A single security operations function with visibility and defined authority across both IT and OT estates, replacing the historical split between a corporate SOC and a plant that security 'doesn't reach'.
AI-powered OT anomaly & threat detection
Industrial IT / OT / Critical Control Information Infrastructure
Industry Acceptance
Near-term · 2–5 yrs
Evidence E4 · Multi-site references
AI / ML
Passive monitoring of industrial networks that learns normal communication patterns and flags deviations, combined with protocol decoding and threat signatures. A mature product category in which machine learning is one ingredient, not the whole story.
How OT network detection works
Most OT anomaly-detection products are passive. A sensor receives a copy of network traffic from a switch mirror port or a tap and decodes industrial protocols such as Modbus, EtherNet/IP, PROFINET, S7 and DNP3. From that traffic it builds an asset inventory and a model of normal behaviour: which devices talk to which, with which commands, how often and with what values. Because nothing is installed on controllers and nothing is injected into the network, these tools are acceptable in environments where active scanning is not.
Detection combines several methods. Signatures and indicators catch known malware and attacker tools. Rules catch policy violations, such as a firmware download outside a maintenance window or a new workstation programming a PLC. Behavioural baselines, the part marketed as AI or machine learning, catch deviations nobody wrote a rule for. Some products also analyse process values and flag setpoints or measurements outside their learned range.
| Method | Catches | Limitation |
|---|---|---|
| Signatures and indicators | Known malware, tools and infrastructure | Blind to new techniques |
| Policy rules | Unauthorised logic downloads, new connections | Someone has to write and maintain the rules |
| Behavioural baseline | Unusual communication nobody anticipated | Learns whatever was normal, including bad habits |
| Process-value analysis | Setpoints or values outside learned ranges | Hard to tell attacks from process upsets |
What the market looks like
This is an established category with several specialist suppliers, among them Claroty, Dragos, Nozomi Networks and Armis, alongside offerings from major automation and networking companies. Consolidation is under way. Mitsubishi Electric completed its acquisition of Nozomi Networks in January 2026; Nozomi reported net revenue of about $102 million for 2025, up from about $75 million in 2024 1.
Acquisitions by automation suppliers can bring tighter integration with their control systems. They also raise a fair question for buyers: how neutral is a monitoring tool owned by one of the suppliers whose equipment it monitors, and how well will it support competitors' protocols over time?
Where the AI claims need scrutiny
Industrial networks are unusually regular, which is what makes behavioural baselining effective: the same controllers exchange the same messages at the same intervals for years. The same regularity means that much of the value comes from simple, explainable deviation detection rather than sophisticated models. When evaluating products, ask what each alert is based on and whether an engineer can understand why it fired.
Baselines also have a weakness. They learn whatever was happening during the learning period, including misconfigurations or an intruder already present. Every change in the plant, from a new skid to a turnaround, generates alerts until the baseline is updated. A tool deployed without someone assigned to review and tune it will soon be ignored. Alert fatigue, not detection capability, is the usual reason these deployments disappoint.
The adversary picture explains why detection close to the process matters. Dragos reported in February 2026 that one threat group carried out systematic reconnaissance of US industrial control loops between March and July 2025 2, activity that looks like engineering traffic rather than malware. Detecting it depends on knowing which engineering communication is expected, which is a baseline and context problem more than an AI problem.
Choosing and deploying
- Start with sensor placement. Visibility is only as good as the traffic the sensor sees, and the most important traffic, between engineering workstations and controllers at the lower network levels, is often the hardest to capture.
- Decide who reviews alerts before buying. Integration with the SOC's SIEM is standard, but someone with OT knowledge still has to triage.
- Use the asset inventory. For many sites the inventory and vulnerability view is the first measurable benefit, ahead of threat detection.
- Test detection against realistic scenarios, such as a simulated unauthorised logic download, rather than relying on demonstrations.
Evidence timeline
- Mar–Jul 2025Dragos observes systematic reconnaissance of US industrial control loops by a tracked threat group. 2
- Jan 2026Mitsubishi Electric completes its acquisition of Nozomi Networks. 1
- Feb 2026Dragos reports that organisations with comprehensive OT visibility contained OT ransomware in about five days on average. 2
Why it sits at the Industry Acceptance stage
The products are proven, several suppliers have long track records, and integration with IT security operations is routine. We considered Proven in Use but kept the entry at the Industry Acceptance stage: deployment is still concentrated in large operators and regulated sectors, and, as the SANS 2025 survey shows, full visibility close to controllers remains rare 3.
Adoption signals to watch
- OT monitoring becoming a routine line item for mid-sized plants, not only large operators.
- Detection quality measured in independent tests or exercises rather than demonstrations.
- Continued supplier consolidation and how acquired products treat competitors' control systems.
Questions to ask before committing
- Where will sensors sit, and which traffic will they not see?
- What is each alert based on, and can an engineer understand why it fired?
- How is the baseline updated after plant changes, and who does it?
- Which industrial protocols, including proprietary ones on our site, are fully decoded?
- Who triages alerts at 3 a.m., and what authority do they have?
Terms used on this page
- Deep packet inspection
- Decoding the content of network messages, not only their addresses.
- Baseline
- The learned picture of normal communication and behaviour against which deviations are judged.
- MITRE ATT&CK for ICS
- A public knowledge base of adversary tactics and techniques against industrial control systems.
Sources
- Mitsubishi Electric completes full acquisition of Nozomi Networks
- Dragos 2026 Year in Review: new OT threats and ransomware
- SANS report warns of rising gap between fast detection and slow recovery in critical infrastructure
Related technologies
See this entry on the full maturity map · All IT/OT & CCII entries · How placements are made. Stage and time-horizon placements are editorial judgements based on the public sources listed above, as of October 2026. They are not engineering, safety or investment advice; see the Terms of Use.