Dragos Buys Phosphorus to Close Gap Between OT and Enterprise IoT Security

Dragos acquires Phosphorus to unify OT and enterprise IoT security

Dragos acquired Phosphorus Cybersecurity, a specialist in agentless discovery, credential rotation, and firmware patching for enterprise IoT devices. The deal removes Phosphorus as a standalone competitor and positions Dragos to pitch a single platform for both OT environments—programmable logic controllers, distributed control systems, SCADA—and unmanaged IoT devices like cameras, badge readers, and building controls.

This follows Mitsubishi Electric's $883 million acquisition of Nozomi Networks earlier this year, confirming that OT/IoT security has become a board-level consolidation play. Dragos now competes directly with Nozomi and Claroty, both of which expanded beyond classic OT into broader cyber-physical systems. Phosphorus previously competed with Claroty's xIoT security, Asimily's connected device risk management, and other agentless visibility vendors.

For enterprise buyers, the immediate impact is budgetary. OT security and IoT device management were often separate programs with separate vendors. Dragos can now pitch integrated procurement—one contract, one platform, one set of SLAs. This improves leverage in enterprise-wide negotiations but increases vendor lock-in risk. Buyers evaluating Phosphorus capabilities should now treat them as part of a Dragos platform decision, including OT use cases and professional services.

The acquisition reinforces a structural shift: IoT risk is no longer separable from OT/ICS risk. Boards and regulators increasingly treat device risk holistically. Enterprises should revisit platform strategies and decide whether IoT security is purchased as part of an OT platform, an NDR/XDR platform, or a dedicated IoT tool. Budget for consolidation premiums—integrated platforms may cost more upfront but collapse tool sprawl.

Claroty launches AI security agent for cyber-physical systems

Claroty announced Claroty Claire, an AI-powered security agent designed specifically for cyber-physical systems, including OT, IoT, and building management systems. Claire continuously analyzes CPS environments to detect anomalies and threats. Claroty has not disclosed performance metrics—no detection rates, latency numbers, or throughput data—but the launch signals a new competitive axis in the OT/IoT security market.

Claire targets the same buyers as Dragos, Nozomi Networks, Armis, Forescout, and Asimily, all of which emphasize CPS and IoT risk visibility. The difference is positioning: Claroty frames Claire as AI-first detection and reasoning tuned to OT/IoT telemetry rather than generic network traffic. This matters because IoT botnets drove a 227% quarter-over-quarter increase in DDoS attacks above 1 terabit per second, averaging 14 per day. Lateral movement and weaponization of IoT devices are no longer edge cases.

For large industrial and healthcare buyers—Claroty's core market—Claire provides a new option for AI-driven anomaly detection. Buyers evaluating Claroty versus Dragos or Nozomi should now compare AI capabilities directly. Expect Claire to be bundled into Claroty platform pricing, with premium positioning and likely incremental costs for AI licensing, compute, and data retention. The launch strengthens the case for platform-centric spending rather than point tools, especially for enterprises justifying incremental spend in light of volumetric DDoS escalation.

Asimily adds automated network segmentation for IoT devices

Asimily launched Segmentation Orchestration, a capability that translates connected-device risk intelligence directly into enforceable network policies. The feature automates network segmentation for IoT and medical devices, removing manual policy creation and reducing the time between risk discovery and network control.

Asimily competes with Claroty, Armis, Ordr, and Forescout, all of which offer some form of IoT network segmentation via integrations with firewall and NAC vendors. The difference is automation: Segmentation Orchestration eliminates the workflow gap between identifying risky devices and isolating them. For healthcare buyers—where unpatched infusion pumps and imaging devices create persistent exposure—this directly addresses a procurement pain point.

Asimily has not disclosed pricing or performance metrics, but the functionality itself is concrete. Buyers should evaluate how Segmentation Orchestration integrates with existing network infrastructure and whether it requires proprietary agents or relies on passive monitoring. The key question is whether automation genuinely reduces manual effort or shifts complexity to integration and tuning.

What to watch

Consolidation in OT/IoT security will continue. Expect Claroty, Nozomi, and Armis to emphasize multi-domain coverage—IT, OT, and IoT—in upcoming RFPs. Vendors will pitch unified asset inventory, risk scoring, and policy enforcement as a competitive differentiator. Buyers should prepare for tighter integration narratives and higher platform premiums.

AI capabilities are now a product differentiation axis. Enterprises evaluating OT/IoT platforms should explicitly compare AI detection performance, not just asset discovery and policy enforcement. Request quantitative evidence—detection rates, false positive rates, time to detection—rather than accepting vendor claims at face value.

Finally, revisit whether IoT security belongs in the OT budget, the network security budget, or a separate device management program. The answer depends on asset mix, regulatory requirements, and risk appetite, but the default assumption—that IoT is a separate category—no longer holds.