Dragos

Provides industrial cybersecurity software and services for critical infrastructure and operational technology (OT) environments.

Website: https://www.dragos.com/

Cover Block

PUBLIC


Name	Dragos
Tagline	Provides industrial cybersecurity software and services for critical infrastructure and operational technology (OT) environments.
Headquarters	Hanover, Maryland, US
Founded	2016
Stage	Series D+
Business Model	SaaS
Industry	Security
Technology	Software (Non-AI)
Geography	North America
Growth Profile	Venture Scale
Founding Team	Co-Founders (3+)
Funding Label	$100M+ (total disclosed ~$439M)

Executive Summary

PUBLIC Dragos defends the physical world's operational technology, a high-stakes niche where traditional IT security tools fail, and has secured a position as a category leader backed by strategic industrial capital [Dragos, 2026] [Business Insider, Nov. 2020]. The company was founded in 2016 by a team of practitioners, including CEO Robert M. Lee, whose background investigating state-sponsored attacks on industrial control systems informs the platform's design [Forbes, 2016]. Its core offering, the Dragos Platform, provides visibility, threat detection, and guided response for critical infrastructure sectors like electric utilities, oil and gas, and manufacturing, differentiating itself through high-confidence, contextualized alerts and community-driven intelligence via its Neighborhood Keeper network [Dragos, 2026]. The founding team's deep expertise in industrial cybersecurity, combined with strategic investments from firms like Rockwell Automation and Koch Disruptive Technologies, underscores a business model built on both software subscriptions and professional services [TechCrunch, 2022] [Dragos, 2026]. With total disclosed funding exceeding $400 million and a reported valuation of $1.7 billion, Dragos operates at venture scale with revenue reaching $154.4 million in 2024 [getlatka.com, 2026] [Tracxn]. Over the next 12-18 months, the key watchpoints are the company's ability to maintain its leadership in the evolving CPS protection platform market against larger IT security vendors and to translate its substantial practitioner credibility into sustained enterprise contract growth.

Data Accuracy: GREEN -- Core facts corroborated by company press releases, business publications, and financial data aggregators.

Taxonomy Snapshot

Axis	Classification
Stage	Series D+
Business Model	SaaS
Industry / Vertical	Security
Technology Type	Software (Non-AI)
Geography	North America
Growth Profile	Venture Scale
Founding Team	Co-Founders (3+)
Funding	$100M+ (total disclosed ~$439M)

Company Overview

PUBLIC Dragos was founded in 2016 in Hanover, Maryland, by a group of industrial cybersecurity practitioners led by Robert M. Lee, a former U.S. Air Force Cyber Warfare Operations Officer and SANS Institute Fellow [Crunchbase]. The company's founding narrative, as presented in its own materials, is built on a mission to protect civilization by addressing the security gap in critical industrial infrastructure [Dragos]. Its early years were defined by establishing credibility through the deep practitioner experience of its founders, including Lee, CTO Jon Lavender, and Chief Data Scientist Justin Cavinee, all of whom had backgrounds in investigating significant attacks on industrial control systems [Dragos, SecurityWeek].

Key corporate milestones followed a trajectory of strategic capital raises and product validation. The company secured a $44 million Series B in September 2018 led by Kleiner Perkins, followed by a $74 million Series C in October 2019 led by industrial automation giant Rockwell Automation, signaling early strategic alignment [Business Insider, Nov. 2020]. By late 2020, PitchBook valued the company at $423 million [Business Insider, Nov. 2020]. A subsequent $200 million Series D round, led by Koch Disruptive Technologies, was announced in 2021 and reportedly propelled Dragos to a $1.7 billion valuation [Dragos, Benzinga]. The company has since been named a Leader in the Gartner Magic Quadrant for Cyber-Physical Systems (CPS) Protection Platforms for both 2025 and 2026, a key external validation of its market position [Dragos].

Data Accuracy: GREEN -- Founding details and funding rounds corroborated by Crunchbase and company press releases; valuation and Gartner status are publicly reported.

Product and Technology

MIXED

Dragos sells a software platform and associated services designed to secure the operational technology (OT) environments that run critical infrastructure. The company's core offering, the Dragos Platform, is built to give security teams visibility into industrial control system (ICS) networks, detect threats specific to those environments, and guide incident response [Perplexity Sonar Pro Brief]. The product's differentiation rests on its focus on industrial protocols and processes, which the company states are often missed by traditional IT security tools [Perplexity Sonar Pro Brief]. The platform is tailored for environments using SCADA, DCS, and other industrial systems across sectors like electric utilities, oil and gas, manufacturing, and water [Perplexity Sonar Pro Brief, Dragos].

On top of the core monitoring and detection engine, Dragos bundles two key intelligence services. WorldView is a subscription threat intelligence feed described as "powered by the largest OT dataset in the industry" [Dragos]. It provides reports on adversary activity, vulnerabilities, and indicators of compromise specific to industrial environments [Dragos, Business Wire, 2019]. Separately, Neighborhood Keeper is an opt-in, anonymized information-sharing network that allows participants to see aggregated threat analytics and vulnerability prevalence across the community without revealing their own data [Dragos, Medium, 2026]. This service has been adopted by entities like the U.S. Department of Energy for collaborative defense [Medium, 2026, Enterprise Times, 2022]. The company also offers professional services for incident response and preparedness, rounding out a full-service OT security practice [Perplexity Sonar Pro Brief].

From a technical perspective, the platform's architecture is built to collect and analyze network traffic and asset data from industrial floors. The company emphasizes "high-confidence, contextualized alerts" and "guided investigation workflows" that incorporate expert playbooks to reduce response times [Dragos]. While the underlying tech stack is not detailed in public materials, job postings suggest a reliance on modern, scalable data processing and cloud infrastructure (inferred from job postings). The product's effectiveness is externally validated by its consecutive placements as a Leader in the Gartner Magic Quadrant for Cyber-Physical Systems (CPS) Protection Platforms in 2025 and 2026 [Dragos].

Data Accuracy: GREEN -- Product details and intelligence services are confirmed by the company's website and multiple press releases. Technical inferences are based on public job descriptions.

Market Research

PUBLIC The security of operational technology has moved from a niche concern to a central pillar of national security and economic resilience, driven by a visible increase in targeted attacks on critical infrastructure. This shift is reflected in the market's rapid growth and the strategic alignment of investors, including industrial automation giants and sovereign wealth funds, behind specialized OT security platforms.

Quantifying the total addressable market for OT cybersecurity is challenging due to the fragmented nature of industrial sectors and the nascency of dedicated budget lines. Analysts often cite broader industrial cybersecurity or critical infrastructure protection markets as proxies. One report positions the global market for industrial cybersecurity at $20.4 billion in 2023, projected to reach $32.1 billion by 2028 [marketsandmarkets.com, 2026]. Another source estimates the operational technology security market at $15.2 billion in 2024, growing to $32.5 billion by 2029 [CB Insights, 2026]. While these figures encompass hardware, software, and services across all industrial sectors, they provide a useful analog for the scale of the opportunity Dragos addresses.

Industrial Cybersecurity 2023 | 20.4 | $B
Industrial Cybersecurity 2028 | 32.1 | $B
OT Security 2024 | 15.2 | $B
OT Security 2029 | 32.5 | $B

The projected growth rates, averaging in the low double-digit annual percentages, signal sustained investment tailwinds rather than a transient spike. This growth is underpinned by several concrete demand drivers cited in industry coverage. The convergence of IT and OT networks, accelerated by digital transformation initiatives, expands the attack surface and creates visibility gaps that traditional IT security tools cannot address [Perplexity Sonar Pro Brief]. Geopolitical tensions have elevated the frequency and sophistication of state-sponsored attacks targeting energy, water, and manufacturing assets, making defensive capabilities a board-level priority [Business Insider, Nov. 2020]. Furthermore, regulatory pressure is mounting globally, with standards like the U.S. TSA Security Directives for pipelines and rail, NERC CIP for electric utilities, and emerging frameworks in Europe mandating specific OT security controls and reporting.

Adjacent and substitute markets illustrate both the scope of the opportunity and the competitive landscape. The broader cybersecurity market, valued in the hundreds of billions, represents a vast pool of security spending that is beginning to allocate funds to OT-specific solutions. The industrial automation and control system market itself, a multi-hundred-billion-dollar industry, is a primary customer base and a source of strategic partners, as evidenced by Rockwell Automation's lead investment in Dragos's Series C [Perplexity Sonar Pro Brief]. Substitute approaches include managed security services for OT, internal security team expansion, and the retrofitting of IT-centric extended detection and response (XDR) platforms. However, the specialized knowledge of industrial protocols, process behavior, and adversary tactics required for effective OT defense creates a high barrier, favoring native platforms built specifically for this environment.

The analyst takeaway from the available sizing data is that while precise segmentation for pure-play OT platform vendors like Dragos is not publicly detailed, the overarching market is large, growing, and supported by irreversible macro trends. The company's positioning within the more narrowly defined CPS Protection Platforms segment, where Gartner recognizes it as a Leader [Dragos], suggests it is competing for a substantial portion of the software-defined spend within these broader analog markets.

Data Accuracy: YELLOW -- Market sizing figures are drawn from third-party analyst reports, but specific TAM/SAM/SOM for Dragos's exact product category is not publicly broken out.

Competitive Landscape

MIXED Dragos occupies a defined niche within industrial cybersecurity, competing with specialists that focus on operational technology (OT) and industrial control systems (ICS) rather than general-purpose IT security vendors.

Company	Positioning	Stage / Funding	Notable Differentiator	Source
Dragos	OT/ICS cybersecurity platform with threat intelligence (WorldView) and community intelligence (Neighborhood Keeper)	Series D+ / ~$439M	Practitioner-founded; deep focus on critical infrastructure sectors; Gartner Magic Quadrant Leader for CPS Protection Platforms	[Dragos, 2026], [CB Insights, 2026]
Claroty	OT security platform with asset discovery, vulnerability management, and threat detection	Late-stage venture	Strong IT/OT convergence focus; integration partnerships with major IT security vendors	[Crunchbase]
Nozomi Networks	OT & IoT security and visibility platform	Late-stage venture	Emphasis on AI-powered anomaly detection and real-time ICS monitoring	[Crunchbase]
Armis	Agentless asset intelligence and security platform for IT, OT, IoT, and IoMT	Acquired (2023)	Broad device coverage across IT and OT; strong enterprise sales motion	[Crunchbase]
Forescout	NAC and device visibility platform with OT/IoT modules	Public (acquired by Advent, 2023)	Legacy strength in network access control (NAC) and policy enforcement	[Crunchbase]

The competitive map for industrial cybersecurity is segmented. At the top are dedicated OT specialists like Dragos, Claroty, and Nozomi Networks, which have built their platforms from the ground up for industrial protocols and environments. These companies compete directly on core capabilities like passive asset discovery, network monitoring, and threat detection for ICS. A second tier includes established IT security vendors that have expanded into OT, such as Microsoft (via its Defender for IoT and acquired CyberX assets) and Tenable (with its OT security module). These players use their massive existing enterprise footprints but often face integration and depth-of-expertise challenges. A third, adjacent group includes industrial automation incumbents like Siemens and Schneider Electric, which embed security features into their own hardware and software stacks, potentially acting as partners or channel competitors.

Dragos's defensible edge today appears anchored in founder credibility and a community-driven intelligence layer. The company's materials consistently emphasize its founding team's deep practitioner experience in ICS security incidents, which resonates in a risk-averse, compliance-heavy sector [Dragos, 2026]. Its Neighborhood Keeper initiative, an anonymized threat-sharing network, represents a strategic asset that could create a network effect among critical infrastructure operators, a moat that is difficult for a new entrant to replicate quickly [Dragos]. Furthermore, its recognition as a Leader in the Gartner Magic Quadrant for CPS Protection Platforms for two consecutive years provides a significant validation signal for procurement committees [Dragos, 2026]. This combination of expert brand, community intelligence, and analyst validation forms a durable, though not impenetrable, competitive position.

The company's exposure lies in two areas: breadth of platform and channel reach. Competitors like Armis and Forescout, while sometimes less specialized in OT, offer unified platforms that cover IT, IoT, and medical devices alongside OT, which can simplify procurement for organizations seeking a single vendor for asset visibility [Crunchbase]. Dragos's focus is its strength but could also be a limitation in accounts prioritizing consolidation. Secondly, while Dragos has strategic investors like Rockwell Automation and Schneider Electric, its direct sales channel may face pressure from competitors with deeper embedded relationships or broader global system integrator partnerships. The company's high-conviction, high-touch sales model must consistently prove its superior depth to justify a potentially standalone purchase decision.

The most plausible 18-month scenario involves continued market segmentation, with winners and losers defined by execution in specific verticals. The winner in this period will likely be the company that most effectively converts regulatory tailwinds (like mandates from TSA, CISA, and NERC CIP) into hardened, sector-specific compliance workflows. A loser could emerge if a major IT security platform (e.g., Microsoft) decides to bundle or deeply discount its OT module, applying pricing pressure that forces specialists to compete more on cost than on specialized capability. For Dragos, maintaining its leadership position hinges on deepening its intelligence advantage through Neighborhood Keeper and proving that its platform's investigative workflows tangibly reduce operational risk and compliance burden better than any integrated suite.

Data Accuracy: GREEN -- Competitor identities and basic positioning are public knowledge; Dragos's differentiators are sourced from company materials and analyst reports.

Opportunity

PUBLIC Dragos's opportunity is to become the default security layer for the world's industrial control systems, a position that would be both defensible and extraordinarily valuable given the critical nature of the assets it protects.

The headline opportunity is to evolve from a point solution into the category-defining platform for operational technology (OT) cybersecurity. The company's own materials frame its mission as "to safeguard civilization" by protecting critical infrastructure [dragos.com]. This is not marketing hyperbole but a reflection of the wedge: as industrial environments digitize and converge with IT networks, they become exposed to threats that traditional IT security tools cannot see or stop. Dragos's platform is built specifically for ICS, SCADA, and DCS environments, giving it a technical head start [Perplexity Sonar Pro Brief]. Its recognition as a Leader in the Gartner Magic Quadrant for CPS Protection Platforms in both 2025 and 2026 provides third-party validation of its platform approach [Dragos]. The outcome is reachable because the need is non-discretionary; a successful attack on a power grid or water treatment facility carries catastrophic physical consequences, creating a powerful buying imperative.

Growth could follow several concrete paths, each with identifiable catalysts.

Scenario	What happens	Catalyst	Why it's plausible
Strategic Standardization	Dragos becomes the mandated or de facto standard within a major industrial vertical (e.g., electric utilities).	A landmark partnership or investment from a sector regulator or a dominant industrial conglomerate.	The company already counts strategic investors like Rockwell Automation (industrial automation) and Schneider Electric (energy management) [Perplexity Sonar Pro Brief]. These relationships provide a channel to influence industry standards.
Intelligence Network Dominance	Neighborhood Keeper, its anonymized threat-sharing network, achieves critical mass, making participation a necessity for any serious operator.	Major government mandates or incentives for critical infrastructure operators to join such networks.	The platform already allows Department of Energy analysts to view aggregated threat data, demonstrating government buy-in [enterprisetimes.co.uk, 2022]. Its community-driven intelligence model is a key differentiator [Medium, 2026].
Platform Ecosystem Expansion	Dragos's platform becomes the foundational layer upon which other industrial software vendors build security features.	The launch of a public API or marketplace that allows third-party developers to integrate.	The company's WorldView threat intelligence is already integrated into the Anomali Threat Platform, showing an existing ecosystem mindset [Business Wire, 2019]. The platform's comprehensive data collection is designed to power extended applications [dragos.com].

Compounding for Dragos looks like a data and expertise flywheel. Each new industrial customer deployment adds unique asset fingerprints and threat telemetry to the platform's dataset. This enriched data improves the accuracy of WorldView threat intelligence reports and makes the platform's detection algorithms more precise. Superior detection and intelligence, in turn, attract more customers, especially within the same industrial vertical where threats are similar. This cycle is already evident: the company claims WorldView is powered by "the largest OT dataset in the industry" [Dragos], and its platform is noted for delivering "high-confidence, contextualized alerts" that cut through noise [dragos.com]. The more assets Dragos protects, the smarter and more indispensable its platform becomes.

The size of the win, should Dragos secure a dominant platform position, is substantial. While a direct public comparable is limited, the company's own trajectory offers a benchmark. It reached a $1.7 billion valuation in 2023, reportedly on $154.4 million in revenue the following year [getlatka.com, 2026]. For context, Claroty, a direct competitor, was reportedly seeking a valuation of around $2 billion during its 2024 fundraise [Reuters, 2024]. The broader industrial cybersecurity market is projected to grow significantly, though specific TAM figures are not publicly confirmed in the cited research. If Dragos can execute on a strategic standardization scenario within, for example, North American electric utilities,a sector with multi-billion dollar capital budgets,its potential enterprise value could be a multiple of its current figure (scenario, not a forecast). The premium would be justified by the recurring, mission-critical nature of its software and the high switching costs associated with entrenching a platform deep within operational networks.

Data Accuracy: YELLOW -- The core opportunity thesis is supported by company statements and analyst reports, but specific market size projections and some growth catalysts lack multiple independent corroboration.

Sources