Microsoft Defender for IoT Adds NIST CSF 2.0 Risk Scoring, Pressures OT Specialists

Microsoft moves IoT/OT security into the broader XDR stack

Microsoft released an update to Defender for IoT that exposes policy-driven risk scores for industrial and IoT devices tied directly to NIST Cybersecurity Framework 2.0. The platform now calculates risk for each device based on vulnerabilities, firmware age, reachable attack paths, and exposure to internet-facing networks, then feeds those scores into the same Defender XDR incident queue enterprises already use for endpoints and identities.

The update ships in the existing Defender for IoT SKU. Pricing remains per-sensor, typically in the low thousands of dollars per sensor annually according to channel partner price lists. The change matters because it lets security teams justify moving some OT security budget into their existing Microsoft contract instead of paying separate six-figure subscriptions to dedicated OT vendors like Claroty, Forescout, or Armis.

What this means for OT security budgets

Enterprises already licensing Defender XDR now have a credible path to consolidate IoT and OT monitoring without adding a separate platform. That puts pressure on pure-play OT security vendors to prove deeper protocol coverage, better asset context, or industry-specific content that Microsoft cannot match. For buyers, the question shifts from "Do we need IoT security?" to "Can our existing XDR platform handle it, or do we need specialist depth?"

The explicit mapping to NIST CSF 2.0 gives CISOs a defensible way to show IoT and OT risk coverage to boards and regulators without maintaining a separate control framework for connected devices. In regulated industries—utilities, healthcare, manufacturing—that reduces internal audit and consulting spend. It also changes RFP language: buyers will increasingly demand XDR-integrated IoT security, not a siloed OT dashboard, unless they face specialized industrial requirements.

Competitive context matters here. Palo Alto Networks offers an IoT Security module on its firewalls and Prisma Access, emphasizing ML-driven device profiling. Cisco couples its Cyber Vision and IoT Operations Dashboard tightly with its network infrastructure. Claroty, Forescout, and Armis focus on deep protocol inspection and risk scoring as dedicated platforms. Microsoft's move forces those vendors to justify why a separate platform is necessary when the same risk scores and alerts can live in a unified security console.

Dragos drops entry price for OT security and publishes threat data

Dragos launched updated SaaS-delivered tiers for its OT security platform and published new data on industrial control system threats. The company now tracks over 20 distinct ICS-specific threat activity groups as of 2026, up from 18 the prior year. More importantly, Dragos reports that over 75% of assessed industrial organizations have limited or no visibility into OT and IoT assets on their networks.

The new SaaS packaging targets mid-market industrials that previously could not afford Dragos's traditional six-figure on-premises deployments. Entry tiers now start in the tens of thousands of dollars per year for smaller sites, according to channel documents. That pricing puts Dragos in more direct competition with cloud-delivered offerings from Armis, Forescout, and Claroty, which have emphasized agentless discovery and cloud analytics.

For manufacturers, utilities, and logistics firms with only a handful of plants, this changes the vendor shortlist. Instead of defaulting to network segmentation alone, they can now realistically evaluate Dragos against Armis or Claroty in competitive bids. That should push down pricing across the category. The data point that three-quarters of industrial organizations lack OT and IoT visibility also gives CISOs quantitative backing for budget requests to inventory and monitor industrial devices, especially after boards increasingly ask specifically about OT risk following high-profile incidents.

Healthcare IoT remains unpatchable and exposed

IoT security vendor Asimily published updated analysis of IoT cybersecurity breaches in 2025 and 2026, focusing on healthcare and medical devices. The report highlights multiple incidents where thousands of connected devices—infusion pumps, imaging systems, patient monitors—were exposed due to default passwords, unsupported operating systems, and unsegmented flat networks. Asimily's analysis notes that in many environments, 30 to 40% of medical IoT devices cannot be easily patched because of FDA approval constraints or vendor support limitations.

The company ties these breaches to specific control failures: lack of accurate device inventory, delayed firmware patching, and absence of network micro-segmentation. This matters for healthcare buyers because it shifts the conversation from patching to compensating controls. If a third of your medical devices cannot be patched, the architecture decision becomes segmentation and monitoring, not vulnerability remediation. That changes which vendors make the shortlist—platforms that emphasize compensating controls and risk prioritization over patch management become more relevant.

Asimily competes in healthcare IoT security against Medigate by Claroty, Cynerio, Ordr, and horizontal platforms like Armis and Forescout that offer healthcare-specific content. The differentiator is focus on root-cause analytics and remediation prioritization for unpatchable devices, recommending compensating controls like segmentation rather than chasing patches that will never arrive.

What to watch

The key trend is consolidation of IoT and OT security into broader XDR and SIEM platforms, which compresses budgets for stand-alone OT tools unless vendors prove specialized value. Buyers should test whether their existing security stack can handle IoT and OT risk scoring and alerting before renewing dedicated OT contracts. The entry of lighter-weight SaaS tiers from historically expensive vendors like Dragos broadens the competitive set and should lower prices in mid-market RFPs. In healthcare, expect continued focus on compensating controls over patching, given the reality that a third of medical devices remain unpatchable.