Report:

Magic Quadrant for CPS Protection Platforms

Top Vendor Products for CPS Protection Platforms in 2025

• Armis
• Claroty
• Dragos
• Microsoft
• Nozomi Networks

CPS Protection Platforms Vendor Product Comparisons 2025

• Armis - Leader
  

  Pros:

  • Geographic strategy: Armis has a broad sales and support presence, serving traditional markets in North America, Europe and Asia, as well as emerging markets like Latin America and Africa. This makes it suitable for globally dispersed organizations.
  • Product strategy: Existing discovery tools like passive network analysis have recently been expanded with integrations and additional active querying capabilities to enhance both asset discovery capability and speed of deployment.
  • Operations: As a SaaS platform, Armis Centrix collects real-time operational intelligence of platform usage to drive product improvements. The free Armis University caters to various learning needs and skill levels, covering navigation, feature usage, configurations, integrations and best practices.

  Cons:

  • Overall viability: Armis is largely held by venture capital firms and employees. Large investments in go-to-market efforts to capture market share have offset the profit from the platform. The rapid growth of the company size in 2024 and the two recent acquisitions require scalable processes to be successful.
  • Business model: Customers can choose five different product suites designed to use features from each product. While the core offerings include protection of CPS networks and assets, advanced features are sold separately, meaning customers need to make additional investments to reap the full benefits of Armis Centrix.
  • Vertical/industry strategy: Given its strategy to be an enterprise solution, the Armis Centrix platform can identify devices ranging from X-ray scanners to industrial cranes, but does not prioritize deep vertical industry knowledge.


• Cisco - Niche Player
  

  Pros:

  • Sales execution/pricing: Cisco's CPS deals involve high-touch presales engagements with the industrial specialist team. Its pricing model for multiyear contracts is suited for large-cap organizations with heavy multinational and industrial footprints.
  • Geographic strategy: Cisco supports many geographic areas, both direct and partner/channel-based, including partnerships with OEMs that also resell Cisco products.
  • Marketing strategy: As a leading global company, Cisco has a long track record of top-tier business-to-business (B2B) marketing campaigns and a broad reach that can attract CPS security end users in search of solutions.

  Cons:

  • Product strategy: While Cisco's Industrial Threat Defense has out-of-the-box integration between its products, it is lagging in a seamless user experience as users must switch between those products.
  • Innovation: Cisco's innovations, such as the Encrypted Visibility Engine and SnortML in Secure Firewall, are more IT-centric than CPS-centric and unlikely to show tremendous value within mature CPS security programs.
  • Vertical/industry strategy: Cisco's limited CPS vertical focus on manufacturing, energy and transportation may limit its expansion and development of the CPS PP to meet a wider set of use cases and value.


• Claroty - Leader
  

  Pros:

  • Market responsiveness: Claroty has a mature process to gather customer needs, evaluate the threat landscape and assess competitors. This allows it to respond rapidly to market needs, as evidenced by the recent addition of compliance reporting in response to government directives and frameworks, and continuous threat exposure management (CTEM) tailored to CPS security.
  • Product strategy: Claroty has experience executing its product roadmap, as demonstrated by its focus in 2024 on visibility quality with multiple data collection capabilities, creation of tiers for visibility quality and zone policy development for segmentation.
  • Vertical/industry strategy: When it acquired Medigate for healthcare solutions, Claroty became one of the first companies in this market to recognize specialized industry needs. It has dedicated business leaders and functions aligned to industry requirements to coordinate vertical product and go-to-market efforts.

  Cons:

  • Pricing: Claroty's pricing options can be confusing. For example, it offers software per asset and per site; per bed pricing for healthcare; and capital expenditure (capex) and operating expenditure (opex) models for hardware; as well as a mix of lease, subscription, perpetual licenses and bundling models.
  • Geographic strategy: While a global company, Claroty does not have the same reach at the country level as some of its competitors, and over half of its revenue comes from North America. This can be a challenge for prospects in regions with low or no presence.
  • Operations: Claroty has one close cloud partner (Amazon Web Services). While Claroty has an on-premises offering, there are a couple of months of lag for full-feature parity with xDome, as SaaS solutions are easier to update.


• Darktrace - Visionary
  

  Pros:

  • Geographic strategy: The company has a global coverage, providing direct sales and channel support in 27 countries. This benefits prospective customers seeking global coverage and support.
  • Product strategy: Darktrace/OT is part of the wider product portfolio that ranges from network to cloud and endpoint security. It is based on self-learning AI that autonomously learns normal behavior in a CPS environment, enabling real-time anomaly-based threat detection without relying on signatures.
  • Financials: Darktrace has a large customer base beyond its CPS PP offering, and is profitable. Nearly all revenue comes from annual subscriptions for a solid cash flow that allows continuous investment in new features and capabilities.

  Cons:

  • Operations: Many customers use Darktrace entirely offline, which makes gathering real-time operational intelligence about the platform's usage impossible.
  • Market responsiveness: As both an IT and CPS security vendor, Darktrace is maturing its ability to keep its fingers on the pulse of the quickly evolving CPS security market.
  • Marketing strategy: CPS PP buyers may perceive Darktrace as an IT security solution shoehorned into a CPS environment. Industry recognition like Darktrace's status as Microsoft's U.K. Partner of the Year amplifies this perception, undercutting confidence in Darktrace's knowledge of industrial operations.


• Dragos - Leader
  

  Pros:

  • Thought leadership: Dragos is a leading voice in CPS security. Its Year in Review and Threat Perspectives reports play a key role in educating the market on current challenges, and its relationships with the SANS Institute and government policymakers are effective marketing tools to highlight its place in the market.
  • Product strategy: Dragos acquired Network Perception in 2024. Its NP-View solution provides important additional technical capabilities around network segmentation policy, access path analysis and facilitates low-impact deployment. The combination of approaches will enable visibility not only into what is, but also what can be inferred from assets and connections.
  • Product: Dragos has released major updates in 2024 to include knowledge packs with more than 3,200 new detections, indicators of compromise and playbooks, as well as multiple new data collection methods (including a lightweight collector and active querying capability) and cloud-hosted options.

  Cons:

  • Vertical/industry strategy: Unlike competitors who cast a broad industry net to include healthcare, Dragos focuses primarily on the oil and gas, utilities (electric and water/wastewater) and manufacturing verticals.
  • Sales execution: Dragos has a relatively smaller reach among vendors into channel partners that can open doors and increase indirect sales into new verticals and geographies. This may hinder its sales reach to prospects outside the industries and regions it serves.
  • Geographic strategy: Dragos does not have the same reach at the country level as some of its competitors, and relies on a network of partners. A significant portion of its revenue comes from North America. This limits its reach to prospects for sales, deployment and support.


• Forescout Technologies - Challenger
  

  Pros:

  • Overall viability: Forescout Technologies has benefited from a profitable CPS PP business for the past three fiscal years and is cash-flow positive. This has enabled larger growth in employees dedicated to the CPS PP compared with competitors in engineering and customer success.
  • Marketing execution: Forescout Technologies has a strong focus in the CPS security market, increasing the allocated marketing budget by 25% in 2024 and successfully focusing on competitive positioning by creating microsites specific to top competitors that explain differences between offerings.
  • Geographic strategy: Forescout Technologies has comprehensive geographical reach, providing direct sales and channel partner support. Prospective buyers with global operations would benefit from this.

  Cons:

  • Vertical/industry strategy: Forescout Technologies focuses on the industrial, healthcare, government and financial industry verticals. Gartner clients do not report considering it as a vertical industry thought leader beyond marketing.
  • Sales strategy: About half of Forescout Technologies' CPS PP engagements come from existing customers, which shows little head-to-head competition through proof of value.
  • Business model: While Forescout Technologies enables integration or build of third parties into its platform, it does not use third parties for its core on-premises functionality. This may present limitations in incorporating capabilities rapidly bidirectionally at a time when CPS security needs are evolving faster than ever.


• Fortinet - Niche Player
  

  Pros:

  • Overall viability: As a large global network security vendor, Fortinet's investments into CPS security provide additional options for end users looking for whole-of-enterprise solutions.
  • Geographic strategy: Fortinet supports a sizable number of geographic points of presence to serve the international CPS security market.
  • Product strategy: Fortinet's focus on automation control vendors for innovative partnerships bodes well for the integration and compatibility of its platform within key vendor and OEM ecosystems.

  Cons:

  • Market positioning: Fortinet's CPS PP has limited organic CPS security, vertical industry and operational context, which makes it less attractive to production-centric prospects and more to network-centric prospects.
  • Business model: Fortinet's business model centers on network security vendor consolidation and IT/CPS security convergence, as opposed to a more holistic industry and business-context-aware CPS security approach that many organizations seek.
  • Innovation: Fortinet's focus on innovation focuses on developing strategic partnerships with OEMs and integrating with other CPS PPs. While this drives innovation from Fortinet's portfolio standpoint, it does not focus on innovation directly related to CPS security.


• Honeywell - Niche Player
  

  Pros:

  • Customer experience: Honeywell offers a global portfolio of both managed and professional security services. It provides CPS network assessments, penetration testing, tabletop exercises and risk assessments supported by three regional cybersecurity centers of excellence.
  • Operations: Honeywell follows stringent security processes, focusing on product quality through code quality reviews, unit testing, integration testing, performance testing and security testing. It also offers extensive new customer activation and training programs for partners and employees.
  • Innovation: Honeywell supports an extensive set of security frameworks, such as NIST, NIS2, OTCC (Saudi Arabia), SOCI (Australia) and NERC-CIP, that are coded into the product and provide audit-ready compliance reports via Cyber Watch.

  Cons:

  • Marketing execution: As Honeywell repositions its portfolio in CPS security, it is too early to say whether its SCADAfence acquisition will provide the necessary fuel to accelerate growth beyond the existing professional services-centric position.
  • Vertical specialization: As an OEM and not a pure-play company, Honeywell's team is aligned to strategic business groups within the organization. Honeywell serves industries such as utilities, oil and gas, and healthcare, and focuses its CPS PP efforts to align with business unit strategies.
  • Geographical strategy: Cyber Insights has had less visibility in the U.S. and Europe. However, Honeywell now has an opportunity to market it more aggressively in those significant markets, building on the small footprint of the Middle East- and APAC-centric SCADAfence acquisition.


• Microsoft - Leader
  

  Pros:

  • Geographic strategy: With Microsoft's global reach, Defender for IoT is broadly available worldwide.
  • Product strategy: Defender for IoT focuses on CPS-specific capabilities that include knowledge of myriad unique protocols, several asset discovery methods, OEM certifications, threat intelligence and vulnerability management. It integrates into Microsoft's enterprise suite.
  • Pricing: Microsoft's market reach supports sales and pricing flexibility. Multiple products can be bundled competitively with other Microsoft products or bought as stand-alone. Licensing can be bought directly or through partners and resellers.

  Cons:

  • Marketing execution: Because it is only one of many solutions in the Microsoft portfolio, Defender for IoT is not prioritized in marketing. As a result, it is not as visible as its competitors when it comes to CPS security thought leadership positioning (e.g., reports, webinars or social media).
  • Vertical strategy: As primarily an enterprise solution provider, Microsoft focuses more on horizontal product development and go-to-market strategies. As a result, it does not focus on the special needs of any specific industry.
  • Sales strategy: Microsoft's strategy for partnering with value-added resellers focuses on collaborating with Microsoft Security Partners who have experience in IT security and are only now expanding their service portfolios into CPS security. Most lack deep CPS expertise.


• Nozomi Networks - Leader
  

  Pros:

  • Product: The Nozomi Platform is feature-rich and built around components that can be bundled or individually purchased, depending on each organization's circumstances and maturity. Ten major industrial OEMs resell it.
  • Innovation: Nozomi Networks has historically prioritized novel approaches. It has led the market in bringing AI and machine learning and cloud-based solutions to CPS environments, developing Guardian Air to detect wireless assets and Arc Embedded to deploy directly into programmable logic controllers, remote telemetry units and human-machine interfaces.
  • Geographic strategy: Nozomi Networks has direct sales and support resources in multiple regions and an extensive global channel partner network. This allows support compliance and regulations in many countries and has fueled balanced growth globally.

  Cons:

  • Vertical/industry strategy: Nozomi Networks' focus on first-to-market continuous innovation can be a double-edged sword, as some early adopters have reported having difficulties adapting some of these innovations to their unique environments.
  • Sales strategy: Nozomi Networks' sales resources remain in short supply for the emerging CPS security market, despite its use of a blended direct and indirect sales approach to broaden global coverage with knowledgeable local resources. In discussions with Gartner, clients expressed difficulties finding the right match.
  • Sales execution: Nozomi Networks' proof of concept process certified under ISO 9001 standards is designed to increase value recognition, but requires following a strict process in unpredictable custom-built environments.


• OPSWAT - Niche Player
  

  Pros:

  • Market understanding: Founded in 2002, OPSWAT has a long history in industrial security and understands best practices, use cases and current market demands, which can be helpful to prospective buyers starting their enterprise CPS security journey.
  • Operations: As a long-term established company, OPSWAT has mature processes to support customer needs.
  • Vertical/industry strategy: OPSWAT has historically focused on critical infrastructure and high-security-needs organizations with sensitive missions, which could be advantageous to prospects in these sectors.

  Cons:

  • Marketing strategy: OPSWAT's marketing strategy misses highlighting its wider set of CPS security product offerings and the thought leadership it could provide in the market.
  • Market responsiveness: OPSWAT's CPS MetaDefender portfolio of products are being adopted more slowly compared to other Niche Players in this Magic Quadrant. This is affirmed by a low volume of Gartner client inquiries and Peer Insights.
  • Business model: OPSWAT's CPS security offerings strategy is confusing and unclear to anyone who has not already heard of or worked with the vendor. This is a missed opportunity for prospects to understand the range of offerings.


• OTORIO - Challenger
  

  Pros:

  • Market responsiveness: OTORIO is nimble and attentive to customer pain points and feedback. This has allowed it to mature its roadmap to provide operational context of vulnerability management, enhance case management and workflows, and support factory and site acceptance tests.
  • Product: OTORIO was early in the market in bringing its patented Attack Graph Analysis engineer and simulation feature, which provides recommended exposure mitigation actions. It has gained quick traction as a result.
  • Marketing execution: OTORIO has grown in the market via an inclusive approach, offering both proprietary data collection capabilities and an overlay solution that ingests data from other deployed CPS PP. This expands the number of demos clients can book and accelerates sales cycles. It can be attractive to end users with competitor offerings.

  Cons:

  • Vertical strategy: OTORIO does not structure its team to align to vertical industries and has no plans for any significant changes in industry alignment.
  • Geographic strategy: As a relative newcomer to the market, OTORIO has limited global reach both directly and through partners. However, it is increasing its established presence in India, Europe and the Americas.
  • Business model: OTORIO only refactored its offering in the last 18 months to align to a platform model and rebranded it as the OTORIO Titan platform, so its track record is not as established as others in this research.


• Palo Alto Networks - Challenger
  

  Pros:

  • Product features: Palo Alto Networks enables easy deployment and provides mitigating controls due to the integration of Strata capabilities within its network security ecosystem. This is delivered with asset-based traffic control, policy and segmentation capabilities, as well as in-line network continuous security inspection and threat prevention.
  • Product strategy: Palo Alto Networks introduced significant improvements in 2024 to its capabilities, particularly asset visibility, risk assessment, policy enforcement, compliance reporting and automation. Planned product additions include microsegmentation and AI-based threat hunting.
  • Innovation: Palo Alto Networks has made significant investments in AI-supporting CPS security. This includes areas such as CPS asset identification and behavior analytics, AI with proprietary assistant, and GenAI vulnerability and risk posture information. It also delivered innovations in private LTE/5G security.

  Cons:

  • Sales strategy: Palo Alto Networks' sales strategy in support of its Strata product is unclear outside of its NextWave program with resellers. This could impact the success of its go-to-market strategy.
  • Sales execution: Palo Alto Networks' tight coupling of Strata with its NGFW limits opportunities to sell the product to users of third-party networking equipment.
  • Vertical specialization: Palo Alto Networks recognizes that vertical industry knowledge is uniquely important in CPS security, but not all industries it serves have the same level of thought leadership depth yet.


• Radiflow - Niche Player
  

  Pros:

  • Product features: Since Radiflow's founding in 2009, its CPS PP has evolved into a mature solution with support from a large ecosystem of partners. It recently added the ability to detect devices using railway-specific protocols.
  • Business model: Radiflow has established a number of strategic partnerships with OEMs, resellers and global consultancy providers. This allows for enhanced service delivery, strategic collaboration and joint marketing.
  • Sales strategy: Despite being one of the smaller players in the market in terms of headcount, Radiflow has built a comprehensive strategy for partnering with value-added resellers to enhance its market reach and service delivery.

  Cons:

  • Operations: Like some of its competitors, delivering hardware (like sensors) to remote locations frequently affects Radiflow's speed of deployment. It recommends that customers deploy servers locally so it can support installations remotely.
  • Overall viability: Radiflow isn't profitable or cash-flow positive, as it's focusing on increasing the sales footprint and product portfolio to grow the overall business. However, industrial conglomerate Sabanci Group is committed to financing growth in the coming years.
  • Marketing strategy: Radiflow relies on local partners for joint marketing events. While this expands its reach to other countries, these partnerships tend to dilute its messaging.


• Sepio - Niche Player
  

  Pros:

  • Product: Sepio's trafficless approach takes away the need for traditional sensors, probes or crawlers. This supports easy deployment and low architectural complexity.
  • Sales execution: Sepio's very high customer retention rate in 2024 is evidence of its solid proof-of-value execution leveraging lab workshop and production deployment. This allows prospects to test the solution against attack scenarios and provide in-depth insights into customers' CPS environments' activity.
  • Operations: Sepio deployments start with a kick-off process to focus on understanding business context to optimize tagging, risk scoring and playbook development. This translation of technical requirements to business logic helps create a trusted connection between teams.

  Cons:

  • Sales strategy: Sepio is revamping its approach to sales by focusing its small team on strategic accounts and verticals, and growing channel partnerships.
  • Geographic strategy: While its strategic partnership with Lenovo can help with sales reach, Sepio itself has limited direct country coverage outside the U.S., Portugal, the U.K., Singapore, Brazil, Israel, South Africa and Nigeria.
  • Innovation: Sepio's strategic partnerships for innovation focus on technology partners such as Lenovo and NVIDIA, neither of which have a recognized pedigree in the CPS field. Its top product innovation capabilities tend to focus primarily on visibility features more than aspects, such as threat and vulnerability management and risk scoring.


• Tenable - Niche Player
  

  Pros:

  • Product: Tenable's OT Security product is mature in terms of core capabilities such as asset discovery and vulnerability management, which is a core focus for the vendor. It integrates with the Tenable One platform for centralized security management and reporting.
  • Geographic strategy: Tenable has sales and support resources in multiple regions, as well as an extensive global channel partner network.
  • Operations: Tenable is a larger company with many years of cybersecurity experience across multiple disciplines and can therefore bring a mature, diversified approach to operations when compared to other CPS PP market leaders with more limited scope.

  Cons:

  • Pricing: Tenable CPS OT Security product licensing is priced by asset count, compared with other market leaders that have moved to site-based pricing. Asset-based pricing is confusing to many prospects who are looking for a CPS PP precisely because they do not know how many assets they have.
  • Market responsiveness: After acquiring Indegy in 2019, Tenable has not kept up with the rapid pace of innovation of many pure-play competitors, opting instead for an add-on strategy to the overall Tenable portfolio.
  • Innovation: With its vulnerability scanner Nessus and Tenable's wider positioning in IT security, the CPS OT Security product is more centered on exposure, risk and vulnerability management than aligned to the new market needs for which competitors are innovating.


• TXOne Networks - Niche Player
  

  Pros:

  • Product features: The EdgeOne platform, alongside EdgeFire and EdgeIPS appliances, combines the role of the network sensor with in-line IPS and segmentation capabilities. As a result, it does not need to rely on third-party integration to protect vulnerable devices.
  • Innovation: TXOne Networks has developed solutions with key CPS equipment manufacturers to embed security directly into the control and automation systems global enterprises use.
  • Business model: Purpose-built for CPS environments, TXOne Networks' solutions target first-mover global customers in verticals with significant and growing capital expenditure.

  Cons:

  • Operations: TXOne Networks' EdgeIPS network appliances may provide overlapping capabilities and higher implementation costs in end-user organizations that have invested in NGFWs.
  • Customer experience: TXOne Networks uses a personalized service-level agreement structure. While this ensures the platform meets each client's specific requirements, it can also create inconsistency in support and customer perception. TXOne still must earn the trust of clients deploying this in their production environment.
  • Overall viability: A significant part of TXOne Networks' CPS PP revenue depends on a few very large customers who generate a lot of revenue, posing a significant risk should they decide to change course. Unlike many U.S.-based cybersecurity companies, TXOne Networks doesn't have a large 'home market,' so it must work harder to build awareness and trust in markets it enters.

Reference

• Gartner, Magic Quadrant for CPS Protection Platforms, 12 February 2025, ID G00808225

View Market Definition
View Vendor Movements