Report:

Magic Quadrant for CPS Protection Platforms

Top Vendor Products for CPS Protection Platforms in 2026

• Armis
• Claroty
• Dragos
• Nozomi Networks

CPS Protection Platforms Vendor Product Comparisons 2026

• Armis - Leader
  

  Pros:

  • Deployment: Armis has a mature outcomes-based proof of value process where presales, engineering and go-to-market teams jointly manage deployment, success criteria and executive checkpoints. Deployment services are available as professional services bundles, rather than per-hour fees.
  • Innovation: In the past year, the company has introduced a fly-away portable version of Centrix; a programmable logic controller (PLC) module report that visualizes physical/logical architecture; automated factory acceptance testing (FAT) and site acceptance testing (SAT) testing with documentation; and Centrix Attack Path Mapping to simulate attack scenarios.
  • Training: Training is provided through Armis University, with guided online learning, role-based paths, hands-on labs and release-specific training.

  Cons:

  • Reduced CPS-specific messaging: Recent marketing by Armis has been less focused on key CPS security use cases or specific industries and roles compared with competitors. This demonstrates an enterprisewide repositioning that could impact perceptions of Armis' commitment to the unique needs of CPS environments.
  • Market positioning: As the platform's capabilities have evolved, Armis has shifted its market messaging several times, starting as a cyber asset attack surface management (CAASM) vendor for enterprise and cloud, then repositioning as a core CPS security vendor, and most recently as an exposure management vendor. This evolution risks overshadowing Armis' position as a CPS protection platform provider, particularly if the ServiceNow acquisition accelerates enterprise and cloud strategies at the expense of unique CPS needs.
  • Customer support: Client support could be improved for local languages in key markets such as France, Italy and Japan, where English proficiency is limited.


• Cisco - Niche Player
  

  Pros:

  • Geographic reach: Cisco is a large global organization providing direct sales and support in nearly all countries through its own staff, partners, resellers and distributors with valid service contracts.
  • Operations: The company's network of 80,000 global partners and 26,000 security partners can access a web portal with learning maps for product design and installation. Online tests are available for partner certification, and the Cisco Live on-demand library offers several thousands of videos featuring engineers presenting industry best practices, deployment options and product updates.
  • Marketing strategy: To address limited awareness of its CPS protection platform, Cisco has launched initiatives such as Industrial Summits at Cisco Live, created industry-specific campaigns, sponsored S4x events and exhibited at the RSA Conference.

  Cons:

  • Innovation: Cisco's product enhancements lag those of competitors; in a December 2025 announcement, Cyber Vision 5.4 now supports ABB, Sauter, SEL, COTP and HTTP-UPNP protocols.
  • Vertical/industry strategy: Cisco's cybersecurity focus within its Industrial IoT division is on manufacturing, energy and transportation. Organizations in other CPS-intensive verticals may require additional evaluation to ensure their unique needs are met.
  • Customer experience: Gartner Peer Insights and inquiry data indicate that users report negative sentiment about Cyber Vision's licensing model and the effort required to determine whether a device is legitimate, unknown or a duplicate.


• Claroty - Leader
  

  Pros:

  • Vertical industry strategy: Claroty continues to focus on unique industry needs by supporting vertical-specific asset information, device purpose mapping and business-centric risks. However, its split between healthcare and industrial capabilities bears watching.
  • Market responsiveness: Claroty shows a mature process for gathering customer needs and adapting its roadmap. In 2025, Claroty Edge evolved from a single-host utility to a scalable discovery engine deployable on Windows, Linux and Docker. It also launched an AI-powered CPS Library to enhance asset visibility and vulnerability attribution.
  • Product strategy: The company is shifting toward an outcome-driven playbook tailored to customer environments, emphasizing uptime and resilience while aligning visibility, exposure management, threat detection and segmentation.

  Cons:

  • Geographic reach: While global, Claroty does not have the same country-level reach as some of its competitors, which can challenge clients in regions with lower presence.
  • Customer experience: Some clients report deployment challenges and longer time to value due to initial site network architecture knowledge and scoping gaps. Claroty Edge can help with initial scoping and should be considered for dynamic discovery and to help map optimal sensor placement.
  • Sales and pricing strategy: Claroty is moving from an all-modules, site-based pricing model for xDome Industrial to a modular approach. While intended to support value- and outcomes-based strategies, this may increase confusion for clients in the short term.


• Darktrace - Visionary
  

  Pros:

  • Business model: Following its acquisition by Thoma Bravo, Darktrace added dedicated CRO/VP-level CPS leadership and scaled CPS product management and marketing. Strategic partnerships with the UK's National Cyber Security Centre (NCSC), OEMs, hyperscalers and security vendors extend delivery coverage and enable coordinated go-to-market collaboration.
  • Innovation: Darktrace Cyber AI Analyst automates SOC L1/L2 alert investigations by performing event correlation, hypothesis development and narrative summarization. Darktrace has also introduced postquantum cryptography posture tagging to identify assets involved in TLS and SSH communications for emerging security and compliance requirements.
  • Product strategy: Darktrace's strategy aligns with expanding regulatory and compliance demands, as well as postquantum readiness. The company achieved FedRAMP High ATO and ISO 42001 certifications for its CPS platform components.

  Cons:

  • Market responsiveness: In 2025, Darktrace pivoted its roadmap in key capabilities such as risk and exposure management to catch up with competitors, while those competitors have attempted to shrink Darktrace's AI-first advantage by releasing their own AI-enhanced capabilities.
  • Customer experience: Technical support is officially available in English, Spanish and Japanese; responses in other local languages are best effort only, which may constrain customers requiring broader localized support.
  • Marketing execution: By positioning as the platform for continuous defense, Darktrace misses the production-centric nuances required in CPS environments.


• Dragos - Leader
  

  Pros:

  • Business model: Dragos broadened its reach by acquiring Network Perception, launching a dedicated U.S. public sector LLC, partnering with OEMs such as Yokogawa, and launching Dragos Platform 3.0 with enhanced capabilities.
  • Enhancement and training: Dragos assists customers in adopting and validating functionality of new releases with an early access process. These hand-selected clients then work closely with the Dragos customer success team over seven to 10 days to provide feedback, update documentation and update the customer training portal. This portal offers over 20 structured self-service training series; instructor-led courses are also available.
  • Vertical/industry strategy: Dragos continues to deepen its oil and gas, energy and utilities focus while methodically targeting manufacturing and government markets by investing in understanding unique sector threats, trends and regulations.

  Cons:

  • Geographic reach: Dragos has only recently started building dedicated regional teams and partners in select regions such as the Middle East and Asia/Pacific, including Japan.
  • Innovation: The company has historically lagged competitors when it comes to multiple asset discovery methods (including active discovery), device nesting granularity, workflows, network segmentation and risk scoring. Addressing these gaps may present Dragos with challenges as it works to catch up.
  • Geopolitical shifts: As geopolitical tensions rise, deep ties in specific countries could become liabilities elsewhere. U.S. mandates for domestic technology for power grids, water systems and industrial controls systems favor Dragos domestically, but may become a liability in other markets.


• Forescout Technologies - Challenger
  

  Pros:

  • Operations: Forescout is partnering with NVIDIA for high-performance on-premises GenAI and agentic applications. The Forescout 4D Platform aggregates anonymized telemetry from many devices into a secure data lake for intelligence generation. Forescout also provides e-learning with videos, slides and quizzes on platform setup, policy design and detection.
  • Market responsiveness: Forescout responds quickly to customer requests and has established partnerships for remote access and custom-built protocol parsers for unknown protocols.
  • Sales execution/pricing: Beyond regular proof of value engagements, Forescout offers a 'test drive' environment where prospects can provision a virtual instance of the platform. Fly Away Kits are available for air-gapped assessments of critical sites and hardware evaluation.

  Cons:

  • Vertical industry strategy: While healthcare providers make up almost one-fifth of Forescout CPS protection platform revenue, a large portion comes from outside the usual verticals such as chemicals, construction or pharmaceuticals.
  • Investment strategy: In a rapidly changing threat landscape and with end-user CPS security needs increasing, it is unclear what part of the overall 4D Platform will benefit from future product development investments because it spans both IT and CPS (OT, IoT, IoMT).
  • Customer experience: While customers generally like the Forescout 4D Platform, some cite a drop in customer support quality.


• Fortinet - Challenger
  

  Pros:

  • Sales execution/pricing: Proof-of-value and pilot deployments are led by consulting systems engineers (CSEs) and CPS security specialists who understand operational context. Flexible pricing supports on-premises perpetual, on-premises subscription and SaaS subscription models, along with enterprise agreements and unlimited-user constructs to align procurement with customer preferences.
  • Product strategy: Fortinet's OT security platform combines asset and vulnerability data with operational instructions to prioritize CPS security tasks and reduce unnecessary alerts.
  • Operations: The Fortinet Fabric-Ready Partner Program has grown to over 400 technology partners, with recent integrations including Armis, CrowdStrike, Equinix, Qualcomm and ServiceNow.

  Cons:

  • Vertical industry strategy: Fortinet's OT Security Platform lacks CPS industry-specific unique capabilities, limiting relevance for buyers seeking deep vertical expertise.
  • Business model: Clients report to Gartner that they must purchase several Fortinet products to get full value, which increases costs and single-vendor dependency.
  • Market understanding: Fortinet is still building its CPS sales resources while investing to better align with global and regional system integrators and managed security service providers. Its partner-led sales model can result in inconsistent technical depth across partners, requiring customers to validate CPS-specific skills and escalation paths for complex issues.


• Honeywell - Niche Player
  

  Pros:

  • Geographic strategy: Honeywell is a large global organization providing direct sales and support in nearly all countries through its own staff. This enables alignment with national or regional requirements such as NERC/CIP in the U.S. and NIS2 in the EU.
  • Scale: Pre-business split, Honeywell is a global enterprise with over 100,000 employees. Since acquiring SCADAfence, development has focused on stabilizing the product suite, achieving regional regulatory compliance (such as with the EU Cyber Resilience Act) and aligning internal architectures.
  • Operations: Honeywell's customer success managers reach out to assigned accounts to confirm awareness of new features, explain their value and provide opportunities for questions. Existing customers benefit from dedicated deployment services to accelerate time to value.

  Cons:

  • Innovation: Honeywell is working to catch up with competitors by advancing its asset discovery capabilities with active-only and mixed modes. Recent integrations with ServiceNow CMDB, Cyolo SRA and Fortinet SIEM also reflect efforts to close the gap on competition rather than drive innovation.
  • Marketing strategy: Honeywell's marketing efforts often focus on regional compliance-focused marketing campaigns and participation in vertical industry events that target prospects who may be interested in production and automation solutions but are not decision makers for cybersecurity investments.
  • Business model: Technology partnerships are mainly focused on hyperscalers such as Amazon Web Services, Microsoft Azure and Google, rather than other security vendors. This approach helps with cloud alignment and scale, but limits opportunities to engage with innovative CPS security.


• Microsoft - Niche Player
  

  Pros:

  • Geographic reach: With Microsoft's global footprint, Defender for IoT is broadly available worldwide alongside many other Microsoft offerings.
  • Operations: As a global company, Microsoft has an established infrastructure for sales and support that enterprises can leverage.
  • Pricing: Microsoft's market reach supports sales and pricing flexibility. Defender for IoT can be bundled with other Microsoft products (with up to five Enterprise IoT devices included in Microsoft 365 E5 pricing) or bought as a stand-alone product with site-based licensing.

  Cons:

  • Marketing execution: Defender for IoT is only one of many products within the Microsoft portfolio and is not prioritized in marketing, resulting in lower visibility compared with competitors' products in CPS security.
  • Vertical strategy: As primarily an enterprise provider, Microsoft focuses on horizontal product development and go-to-market strategies, rather than on the unique vertical industry needs of CPS environments.
  • Innovation: Microsoft has not recently invested in new feature updates for Defender for IoT, focusing instead on bug fixes for sensors in the 25.x series. In January 2025, it retired its on-premises management console.


• Nozomi Networks - Leader
  

  Pros:

  • Market responsiveness: Nozomi Networks uses client feedback from advisory board sessions and surveys to inform agile development teams that work directly with early adopters to refine solutions.
  • Innovation: In 2025, Nozomi Networks added controller logic, process variables and life cycle information from OEMs to asset pedigrees. The company also introduced automated deployment wizards, a physical map using wireless triangulation and multiple AI-assisted capabilities across critical capabilities of the platform.
  • Product strategy: From wireless asset discovery to Arc-embedded technology and value-based buying options, Nozomi Networks adapts its roadmap and go-to-market strategies to meet the rapidly evolving needs of the customer.

  Cons:

  • Positioning and messaging: Despite assurances from Nozomi Networks that the Mitsubishi Electric acquisition will not affect its independence, Gartner inquiries show that clients and competitors will closely monitor for any shifts.
  • U.S. public sector reach: As the U.S. federal market grows and mandates Authorizations to Operate (ATOs) under FedRAMP, Nozomi Networks is still working toward achieving a Moderate-level ATO and lags several key competitors in this area.
  • Sales strategy: The 'partner-first' sales approach discourages direct transactions to enhance partner value. While this strategy can accelerate entry into new accounts, industries and regions, it risks diluting the client intimacy that has fueled the company's innovation.


• Palo Alto Networks - Niche Player
  

  Pros:

  • Operations: Palo Alto Networks offers comprehensive training and certification through Palo Alto Networks Education Services, including digital learning, instructor-led training and a cybersecurity academy.
  • Geographic reach: As a large global organization, Palo Alto Networks provides direct sales and support in nearly all countries and maintains a network of global partners.
  • Broad portfolio: The company has solid financials and an established global presence in cybersecurity, reporting $9.2 billion for fiscal year 2025 and serving 70,000 organizations.

  Cons:

  • Marketing execution: Palo Alto Networks has reduced dedicated marketing focus on CPS security. In 2025, its press release activity specific to CPS security was considerably lower than that of competitors.
  • Innovation: The company significantly decreased the release of features specific to its CPS protection platform in 2025 compared with 2024.
  • Vertical industry strategy: By delivering CPS protection platform functionality as part of a broader enterprise-centric product set, Palo Alto Networks does not prioritize vertical-specific CPS security capabilities.


• Tenable - Challenger
  

  Pros:

  • Geographic reach: Tenable has broad geographic coverage through direct sales and support in key markets across North America, Europe and Asia/Pacific, complemented by extensive channel partner reach for global scalability.
  • Mature proof-of-value process: Tenable uses a structured, phased methodology that respects unplanned or scheduled freeze days and safety change windows.
  • Targeted marketing: Tenable has updated its messaging to place end users at the center, with guided demos and self-diagnosis.

  Cons:

  • Vertical industry strategy: Tenable's approach remains platform-led rather than deeply verticalized, emphasizing reusable cross-industry capabilities over differentiated vertical-specific packaging or go-to-market strategies.
  • Customer experience: Customers cite a steep learning curve and navigation challenges for nonspecialists. Large environments require significant resources and dedicated personnel to operate effectively.
  • Innovation: While Tenable demonstrates ongoing progress, it is still catching up in advanced CPS threat detection, as competitors have built detection mechanisms with AI-driven behavioral baselining and protocol-aware process semantics.


• TXOne Networks - Niche Player
  

  Pros:

  • Operational intelligence: TXOne gathers real-time metadata (never payloads) to understand clients' product usage and update their roadmaps and training strategies accordingly.
  • Innovation: Recent launches include TXOne Deployment Assistant for batch device provisioning across hundreds of devices; AI-powered auto rule learning for automated rule generation based on traffic analysis; and Stellar Cyber-Physical System Detection and Response (CPSDR) for sequential traffic flow analytics.
  • Product strategy: In 2025, TXOne enhanced visibility, segmentation, threat detection and management capabilities. The updates included custom TCP/UDP port mapping for OT protocols on nonstandard ports, as well as SageOne integration for unified orchestration across edge network security and Stellar endpoint protection.

  Cons:

  • Market reach: A significant portion of TXOne's CPS protection platform revenue depends on a few very large customers; because it has other CPS security solutions, only a small percentage of full-time employees are dedicated to the platform.
  • Sales strategy: TXOne has a small direct and indirect sales footprint in key markets such as the U.S., where it is underpenetrated.
  • Vertical industry strategy: While diversifying with other product lines, TXOne's CPS protection platform footprint remains dominated by the semiconductors industry.

Reference

• Gartner, Magic Quadrant for CPS Protection Platforms, 3 March 2026, ID G00830517

View Market Definition
View Vendor Movements