recommendations. All four integrate with enforcement points including Cisco ISE, Fortinet, Palo Alto and Forescout to share asset context and trigger quarantine actions. If your security programme assumes the monitoring platform delivers segmentation, there is a gap in the plan and an unraised budget line.
Can any OT security platform patch industrial devices automatically?
Dragos can, through its Device Remediation capability, which automates credential rotation, firmware upgrades and downgrades, certificate deployment and configuration hardening across connected devices, scheduled inside maintenance windows and reported against NERC CIP, IEC 62443, NIS2 and NIST 800-53. That capability arrived through the Phosphorus acquisition and Dragos states integration is underway, so verify it in a pilot. Claroty, Nozomi Networks and Armis identify vulnerable devices and hand remediation back to your engineering team and the equipment vendor.
How should IT leaders run a proof of value for OT security tools?
Design the tests yourself rather than accepting a vendor pilot. The tests that separate these four are a ground-truth asset attribute audit against a hand-verified list, logic download detection, firmware change detection, serial device discovery behind a gateway, rogue device introduction, baseline behaviour during a planned maintenance window, alert quality under a simulated engineering change, a CVE match accuracy audit on 25 hand-verified findings, an API export test into your SIEM, and where offered, a remediation safety test with a confirmed rollback path. Run at least one test at a site with no SPAN port available, or every vendor will look equally capable.
