Credit: Jose Manuel Esp on Unsplash “It’s about whether the lights stay on and the water stays safe when an adversary attacks,” said Dmitri Alperovitch, the CrowdStrike co-founder who is returning to the board of Dragos. The industrial cybersecurity company said on Monday it has closed its acquisitions of NetRise and runZero. The deals completed alongside the close of Accenture’s majority investment in Dragos. TNW covered that announcement in June.
Robert M. Lee, who co-founded Dragos and runs it, has been named chairman of the board in addition to chief executive. The company said it will keep operating independently, with its existing leadership team. It framed that independence as vendor neutrality, on the grounds that critical infrastructure runs on systems from multiple providers.
Dragos did not disclose what it paid for either company. What each company brings runZero handles exposure management. It pulls asset and risk data into a single view, drawing on sources an organisation already has across IT, cloud and operational technology. NetRise looks inside the software and firmware running on operational devices.
It surfaces outdated components and hardcoded credentials. Dragos said it also produces documentation for NERC CIP, NIS2 and TSA directives. Both founding teams join in full. runZero chief executive HD Moore, NetRise chief executive Thomas Pace and NetRise chief technology officer Michael Scott will lead the integration while continuing to serve their existing customers. Dragos bought a third company, Phosphorus, earlier this year.
Lee wrote in a blog post that the Phosphorus integration is already under way, and that details on NetRise and runZero will follow in the coming months. The term the company is pushing Dragos is marketing all of this under a label it calls xOT, for extended operational technology. Lee’s argument for the term is that the industry drew its lines in the wrong place. It tried to sort systems by where they sat in the Purdue model, or by which operating system they ran.
He listed three things he says belong in the same scope. A cloud-connected analytics platform running a manufacturing process. The cooling and power systems keeping a data centre online. Cloud-connected SCADA servicing electrical substations. “The world’s largest companies have invested heavily in enterprise IT security, yet it’s their cyber-physical systems that generate revenue and carry national and local security impact,” Lee said in the release.
The data underneath it Dragos said both acquisitions will feed what it calls the Dragos Intelligence Fabric. That is a decade of operational-technology telemetry and incident response work that already powers its platform. The company builds an AI tool on top of it called EmberAI, and said the wider data set will make its guidance to analysts faster and richer. The release also quotes a Gartner report on cyber-physical systems.
The legacy assumption of air-gapped isolation, it says, “is no longer defensible in today’s operational environments”. Who joins the board Three Accenture executives take seats: Harpreet Sidhu, its global cybersecurity lead; Luis Luque, its global OT cybersecurity lead; and John Coltsmann from corporate development. Alperovitch returns. He co-founded CrowdStrike and served as its chief technology officer, and now chairs the Silverado Policy Accelerator.
The hiring, and the pitch Lee wrote that Dragos is putting the new capital into research and development, with more than 100 positions open and hundreds more to come. The majority will be in R&D. He also set out what the company sees coming. State-backed actors are growing more capable.
Less sophisticated actors are using AI to close the gap. And the AI that organisations add to their own operational environments is itself increasing risk. The beat this lands on Attacks on operational systems have been a running thread this year. Iran-linked hackers breached a UK power plant in August.
A House report set out Chinese state access to US telecoms networks in the Salt Typhoon campaign. This month a third tanker in four weeks was hit by a suspected cyber incident off Italy. The compliance side has moved too. The EU’s Cyber Resilience Act brought in a 24-hour reporting deadline that is reshaping how companies track what is inside their software.
What the announcement does not say Dragos gave no purchase price for NetRise, for runZero or for Phosphorus. It did not say what share of the company Accenture now holds. The company is privately held, with headquarters in the Washington DC area and operations across North America, EMEA and Asia-Pacific. The release gives no revenue figure, no customer count and no headcount for any of the four businesses.
It does not say when the NetRise and runZero products will actually be integrated, only that details will come in the coming months. Lee, Moore and Pace are due to discuss the roadmap in a webinar on 19 October.
