Listen to this Post
Introduction:
In a move that has sent shockwaves through the cybersecurity industry, Accenture Security has acquired a majority stake in Dragos alongside full acquisitions of runZero and NetRise for a combined enterprise value of approximately $4.175 billion. This isn’t just another services firm buying product companies—this is a fundamental restructuring of how operational technology (OT) security will be delivered to critical infrastructure operators worldwide. With the three companies generating roughly $208 million in annual recurring revenue growing at 53% year-over-year, Accenture is betting that the convergence of services, threat intelligence, asset visibility, and firmware-level supply chain security will define the next decade of industrial cybersecurity.
Learning Objectives:
- Understand the strategic rationale behind Accenture’s unprecedented OT cybersecurity acquisition spree and what it signals for the broader market
- Master the technical capabilities of Dragos (OT threat detection), runZero (asset discovery), and NetRise (firmware/software supply chain visibility)
- Learn practical implementation techniques for OT asset discovery, vulnerability prioritization, and firmware analysis using both commercial and open-source tools
- Develop a framework for securing xOT environments against AI-driven threats and geopolitical risks
You Should Know:
- The New xOT Security Stack: Understanding What Accenture Just Bought
Accenture’s acquisition strategy centers on three companies that, when combined, create an end-to-end xOT (extended operational technology) security platform. Dragos brings industry-leading OT threat detection and incident response credibility, built by practitioners who respond to real ICS incidents globally. The Dragos Platform discovers and profiles assets using over 600 ICS protocols with both active and passive monitoring, delivering complete OT cybersecurity without disrupting operations.
runZero, founded by Metasploit creator HD Moore, adds advanced asset discovery, exposure assessment, and attack surface intelligence. Its agentless, credential-free platform delivers full-spectrum visibility across IT, OT, IoT, cloud, and third-party environments. NetRise contributes deep firmware analysis and software supply chain visibility capabilities, identifying vulnerabilities, misconfigurations, hard-coded credentials, and outdated components within device firmware.
Step-by-step guide to understanding the integrated stack:
- Layer 1 – Asset Discovery (runZero): Continuously discovers every asset on the network—including OT, IT, IoT, and IIoT—using safe active scanning and passive discovery techniques
- Layer 2 – Firmware Intelligence (NetRise): Analyzes device firmware and software bills of materials (SBOMs) to identify hidden vulnerabilities and supply chain risks
- Layer 3 – Threat Detection (Dragos): Provides OT-1ative threat detection enriched by the world’s largest civilian OT threat intelligence team, with four detection types and high-confidence contextualized alerts
- Layer 4 – Services Integration (Accenture): Wraps the product layer inside a $10 billion cybersecurity services machine with decades of trusted relationships with critical infrastructure operators
- OT Asset Discovery and Exposure Assessment with runZero (and Open-Source Alternatives)
runZero’s approach to asset discovery is fundamentally different from traditional vulnerability scanners. It combines active scanning, passive discovery, and seamless API integrations with advanced fingerprinting to profile each asset against nearly 1,000 attributes. On average, enterprise organizations find 25% more assets with runZero than they were previously aware of.
For security professionals who want to understand OT asset discovery fundamentals, here are practical commands using open-source tools:
Basic Nmap scanning for OT asset discovery (use ONLY in authorized lab environments):
Scan for common ICS/OT protocols on a specific subnet nmap -p 502,102,44818,2222,4840,2404,20000 192.168.1.0/24 Modbus device discovery using NSE script nmap -p 502 --script modbus-discover 192.168.1.0/24 Ethernet/IP discovery nmap -p 44818 --script enip-info 192.168.1.0/24 Siemens S7 discovery nmap -p 102 --script s7-info 192.168.1.0/24 DNP3 discovery nmap -p 20000 --script dnp3-info 192.168.1.0/24
Important safety considerations for OT scanning:
Use safe scanning options to avoid disrupting production nmap -T2 --max-rtt-timeout 1000ms --max-retries 1 --min-rate 10 192.168.1.0/24 Export results in multiple formats for analysis nmap -oA ot_asset_scan 192.168.1.0/24 Creates .nmap, .xml, and .gnmap files
runZero’s proprietary Explorer deployment on Linux systems:
Download and install runZero Explorer (official method via runZero console) wget https://<runzero-instance>/explorer/install.sh chmod +x install.sh sudo ./install.sh --org <ORG_ID> --explorer <EXPLORER_NAME> Verify installation systemctl status runzero-agent-<ORG_UUID> Check logs for any issues journalctl -u runzero-agent-<ORG_UUID> -f
The key insight from runZero is its Inside-Out Attack Surface Management (IOASM) capability, which identifies internal assets that are also exposed on the public internet—no external IP knowledge or configuration required. This addresses a critical gap where organizations don’t realize their OT devices are inadvertently exposed.
- OT Threat Detection and Vulnerability Prioritization with Dragos
Dragos addresses what makes security challenging in ICS environments: legacy equipment, proprietary protocols, air-gapped networks, and zero-downtime requirements. The platform’s approach to vulnerability management is particularly noteworthy—only approximately 6% of OT vulnerabilities need immediate action, and Dragos provides OT-corrected CVSS scores with a “Now, Next, Never” prioritization framework.
Understanding Dragos Platform architecture:
- Data Collection: 600+ ICS protocols with both active and passive monitoring
- Asset Discovery: Automatic discovery, classification, and monitoring of every OT asset south of the firewall
- Threat Detection: Four detection types enriched by civilian OT threat intelligence team
- Response: Expert-authored playbooks, timeline correlation, and query-focused datasets
API integration example for pulling threat intelligence:
Generate API key in Dragos Platform console Navigate to Admin > Users > API Keys > Add new API key Example curl command to query Dragos API for threat intelligence curl -X GET "https://<dragos-instance>/api/v1/threats" \ -H "Authorization: Bearer <API_TOKEN>" \ -H "Content-Type: application/json" Query for specific asset vulnerabilities curl -X GET "https://<dragos-instance>/api/v1/assets/<ASSET_ID>/vulnerabilities" \ -H "Authorization: Bearer <API_TOKEN>"
OT vulnerability assessment using open-source tools:
Use nmap to identify OT devices and their exposed services nmap -sV -p 502,102,44818,2222 --script=modbus-discover,s7-info,enip-info 192.168.1.0/24 Use Shodan CLI to check for exposed OT devices (OSINT only) shodan search "port:502 modbus" --limit 10 Use masscan for large-scale OT network discovery (use with extreme caution) masscan -p502,102,44818,2222 192.168.1.0/24 --rate=100
- Firmware and Software Supply Chain Security with NetRise
NetRise addresses one of the most overlooked areas in OT security: the firmware and software running on devices. Its platform identifies vulnerabilities, misconfigurations, hard-coded credentials, and outdated components within device firmware—critical for sectors where outdated equipment remains essential to core operations.
NetRise Provenance, a key capability, maps every package back to its maintainers, their organizations, their locations, and their advisory history. This is delivered through a developer-friendly API, command-line interface (CLI), or GitHub action.
Practical SBOM analysis workflow:
Generate SBOM for a container image using Syft (open-source) syft <container-image> -o spdx-json > sbom.json Generate SBOM for a filesystem syft dir:/path/to/filesystem -o cyclonedx-json > sbom_cyclonedx.json Analyze SBOM for known vulnerabilities using Grype grype sbom:sbom.json Compare SBOMs between versions (NetRise Asset Diffing equivalent) Using open-source tools like cdxgen for comparison cdxgen -o /path/to/v1 /path/to/v2 --diff
Firmware analysis basics:
Extract firmware using binwalk binwalk -e firmware.bin Analyze extracted filesystem for hard-coded credentials grep -r "password|secret|key" extracted_firmware/ Check for common vulnerabilities in extracted binaries checksec --file=extracted_firmware/bin/binary_name
NetRise’s integration with the broader platform means organizations can overlay trust and provenance data onto a verified software asset inventory, creating a complete picture of what’s running on every device and where the risks originate.
- Securing the Extended OT (xOT) Environment Against AI-Driven Threats
The “xOT” concept recognizes that modern operational environments extend beyond traditional OT to include IoT devices, cloud-connected sensors, IIoT, and related IT infrastructure. With AI being integrated into both industrial decision-making and adversary operations, the attack surface is expanding rapidly.
Key security controls for xOT environments:
Network Segmentation Validation using runZero:
runZero can identify multi-homed devices that shatter segmentation—devices that often act as a bridge bypassing firewalls and other controls designed to prevent lateral movement. The platform’s network maps show unintended routes across environments that threaten security.
Windows commands for OT network assessment:
Check for routing table entries that might indicate multi-homed devices
route print
Identify network interfaces and their configurations
ipconfig /all
Use PowerShell to scan for open ICS ports (use with caution)
1..254 | ForEach-Object { Test-1etConnection -ComputerName 192.168.1.$_ -Port 502 -InformationLevel Quiet }
Vulnerability Management with OT Context:
The Dragos Platform enriches and continuously updates CVSS scores with OT-specific context, mapped to asset inventory. This is critical because patching in OT environments is often not feasible or safe—alternative mitigations are required.
Linux commands for OT environment hardening:
Check for default credentials in OT devices (lab environment only) nmap -p 502 --script modbus-discover --script-args modbus-discover.aggressive 192.168.1.0/24 Identify expired certificates on network devices openssl s_client -connect 192.168.1.100:443 -showcerts < /dev/null 2>/dev/null | openssl x509 -1oout -dates Check for outdated protocols (e.g., Telnet, FTP) in use nmap -p 23,21,161 192.168.1.0/24
Incident Response Playbooks:
Dragos provides expert-authored playbooks that accelerate investigation and response without disrupting critical operations. The platform’s timeline correlation and query-focused datasets help teams understand attack progression and respond faster.
What Undercode Say:
- Key Takeaway 1: This is a services-to-products pivot of historic proportions. Accenture has been building OT capabilities for over a decade through acquisitions like Cimation (2015) and Revolutionary Security (2020), but this marks the first time the firm has entered OT cybersecurity software at scale. The strategic rationale is clear: sell eight- and nine-figure industrial transformations with six- and seven-figure OT security products bundled in.
-
Key Takeaway 2: The OT security market is entering a consolidation phase. With Accenture’s entry, ServiceNow’s acquisition of Armis for $7.75 billion, and Microsoft’s earlier CyberX purchase, the OT security landscape is rapidly consolidating. The question is whether this marks the beginning of broader convergence between services-led transformation firms and cybersecurity platform providers.
Analysis: What makes this deal particularly significant is the unique position Accenture occupies. Unlike pure-play cybersecurity vendors, Accenture has deep relationships with the largest public and private companies globally, executing eight- and nine-figure programs in the OT space. The combination of Dragos’ threat intelligence, runZero’s asset visibility, and NetRise’s firmware analysis creates a product layer that can sit inside that services machine in ways nobody else can match.
The OT cybersecurity market is estimated at $27 billion in 2026 and projected to grow to nearly $59 billion by 2031 at approximately 16% CAGR. Accenture’s move positions the firm to capture a significant portion of this growth, leveraging its existing services businesses to scale adoption of these security products.
However, the consolidation also raises questions about vendor neutrality. Dragos has built its reputation on being vendor-1eutral—a critical differentiator in OT security. While Dragos CEO Robert Lee has stated the company will remain independent and vendor-1eutral, the Accenture ownership structure inevitably creates channel conflicts with other service providers.
Prediction:
- +1 Accenture’s deep relationships and go-to-market firepower will accelerate Dragos, runZero, and NetRise adoption, potentially doubling their combined ARR within 24-36 months as the products get integrated into large-scale industrial transformation programs.
-
+1 The “xOT” security platform category will become a standard procurement requirement for critical infrastructure operators within 3-5 years, driving similar consolidation moves from other major services firms like Deloitte and PwC.
-
-1 Vendor-1eutrality concerns may cause some existing Dragos customers who are also Accenture competitors to seek alternative OT security solutions, potentially creating a short-term headwind despite the long-term growth potential.
-
-1 The complexity of integrating three distinct product companies with different cultures, technology stacks, and go-to-market approaches could create execution risk, particularly if Accenture pushes for aggressive integration timelines.
-
+1 The acquisition will accelerate innovation in OT security AI capabilities, as Accenture’s unique industrial datasets combined with Dragos’ threat intelligence create training data that no other provider can match.
-
+1 This move will finally force the cybersecurity industry to take OT/xOT security as seriously as IT security, potentially unlocking the $59 billion market opportunity Accenture has identified and driving a new wave of investment in industrial cybersecurity talent and technology.
▶️ Related Video (76% Match):
https://www.youtube.com/watch?v=C8UmGsRcCb4
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Colegrolmus Just – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
