Dragos Platform

Prioritizes CPS/OT findings by real-world exploitability and operational impact rather than raw vulnerability counts, reflecting that most OT assets cannot be patched on IT timelines.

Dissects OT protocol payloads at the function code level, detecting unauthorized read/write operations, unusual register ranges, and firmware upload commands in Modbus, DNP3, EtherNet/IP, PROFINET, and OPC-UA traffic.

Discovers OT/ICS assets by analyzing existing network traffic (Modbus polls, Profinet broadcasts, EtherNet/IP connections), without sending any probe packets that could disrupt device operation.

Identifies and prioritizes vulnerabilities across discovered OT and ICS assets using device, firmware, and exposure context, recommending safe, operationally feasible remediation or compensating controls for environments where patching is constrained.

Forwards enriched OT security alerts into enterprise SIEM and SOAR platforms with OT-specific context, enabling unified SOC operations without requiring OT-specialized analysts.

Baselines normal device communication patterns (command frequency, connection pairs, timing), and alerts on deviations, detecting reconnaissance, manipulation, and lateral movement.

Generates pre-formatted incident notifications compliant with CISA reporting requirements, NERC CIP-008, and sector-specific regulatory reporting obligations.

Monitors OT system availability, process variable integrity, and control system state, flagging deviations that indicate cyberattack or equipment failure affecting operational continuity.

Ingests and applies threat intelligence specific to critical infrastructure threat actor groups (Sandworm, ELECTRUM, Volt Typhoon), and sector-specific attack techniques.

Supports sector-specific compliance frameworks alongside IEC 62443: NERC CIP for electric utilities, TSA security directives for pipelines, NRC cybersecurity requirements for nuclear.

Models expected behavior of safety-instrumented systems (SIS) separately from process control systems, preventing false alerts on normal SIS state machine transitions.

Builds ICS asset inventories (PLCs, RTUs, HMIs, engineering workstations) from passive network observation without probes that could disrupt operations.

Provides a single platform for monitoring both enterprise IT and OT network segments, enabling unified SOC operations without separate monitoring tooling for each domain.

Identifies device vulnerabilities by fingerprinting asset type, firmware version, and protocol implementation from passive traffic observation, no active scan that could disrupt device operation.

Monitors ICS network traffic by analyzing span port or tap data without injecting any traffic, critical for environments where active probing can cause PLC faults or safety system trips.

Maps network topology, identified vulnerabilities, and detected anomalies to IEC 62443 zone and conduit requirements and security level targets.

Inspects industrial protocols (Modbus, DNP3, IEC 61850, EtherNet/IP, PROFINET, OPC-UA, BACnet) at function-code level for commands and configuration changes. Coverage breadth and inspection depth (command-level function code analysis vs. packet-level header parsing) both vary across ICS security products and are primary evaluation criteria.