zcrOT vs. Claroty, Nozomi Networks, and Dragos: Picking the Right OT/ICS Monitoring Fit
We compare zcrOT against Claroty, Nozomi Networks, and Dragos on protocols, deployment, and pricing — plus the solar and EV angle competitors don't emphasize.
zcrOT vs. Claroty, Nozomi Networks, and Dragos: Picking the Right OT/ICS Monitoring Fit
If you've got tabs open comparing Claroty, Nozomi Networks, and Dragos and landed here anyway, you've probably already made peace with "OT needs visibility." You're past that. You're at "which vendor," which is a much harder question — because all three of those companies are genuine global players, not vaporware with a good pitch deck.
So let's be upfront about it from paragraph one: zcrOT doesn't cover as many protocols as Claroty, Nozomi, or Dragos, and we're not going to pretend otherwise. This article is meant to help you decide correctly, not close a deal. If you finish reading and conclude Dragos is the better fit for your plant, that's the right answer for you, and we're fine with that.
Who you're actually comparing
Claroty was founded in 2015 and has raised $635 million in total funding, including a $400 million Series E used entirely to fund the Medigate acquisition, backed by investors including SoftBank Vision Fund 2 and Schneider Electric. In 2022 it acquired Medigate, a medical IoT security company, for $400 million — extending its scope from pure OT into IoMT. It runs two main product lines: xDome (SaaS) and CTD (a fully on-premise option for organizations that can't send OT data to the cloud). Claroty covers 9 industry verticals (electric utilities, oil & gas, chemical, water, manufacturing, food & beverage, mining, healthcare, and real estate/BMS), with reference customers ranging from oil refineries to a consumer goods manufacturer running 75 plants across 8 countries.
Nozomi Networks was founded in 2013 in San Francisco, and it carries the single clearest credibility signal of the three: Mitsubishi Electric first took a minority stake of roughly 7% in 2024 via a Series E round, then announced its agreement to acquire the remaining 93% in September 2025, closing the full acquisition in January 2026 for a combined deal worth roughly a billion dollars ($883 million for that remaining stake) — Mitsubishi Electric's largest acquisition to date. Nozomi still operates as a subsidiary today. On the architecture side, it deploys Guardian sensors — hardware or virtual appliances — on-site, managed through either Vantage (SaaS) or CMC (on-prem), and offers "OnePass," a subscription model that bundles hardware and software licensing together.
Dragos was founded in 2016 by Robert M. Lee (alongside co-founders Jon Lavender and Justin Cavinee) — Lee is a former ICS threat analyst for the NSA and US Air Force, a name that carries real weight in OT security circles. It's raised roughly $439 million total, with investors that include Schweitzer Engineering Labs, Rockwell Automation, Emerson, and HPE — an unusually deep bench of actual industrial companies as backers. Important update: in June 2026, Accenture announced an agreement to acquire a majority stake in Dragos at a $3.25 billion valuation (part of a combined $4.175 billion deal that also includes all of runZero and NetRise), and Accenture's newsroom now records the Dragos majority investment as closed on September 16, 2026. Per Accenture's own announcement, Dragos is to continue operating as an independent business under CEO Robert Lee.
All three are Gartner Magic Quadrant Leaders for CPS Protection Platforms in both 2025 and 2026 — two years running. That deserves a straight acknowledgment, no caveats. Claroty and Nozomi are also Forrester Wave Leaders in IoT Security Solutions (Q3 2025). Dragos, separately, earned a Strong Performer rating in a different Forrester Wave (Operational Technology Security Solutions, Q2 2024) — not the same evaluation, so it's not a direct apples-to-apples comparison, but still a positive signal in its own right.
The comparison table
| zcrOT | Claroty | Nozomi Networks | Dragos |
|---|
| Protocols supported | Modbus (deepest support — read/write/error/malformed), DNP3, OPC UA, Profinet | 450+, per Claroty's own site | 200+, per Nozomi's own published protocol support list | 600+ via deep packet inspection, confirmed on Dragos's official site |
| Deployment | SaaS, on-premise, appliance | xDome (SaaS) or CTD (fully on-prem) | Hardware/virtual sensors, managed via Vantage (SaaS) or CMC (on-prem) | Sensor → SiteStore → CentralStore, hybrid, on-prem, or cloud (AWS) |
| Pricing model | Published: SaaS ฿800,000/yr, or on-premise VM ฿1,600,000 one-time plus maintenance at 30%/yr of the project value — each includes 1 sensor, extra sensors ฿400,000 each (per year on SaaS, one-time on-premise), VAT included (see pricing); a hardware appliance is quoted separately by a channel partner | Contact sales | Contact sales (has an "OnePass" subscription model) | Contact sales |
| Inline connection to control systems | None — 100% passive, out-of-band | Both passive mode and more active-leaning add-on features, depending on deployment | Mostly passive via sensors | Mostly passive via sensors |
| Standout differentiator | Monitors solar inverter output, EV charger status, and factory power telemetry alongside network security | Coverage across 9 industry verticals, including IoMT post-Medigate | Backed by Mitsubishi Electric's global industrial network; OnePass hardware+software subscription model | Neighborhood Keeper: free, opt-in, pseudonymized threat intel sharing across all Dragos customers |
| Founded / funding / current status | Thai company (zcr) | 2015 / $635M total | 2013 / ~$266M pre-acquisition, ~$1B acquisition by Mitsubishi Electric (closed Jan 2026) | 2016 / ~$439M raised, $1.7B valuation / Accenture majority investment at $3.25B valuation (announced Jun 2026, closed Sep 16, 2026) |
| Analyst recognition | No Gartner/Forrester ranking yet | Gartner MQ Leader 2025–2026, Forrester Wave Leader (IoT Security, Q3 2025) | Gartner MQ Leader 2025–2026, Forrester Wave Leader (IoT Security, Q3 2025) | Gartner MQ Leader 2025–2026, Forrester Strong Performer (OT Security, Q2 2024 — a different report than Claroty/Nozomi's) |
A caveat on those protocol numbers: all three are the vendors' own published figures, but they're not measured on identical terms, so they shouldn't be read as an apples-to-apples comparison with Dragos's confirmed number.
To say it plainly one more time: if your facility runs a lot of equipment speaking less common protocols — Siemens' S7comm, EtherNet/IP, BACnet, or something proprietary to a niche industrial vendor — Dragos, with its directly confirmed 600+ protocol claim, is far more likely to have coverage for that traffic at all. zcrOT currently supports Modbus, DNP3, OPC UA, and Profinet only, and does not yet support S7comm — if your plant leans heavily on S7comm, that alone should point you toward a different vendor.
Talk to our team →
Where zcrOT actually differs
Not on protocol breadth — we lose that one clearly. But there are three things zcrOT genuinely does well, and you can verify all of them yourself through the zcrOT demo, which is open to the public with no login required.
One — Modbus support that's actually deep, not just traffic detection. zcrOT classifies Modbus commands down to read, write, error, and malformed command level. Our post on how OT detection rules work gets into why this level of classification matters more than raw protocol count.
Two — solar and EV charging, an angle the other three don't emphasize as heavily. Across our research into all three competitors, none of them list solar inverters or EV charging stations as a primary target segment on their official sites — "electric" for all three mostly means utility-side SCADA (generation, transmission, distribution at the grid level), not distributed renewable energy systems or EV charging infrastructure. (Worth flagging: don't confuse this with "Nozomi Energy," a Japanese renewable energy company entirely unrelated to Nozomi Networks — the name overlap trips people up constantly.) zcrOT monitors solar inverter output, EV charger status, and factory power telemetry alongside network security in one dashboard, which lines up well with how fast Thailand's solar and EV infrastructure is expanding. If you manage systems like this, our real incident timeline of attacks on solar and EV charging infrastructure is worth reading alongside this — the risk here isn't hypothetical.
Three — passive, zero-agent, and deployable as SaaS, on-premise, or appliance — see the full feature set on the zcrOT product page. zcrOT never connects to control systems inline, so it can't disrupt production the way an inline device can, and organizations can choose their deployment model based on their own data residency or IT policy constraints — something Claroty and Nozomi also do well, to their credit.
If you want the bigger picture on why OT monitoring is fundamentally different from IT monitoring, OT Security for Industrial Facilities — Why the IT Playbook Doesn't Transfer is a good place to start — it explains why "broadest protocol list" shouldn't be the only criterion driving this decision.
Where we have to admit Claroty, Nozomi, and Dragos win
Worth spelling out fully, because this is what keeps this article useful instead of turning into an ad:
- Protocol breadth — all three support far more industrial protocols than zcrOT does. Dragos confirms 600+ on its own site. If your plant runs equipment from many vendors accumulated across decades, this is the deciding factor.
- Time in market and track record — all three have been operating for 9–13 years, deployed across oil refineries, power plants, and large-scale global manufacturing operations. That's a lot longer than zcrOT has had to accumulate case studies and prove itself in the field.
- Dedicated threat intelligence teams and research budgets — Dragos runs a specialized ICS threat intel team founded by a former NSA analyst himself. Claroty and Nozomi both run substantial research teams tracking new ICS vulnerabilities continuously — a level of investment a smaller player genuinely can't match head-on in the short term.
- Industry analyst recognition — Gartner MQ Leader for two years running is a real signal of weight for organizations that have to run procurement through external analyst validation.
- Backing from major industrial acquirers — Nozomi is now fully owned by Mitsubishi Electric, and Accenture now holds a majority stake in Dragos. Both deals mean serious capital and global go-to-market reach behind these vendors going forward.
If your organization is an oil refinery, a large national-grid-scale power plant, or a multinational manufacturer running decades of accumulated equipment from dozens of vendors — these three are genuinely the better fit right now. We have no reason to claim otherwise.
So who should choose what
To put it plainly:
- Choose Claroty, Nozomi, or Dragos if your facility has very high protocol diversity, you need a global track record to clear a strict compliance process, or you're a multinational that needs one standard across every country you operate in.
- Choose zcrOT if your core control systems primarily speak Modbus, DNP3, OPC UA, or Profinet, you want deployment flexibility across SaaS, on-prem, or appliance, or you're running solar and EV charging infrastructure you need monitored alongside network security.
Plenty of organizations actually run a mix of both — a global player covering the main production floor with its mix of legacy multi-vendor equipment, and zcrOT covering the solar, EV, and power zones where specialized monitoring matters more. It doesn't have to be all-or-nothing.
Want to try it before deciding anything? Check out the zcrOT product page for the full feature set, or open the zcrOT demo and click around right now — no sign-up required.
Contact zcr
Want to talk through your specific use case? Ask our team whether zcrOT fits your facility or energy systems.
Sources
- Claroty — Series E funding and Medigate acquisition announcement, accessed 2026-09-16.
- Claroty — completes acquisition of Medigate, accessed 2026-09-16.
- Claroty — industrial cybersecurity platform overview (verticals, protocol count), accessed 2026-09-16.
- Claroty — named a Leader in the 2026 Gartner Magic Quadrant for CPS Protection Platforms, accessed 2026-09-16.
- Claroty — named a Leader in the Forrester Wave: IoT Security Solutions, Q3 2025 (Internet Archive copy, 4 January 2026), accessed 2026-09-25.
- Nozomi Networks — named a Leader in the Forrester Wave: IoT Security Solutions, Q3 2025, accessed 2026-09-25.
- Nozomi Networks — enters next phase of growth as Mitsubishi Electric completes acquisition, accessed 2026-09-16.
- Nozomi Networks — delivers industry's first hardware+software OnePass offering, accessed 2026-09-16.
- Nozomi Networks — named a Leader in the 2026 Gartner Magic Quadrant for CPS Protection Platforms, accessed 2026-09-16.
- Nozomi Networks — official Protocol Support List, accessed 2026-09-16.
- Crunchbase — Dragos company and funding profile, accessed 2026-09-16.
- Accenture Newsroom — acquisition of majority stake in Dragos, plus runZero and NetRise, accessed 2026-09-25.
- Dragos — Network Monitoring product page (600+ protocols via deep packet inspection), accessed 2026-09-16.
- Dragos — named a Leader in the 2026 Gartner Magic Quadrant for CPS Protection Platforms, accessed 2026-09-16.
- Dragos — Forrester Wave: Operational Technology Security Solutions, Q2 2024, accessed 2026-09-16.
- Dragos — Neighborhood Keeper program overview, accessed 2026-09-16.