Viakoo's New OT/IoT Config Tool Layers Atop Armis, Claroty, Nozomi Deployments

Agentless drift detection targets existing OT security stacks

Viakoo announced a Device Configuration Manager module at Black Hat 2026 that performs continuous auditing of OT and IoT device configurations against approved baselines and automates remediation when devices drift from policy. The tool is agentless and integrates directly with Armis, Forescout, Nozomi Networks, Claroty, and Tenable rather than replacing them. General availability is set for Q4 2026, positioning this as a near-term decision for FY27 operational risk budgets.

The design is explicitly complementary. Viakoo is not trying to compete on asset discovery or vulnerability scanning — functions these platforms already handle. Instead, it addresses the chronic problem of configuration drift in industrial, healthcare, and municipal IoT deployments where devices are modified in the field for maintenance or troubleshooting and never returned to compliant baselines. The closed-loop remediation capability — automatically restoring approved configurations without manual intervention — differentiates this from the compliance reporting functions built into existing OT security tools.

For enterprises already running Armis, Nozomi, or Claroty, this creates a procurement decision: wait for the primary vendor to add similar auto-remediation features, or introduce a specialist tool now. The Q4 2026 launch aligns with 2027 compliance and audit planning cycles, particularly for environments where baseline configurations are required for safety, regulatory, or insurance reasons.

Budget impact: new line item or compliance cost?

The Device Configuration Manager introduces or strengthens a budget category distinct from basic OT visibility. Security leaders will need to decide whether this sits within the OT security tool budget alongside existing platforms, or within compliance and GRC tooling justified by audit findings and policy enforcement requirements.

The business case is strongest in sectors with large installed bases of unmanaged or semi-managed devices: manufacturing facilities with legacy SCADA systems, hospital networks with thousands of connected medical devices, or municipal utilities where configuration changes can create safety risks. In these environments, configuration drift is not a theoretical problem — it is a documented cause of failed audits, extended incident response times, and compliance violations.

For the platforms Viakoo integrates with, this announcement creates competitive pressure to deepen their own configuration baseline and auto-remediation features. Armis, Forescout, Nozomi, Claroty, and Tenable have all expanded beyond asset discovery into vulnerability management and risk prioritization. Configuration governance is a logical next layer, and Viakoo's specialist positioning may accelerate product roadmaps at these vendors to avoid ceding this functionality to a third party.

NIST IoT guidelines set federal procurement baseline

NIST released the initial public draft of SP 800-213 Revision 1 — IoT Product Cybersecurity Guidelines for the Federal Government — on June 24, 2026, with a public comment period closing August 24, 2026. The document establishes how U.S. federal agencies should define and apply cybersecurity requirements when procuring IoT products, effectively setting a baseline many vendors will adopt beyond the public sector.

For federal and quasi-public buyers, this draft will be referenced in contracts and solicitations starting in late 2026 and throughout 2027. Security and procurement teams have until August 24 to submit comments on issues including device update mechanisms, identity management, logging requirements, and secure configurations — all areas directly relevant to enterprise IoT deployments.

For private-sector buyers, SP 800-213 Rev. 1 functions as a de facto benchmark for reasonable IoT product security. Using it as a checklist in RFPs reduces legal exposure by demonstrating adherence to a recognized standard of care and forces vendors to document secure update processes, configuration hardening guidelines, and support for secure device onboarding and identity.

Vendors whose offerings align closely to NIST's requirements will gain a procurement advantage in federal RFPs. Those lacking these controls will face higher compliance overhead or risk exclusion from contracts. Expect increased enterprise spending on IoT product security assessments, compliance consulting, and device management platforms that can demonstrate alignment with NIST's control expectations. Vendors may pass additional engineering and compliance costs through to enterprise customers in pricing or support tiers.

What to watch

Viakoo's Q4 2026 launch will test whether enterprises view configuration governance as a discrete function worth a separate tool or expect their existing OT security platform to absorb it. If Viakoo gains traction, expect Armis, Claroty, and Nozomi to accelerate roadmap items around automated remediation and policy enforcement.

The NIST comment period closes August 24. The final version of SP 800-213 Rev. 1, expected later in 2026, will shape federal IoT procurement requirements and influence private-sector RFPs throughout 2027. Vendors should review the draft now to identify gaps in their product security controls — particularly around update mechanisms, logging, and configuration management — before those gaps become procurement blockers.