Dragos Overview
Dragos is the largest independent specialist in cybersecurity for operational technology (OT), the control systems that run power grids, pipelines, water utilities, factories and semiconductor fabs. Its practitioner founders came from the U.S. intelligence community and U.S. Air Force. They built the company around a three-part model: a passive network-monitoring software platform, an OT-specific threat intelligence service, and an incident response and professional services practice. The model rests on a data advantage. Dragos tracks 26 OT-focused threat groups and runs what it calls the Intelligence Fabric, which takes in more than five petabytes of OT telemetry a day across more than 600 industrial protocols. Gartner named Dragos a Leader in the first two editions of its Magic Quadrant for Cyber-Physical Systems Protection Platforms (2025 and 2026). In 2026 the company bought three businesses (Phosphorus, NetRise, runZero) to widen its scope from classic OT to "xOT", the extended operational environment, and Accenture took a majority stake at a USD 3.25 billion valuation. In semiconductor manufacturing, Dragos sells to fabs and fab-infrastructure operators as part of its manufacturing vertical. It secures tool networks, facility systems and the industrial networks behind wafer production.
What the company does
Dragos sells cybersecurity technology and services built for industrial control systems (ICS) and OT environments. These environments differ from corporate IT in ways that shape the product. Assets such as programmable logic controllers (PLCs), remote terminal units (RTUs), human-machine interfaces (HMIs), distributed control systems, safety instrumented systems and the PCs that control fab tools often run for 15–30 years. They use industrial protocols (Modbus, DNP3, EtherNet/IP, OPC UA, SECS/GEM in semiconductor fabs and many others). They usually cannot be patched or rebooted on IT timelines, and they control physical processes where a mistake can mean downtime, equipment damage or a safety incident. Dragos's main product, the Dragos Platform, passively monitors industrial network traffic to build an asset inventory, assess vulnerabilities in OT context, detect threat behaviour, and support investigation and response, without disturbing the process.
The company describes itself as providing OT cybersecurity technology for industrial and critical infrastructure in pursuit of its mission "to safeguard civilization." It says the platform discovers and monitors OT, IT, IoT and IIoT assets within the OT environment and integrates with IT security infrastructure. Its customers span electric, oil and gas, manufacturing, water, transportation, mining and government.
Business model and revenue model
| Revenue stream | Nature | Pricing model |
|---|---|---|
| Dragos Platform (software) | Term subscription software deployed on-premises, hybrid, or as SaaS on Microsoft Azure from Q1 2026 | Recurring subscription, typically scaled by sites, sensors and monitored assets; Platform 3.0 added lower-cost options for small sites |
| Threat intelligence (WorldView) | Subscription OT threat intelligence: reports, indicators, adversary profiles, vulnerability analysis | Recurring subscription |
| Services | Incident response retainers, architecture reviews, compromise assessments, penetration testing, tabletop exercises, training, and OT Watch managed threat hunting | Mix of retainers (recurring) and project fees (non-recurring) |
| xOT extensions (from 2026) | Phosphorus (connected-device discovery and remediation), runZero (exposure management and asset discovery), NetRise (firmware and software supply-chain analysis) | Subscription |
Dragos has three revenue streams, plus a fourth added in 2026:
Dragos Platform (software): Nature: Term subscription software deployed on-premises, hybrid, or as SaaS on Microsoft Azure from Q1 2026; Pricing model: Recurring subscription, typically scaled by sites, sensors and monitored assets; Platform 3.0 added lower-cost options for small sites
Threat intelligence (WorldView): Nature: Subscription OT threat intelligence: reports, indicators, adversary profiles, vulnerability analysis; Pricing model: Recurring subscription
Services: Nature: Incident response retainers, architecture reviews, compromise assessments, penetration testing, tabletop exercises, training, and OT Watch managed threat hunting; Pricing model: Mix of retainers (recurring) and project fees (non-recurring)
xOT extensions (from 2026): Nature: Phosphorus (connected-device discovery and remediation), runZero (exposure management and asset discovery), NetRise (firmware and software supply-chain analysis); Pricing model: Subscription
Dragos does not publish its split between product, subscription and services revenue. Accenture's choice to report the combined business on an ARR basis (USD 208 million, June 2026) shows that recurring subscription revenue now makes up most of the economics. Services are strategically important beyond their revenue: Dragos says its platform's strength comes from codifying its threat intelligence and the insights of its services team into the software. Incident response work produces the adversary knowledge that feeds the detection content.
Value-chain position
Dragos sits between industrial asset owners, the automation vendors that build their equipment (Rockwell Automation, Yokogawa, Emerson, Schneider Electric and others), and the IT security stack (SIEM, SOAR, endpoint detection). It is deliberately vendor-neutral. It does not make controllers or fab equipment and does not favour one automation brand, and it says it will keep that neutrality under Accenture ownership. Its most important integrations run into IT security platforms, notably Microsoft Sentinel, CrowdStrike and Splunk. These let OT detections reach the enterprise security operations centre.
Customer types and end-markets
| End-market | Typical OT assets protected | Strategic note |
|---|---|---|
| Electric utilities (generation, transmission, distribution) | SCADA, substations, energy management systems, battery storage | Historic core vertical; supported by NERC CIP compliance needs |
| Oil and gas (upstream, midstream, downstream) | Pipelines, refineries, compressor stations | TSA pipeline directives drive demand |
| Manufacturing (discrete, process, semiconductors, pharma, food and beverage, chemicals) | Production lines, robotics, fab tool networks, facility systems | Manufacturing accounted for more than two-thirds of the industrial ransomware victims Dragos recorded in 2025 |
| Water and wastewater | Treatment plants, pumping stations | Served partly through free community-defense programmes for small utilities |
| Transportation and logistics | Rail signalling, ports, distribution centres | — |
| Mining and metals | Process control, autonomous haulage | Strong in Australia |
| Data centres | Power, cooling and building management systems | Named by Accenture as a target market |
| Government and defense | Federal facilities, defense industrial base | Addressed from October 2026 through the Dragos Public Sector subsidiary |
Electric utilities (generation, transmission, distribution): Typical OT assets protected: SCADA, substations, energy management systems, battery storage; Strategic note: Historic core vertical; supported by NERC CIP compliance needs
Oil and gas (upstream, midstream, downstream): Typical OT assets protected: Pipelines, refineries, compressor stations; Strategic note: TSA pipeline directives drive demand
- Manufacturing (discrete, process, semiconductors, pharma, food and beverage, chemicals) — Typical OT assets protected: Production lines, robotics, fab tool networks, facility systems; Strategic note: Manufacturing accounted for more than two-thirds of the industrial ransomware victims Dragos recorded in 2025
Water and wastewater: Typical OT assets protected: Treatment plants, pumping stations; Strategic note: Served partly through free community-defense programmes for small utilities
Transportation and logistics: Typical OT assets protected: Rail signalling, ports, distribution centres; Strategic note: —
Mining and metals: Typical OT assets protected: Process control, autonomous haulage; Strategic note: Strong in Australia
Data centres: Typical OT assets protected: Power, cooling and building management systems; Strategic note: Named by Accenture as a target market
Government and defense: Typical OT assets protected: Federal facilities, defense industrial base; Strategic note: Addressed from October 2026 through the Dragos Public Sector subsidiary
In September 2023 the company said its customer base was about 400 organizations and governments. A distributor in Japan later described more than 400 customers across 11 industries in 20 regions. No more recent customer count has been published.
Semiconductor manufacturing ecosystem
Semiconductor fabs are among the most OT-intensive and downtime-sensitive industrial settings. A modern fab runs thousands of process tools, each controlled by embedded or Windows-based equipment PCs. Around them sit automated material handling systems, manufacturing execution systems, and facility systems for cleanroom air, ultra-pure water, specialty gases and power. Many tool PCs run legacy operating systems that cannot be patched without re-qualifying the tool. The industry's best-known OT incident shows the stakes: in August 2018 a WannaCry variant spread through tool installs at TSMC and halted several fabs, and the company estimated the impact at roughly 3% of its third-quarter 2018 revenue.
The industry has since built its own standards. SEMI E187 (Specification for Cybersecurity of Fab Equipment, published January 2022, developed by a task force led by TSMC and ITRI) and SEMI E188 (malware-free equipment integration) set baseline requirements. In August 2025 SEMI and the Semiconductor Manufacturing Cybersecurity Consortium (SMCC) published E187 compliance guidance. Dragos addresses fabs through its manufacturing practice. The platform's passive monitoring, asset inventory and OT vulnerability prioritization fit fabs, where scanning a tool network can disrupt production. Phosphorus (device remediation), runZero (asset and exposure discovery) and NetRise (binary-level firmware analysis of equipment software) extend this into supplier software and firmware risk, the problem E187 and E188 address. Dragos does not report semiconductor revenue separately.
Independent characterization
Dragos is an intelligence-led OT security software company. Its moat comes less from sensor technology, which several rivals now match, and more from its proprietary adversary data, its reputation as first responder in high-profile ICS incidents, and its standing with regulators and governments. Its weak points are scale against well-capitalised generalists (Palo Alto Networks, Fortinet, Microsoft, Cisco) and against rivals now owned by large strategic buyers (ServiceNow with Armis, Mitsubishi Electric with Nozomi Networks). The Accenture deal gives Dragos a distribution channel and capital base matching those combinations, at the cost of independent control.
Strategy
Stated strategy
Dragos's strategy rests on four themes found in its press releases, CEO communications and the Accenture announcement:
-
OT-native, intelligence-led defense. Dragos argues that OT security must be built for OT rather than adapted from IT tools. Its detections, vulnerability scoring and guidance come from its own adversary tracking and frontline incident response. Its 2026 Year in Review supports the message with data: 25% of ICS advisories carried incorrect CVSS scores, and only 2% of ICS-relevant vulnerabilities warranted "Now" priority.
-
From OT to xOT. The 2026 acquisitions widen the platform from the classic ICS network to the "extended operational technology" environment: connected devices, exposed assets outside monitored networks, and the firmware and software supply chain. Lee describes the aim as "the industry's first end-to-end xOT cybersecurity platform."
-
Vendor neutrality and independence. Dragos stresses that it takes no side among automation vendors. In his September 2026 letter Lee described the goal as building "an independent, 100+ year company." He said Accenture was chosen as majority investor because it shares that view while providing global reach.
-
AI grounded in proprietary data. Platform 3.0's AI-assisted vulnerability work and EmberAI's natural-language analyst assistant both rest on the Intelligence Fabric. Dragos keeps customer data inside customer-controlled deployments, setting itself apart from vendors that send operational telemetry to cloud-hosted global models.
Strategic initiatives, last 24 months
| Initiative | Date | Description | Strategic intent |
|---|---|---|---|
| Executive team build-out for scale | November 2024 – January 2026 | New CFO with IPO experience, CMO, CSO, CRO and Chief People Officer | Public-company readiness; go-to-market scale |
| Yokogawa global partnership | January 2025 | Joint OT cybersecurity offering with a major automation vendor | Reach into process-industry installed base, especially in Asia |
| OT Security Financial Risk Report | August 2025 | Quantifies over USD 300 billion of potential OT cyber exposure | Moves OT security into CFO and insurer conversations |
| Platform 3.0 | September 2025 | Insights Hub, AI vulnerability processing, small-site options | Faster time-to-value; mid-market and distributed-site coverage |
| Microsoft collaboration expansion | February 2026 | SaaS on Azure, Sentinel integration, Marketplace listing | Cloud delivery; procurement via Microsoft committed spend |
| Phosphorus acquisition | June 2026 | Connected-device discovery and remediation | First step into xOT; TAM raised to more than USD 50 billion |
| Accenture majority investment | Announced June 2026; closed September 2026 | Capital, global services and distribution | Scale against consolidated competitors |
| EmberAI | June 2026 | OT-native AI assistant | Eases the OT skills shortage; product differentiation |
| NetRise and runZero acquisitions | Closed July and September 2026 | Firmware and supply-chain analysis; exposure management | Completes the xOT platform |
| R&D-led hiring | From September 2026 | More than 100 open roles, mostly R&D, with hundreds more planned | Faster platform integration and innovation |
| Dragos Public Sector | Board constituted October 2026 | U.S. federal subsidiary, sold with Accenture Federal Services and Carahsoft | Federal market access under CISA BOD 26-04 and OMB M-26-14 timelines |
Executive team build-out for scale: Date: November 2024 – January 2026; Description: New CFO with IPO experience, CMO, CSO, CRO and Chief People Officer; Strategic intent: Public-company readiness; go-to-market scale
Yokogawa global partnership: Date: January 2025; Description: Joint OT cybersecurity offering with a major automation vendor; Strategic intent: Reach into process-industry installed base, especially in Asia
OT Security Financial Risk Report: Date: August 2025; Description: Quantifies over USD 300 billion of potential OT cyber exposure; Strategic intent: Moves OT security into CFO and insurer conversations
Platform 3.0: Date: September 2025; Description: Insights Hub, AI vulnerability processing, small-site options; Strategic intent: Faster time-to-value; mid-market and distributed-site coverage
Microsoft collaboration expansion: Date: February 2026; Description: SaaS on Azure, Sentinel integration, Marketplace listing; Strategic intent: Cloud delivery; procurement via Microsoft committed spend
Phosphorus acquisition: Date: June 2026; Description: Connected-device discovery and remediation; Strategic intent: First step into xOT; TAM raised to more than USD 50 billion
Accenture majority investment: Date: Announced June 2026; closed September 2026; Description: Capital, global services and distribution; Strategic intent: Scale against consolidated competitors
EmberAI: Date: June 2026; Description: OT-native AI assistant; Strategic intent: Eases the OT skills shortage; product differentiation
NetRise and runZero acquisitions: Date: Closed July and September 2026; Description: Firmware and supply-chain analysis; exposure management; Strategic intent: Completes the xOT platform
R&D-led hiring: Date: From September 2026; Description: More than 100 open roles, mostly R&D, with hundreds more planned; Strategic intent: Faster platform integration and innovation
Dragos Public Sector: Date: Board constituted October 2026; Description: U.S. federal subsidiary, sold with Accenture Federal Services and Carahsoft; Strategic intent: Federal market access under CISA BOD 26-04 and OMB M-26-14 timelines
Sustainability commitments
Dragos has not published emissions targets. Its mission-linked commitments are its free community resources (OT-CERT, Neighborhood Keeper, public threat reporting and support for small utilities).
Medium-term targets
Dragos has given no public revenue, margin or profitability guidance. Before the Accenture deal, management spoke of an eventual IPO or Series E. Accenture's guidance covers only the deal's EPS effect: dilutive at first, then accretive.
Products & Services
Dragos Platform (core software)
| Attribute | Detail |
|---|---|
| Description | Passive, OT-native network monitoring that builds a full inventory of industrial assets and communications, assesses vulnerabilities in operational context, and detects adversary behaviour using threat-behaviour analytics written by Dragos intelligence analysts |
| Key capabilities | Asset identification and classification; protocol-aware deep packet inspection across hundreds of industrial protocols; vulnerability management with "Now / Next / Never" prioritization; threat detection mapped to known OT adversaries; playbook-driven investigation; integration with SIEM/SOAR/EDR |
| Latest major version | Platform 3.0, released September 23, 2025 |
| Deployment | On-premises, hybrid and, from Q1 2026, SaaS on Microsoft Azure; lighter sensors for remote and intermittently connected sites |
| Target customer | Asset owners in electric, oil and gas, manufacturing (including semiconductors), water, mining, transportation and government |
| Pricing | Subscription; Platform 3.0 introduced new cost models for smaller sites. List prices are not published |
| Component | Description |
|---|---|
| Insights Hub | A single prioritized view that combines risk-based vulnerability, asset and threat alerts, with recommendations written by OT experts on where to start and what to do next |
| AI-enhanced vulnerability processing | AI models used behind the scenes by the vulnerability intelligence team to speed data normalization and the delivery of OT-contextualized vulnerability analysis |
| Redesigned UI and workflows | New user experience meant to cut time-to-value and analyst workload |
| Small-site deployment options | Smaller device footprints and flexible deployment and cost models, so remote, small or intermittently connected sites can feed centralized visibility |
Dragos EmberAI (launched June 23, 2026)
| Attribute | Detail |
|---|---|
| Description | An OT-native AI assistant inside the Dragos Platform. Analysts query their environment in natural language and get answers grounded in Dragos intelligence |
| Foundation | The Dragos Intelligence Fabric: more than ten years of adversary tracking, incident response, vulnerability research, more than 600 OT protocols, and more than five petabytes of daily OT telemetry |
| Capabilities | Intelligence-driven query engine; correlation across assets, vulnerabilities, threat intelligence and network activity; adversary-informed guidance; workflow automation for alert triage, incident summaries and reporting; a forthcoming library of expert-built investigation workflows |
| Data handling | Runs inside the customer's own Dragos Platform deployment, so customer data does not go to external AI models; recommendations are transparent and auditable, and the analyst stays in control |
| Availability | Generally available inside the Dragos Platform since June 2026 |
Network visibility and compliance (NP-View, from Network Perception)
| Attribute | Detail |
|---|---|
| Description | Offline analysis of network device configurations to map OT topology, analyze access paths and evaluate firewall rules |
| Capabilities | Topology mapping; sensor placement planning; mapping vulnerabilities to attack paths; configuration and policy drift detection; segmentation validation |
| Compliance | Continuous compliance checks and evidence for NERC CIP (including CIP-003 and CIP-005 network access requirements) and TSA directives; Dragos also produces documentation for NIS2 |
| Target customer | Originally the North American electric sector; now offered to oil and gas, manufacturing and other industries worldwide |
Connected-device security (Phosphorus)
| Attribute | Detail |
|---|---|
| Description | Discovery and active remediation for the connected devices spread through operational sites: IP cameras, smart sensors, building systems, network appliances and IoT components |
| Capabilities | Automated device discovery; firmware update automation; credential management, including rotating default passwords; remediation workflows |
| Customer continuity | Existing Phosphorus customers remain fully supported and gain access to wider Dragos offerings as integration proceeds |
Exposure management (runZero)
| Attribute | Detail |
|---|---|
| Description | Asset discovery and exposure management across IT, IoT and OT that combines asset and risk intelligence from any source into one view |
| Founder significance | Led by HD Moore, creator of Metasploit |
| Role in the xOT platform | Finds assets outside sensor-monitored OT networks and adds attack-surface intelligence |
Firmware and software supply-chain security (NetRise)
| Attribute | Detail |
|---|---|
| Description | Binary-level analysis of the compiled software and firmware running on operational devices, plus a proprietary software supply-chain dataset |
| Role in the xOT platform | Firmware-level visibility into device exposure, relevant to equipment-supplier risk in sectors such as semiconductors, where tool software arrives from many vendors |
Threat intelligence
| Offering | Description |
|---|---|
| Dragos WorldView | Subscription OT threat intelligence: adversary reports, indicators of compromise, vulnerability advisories with corrected risk scoring, and industry-specific briefings |
| OT/ICS Cybersecurity Year in Review | Annual flagship report. The 2026 edition (February 17, 2026) recorded 119 ransomware groups hitting industrial organizations in 2025 (up from 80), about 3,300 affected organizations, and 26 tracked OT threat groups, 11 of them active in 2025 |
| Neighborhood Keeper | Opt-in, anonymized community network for sharing threat intelligence across participating organizations |
| OT Security Financial Risk Report | Quantifies financial exposure to OT cyber events; the August 2025 edition estimated over USD 300 billion of potential global exposure |
Services
| Service | Description |
|---|---|
| Incident response and retainers | Emergency response to OT intrusions and ransomware; retainers guarantee response times |
| Architecture reviews | Assessment of OT network design, segmentation and remote access |
| Compromise assessments | Hunting for evidence of past or current intrusion in OT environments |
| Tabletop exercises | Scenario exercises for operations, security and executive teams |
| Penetration testing and threat assessments | Adversary emulation tailored to industrial environments |
| OT Watch | Managed threat hunting by Dragos analysts on the customer's platform data |
| Training (Dragos Academy) | Courses for ICS/OT defenders |
Community and free programmes
| Programme | Description |
|---|---|
| Dragos OT-CERT | Free cybersecurity resources for industrial asset owners and operators, aimed at the OT resource gap; coordinates CVE disclosure as Dragos's CNA function |
| Community defense support | Free resources and support for under-resourced utilities and operators |
Financial Narrative
Dragos has never filed public financial statements. It has no listed securities, and Accenture does not report it as a separate segment. Revenue, gross profit, operating income, EBITDA, net income, EPS, dividends, balance-sheet items, cash flows and the standard return and leverage ratios have not been published for any year. The figures that do exist are recurring revenue, capital raised, valuations and headcount. They are set out below with commentary.
Recurring revenue
At 53%, growth in the combined business was well above the broader OT security market's roughly 16% CAGR projected by MarketsandMarkets for Accenture. Part of the growth will reflect the faster expansion of the smaller acquired businesses, so Dragos's organic growth may differ. Growth history gives some context. In mid-2023 Lee told staff Dragos had kept growing more than 100% a year before missing its first-quarter 2023 targets. The miss came as sales cycles lengthened and new customers cut initial deployment sizes. Growth of about 53% combined three years later suggests a recovery to strong, but no longer triple-digit, growth.
Equity capital raised
Cumulative primary funding before Accenture was about USD 432 million. Some trackers give up to USD 439 million, depending on how they count small strategic tranches. Lee said in 2021 that the Series D should be the last round needed before going public. The 2023 extension, Lee said, was raised as equity for operational flexibility.
Valuation markers
The 2021 figure is the Series D post-money valuation. The 2026 figure is the enterprise value at which Accenture bought its majority stake. Canaan Partners, a longtime investor, described Accenture's commitment for the majority stake as USD 3.2 billion. The combined three-company enterprise value of about USD 4.175 billion against USD 208 million of combined ARR implies about 20x EV/ARR. That is a premium to Mitsubishi Electric's purchase of Nozomi Networks and roughly in line with ServiceNow's USD 7.75 billion purchase of Armis (about 23x Armis's USD 340 million ARR).
The 2018 figure is the "more than 90" Lee cited at the Series B. The 2023 figure is implied by the June 2023 layoff of 50 employees, described as about 9% of the workforce. The 2026 figure is from Accenture's June 2026 announcement. Headcount grew only about 5% from mid-2023 to mid-2026 while recurring revenue grew sharply. That points to large operating leverage gains after the 2023 restructuring. With runZero (66) and NetRise (57) included, the group had more than 700 employees at closing. After closing, Dragos said it had more than 100 open positions, mostly in R&D, with "hundreds more to come."
Accenture's financial framing
Accenture said the transactions would dilute its earnings per share at first, then add to EPS and free cash flow over time. Accenture's cybersecurity business generated about USD 10 billion of revenue in fiscal 2025, so the acquired ARR adds only about 2% to that franchise. The deal's value to Accenture is strategic: it gains a proprietary software platform it can bundle with services, which consulting firms rarely own.
Ratio analysis
ROE, ROA, ROIC, liquidity, leverage, interest coverage, asset turnover and cash conversion cycle cannot be computed because no balance sheet or income statement has been published. In the 2023 layoff memo, Lee said salaries plus benefits were more than nine times the next-largest expense line. That cost structure is typical of software firms, where operating margins depend mainly on headcount productivity.
Unlock Company Financials
Unlock this company profile to view its financial data.
View Subscription PlansFinancial Detail
Business Units
| Unit | What it contains | Principal offerings | Status |
|---|---|---|---|
Dragos Platform | Core OT monitoring software | Asset visibility, vulnerability management, threat detection, investigation and response, Insights Hub, EmberAI, NP-View capabilities | Core since 2016 |
Threat Intelligence | Adversary research, vulnerability intelligence, reporting | WorldView subscriptions, annual OT/ICS Year in Review, Neighborhood Keeper | Core since founding |
Services | Professional services and managed services | Incident response and retainers, architecture reviews, compromise assessments, tabletop exercises, OT Watch, training | Core since founding |
Network Perception | Network architecture security | NP-View topology mapping, firewall rule analysis, segmentation validation, NERC CIP/TSA compliance evidence | Acquired October 2024; integrated into the platform |
Phosphorus | Connected-device security | Device discovery, firmware update automation, credential rotation, remediation workflows | Acquired June 2026; run as a business unit under General Manager Sonu Shankar during phased integration |
runZero | Exposure management | Asset discovery and exposure assessment across IT, IoT and OT; attack-surface intelligence | Acquired (closed September 17, 2026); led by HD Moore |
NetRise | Firmware and software supply-chain security | Binary-level analysis of firmware and compiled software, software bill-of-materials generation, supply-chain risk dataset | Acquired (closed July 31, 2026); led by Thomas Pace and Michael Scott |
Dragos Public Sector (DPS) | U.S. government subsidiary | Dragos technology and services for federal civilian, defense, law enforcement and intelligence agencies | Board constituted October 2026; GM Daniel Dorchinsky |
Revenue by Segment
| Metric | 2025 | 2026 |
|---|---|---|
Combined ARR, Dragos + runZero + NetRise, June (USD Mn) | 136 | 208 |
Unlock Company Financials
Unlock this company profile to view its financial data.
View Subscription PlansKey Financials and Margin Analysis (%)
| Metric | 2025 | 2026 |
|---|---|---|
Combined ARR, Dragos + runZero + NetRise, June (USD Mn) | 136 | 208 |
Combined ARR growth YoY (%) | — | 53 |
Balance Sheet
| Metric | 2016 | 2017 | 2018 | 2020 | 2021 | 2023 |
|---|---|---|---|---|---|---|
Primary equity raised (USD Mn) | 1.2 | 10 | 37 | 110 | 200 | 74 |
Key Financials
| Metric | 2021 | 2026 |
|---|---|---|
Dragos valuation (USD Mn) | 1,700 | 3,250 |
Financial Analysis
| Metric | 2018 | 2023 | 2026 |
|---|---|---|---|
Dragos employees | 90 | 555 | 580 |
Region Overview
| Region | Presence | Demand drivers | Assessment |
|---|---|---|---|
North America | Headquarters (Hanover, MD), Houston, Austin (runZero, NetRise), Canada; federal subsidiary | NERC CIP, TSA pipeline directives, CISA directives, federal OT mandates | Largest region; Dragos's earliest customers were North American electric utilities |
EMEA | United Kingdom (from 2021), continental Europe, UAE / Dubai (from 2021), wider Middle East | NIS2, UK NIS regulations, Gulf national energy programmes, Saudi and UAE critical infrastructure investment | Growth region; the European Year in Review editions show a focus on European manufacturing |
APAC | Australia and New Zealand (from 2021); Japan through distributor Macnica and the Yokogawa partnership | Australia's SOCI Act, Japanese manufacturing, Asian semiconductor clusters | Growth region; most relevant to semiconductor fabs in Japan, Taiwan, Korea and Singapore |
Capital Markets Data
| Metric | 2021 | 2026 |
|---|---|---|
Valuation (USD Mn) | 1,700 | 3,250 |
Transaction Details
| Transaction | Year | Deal value (USD Mn) | ARR basis (USD Mn) | EV / ARR (x) |
|---|---|---|---|---|
Accenture – Dragos + runZero + NetRise | 2026 | 4,175 | 208 | 20.1 |
ServiceNow – Armis | 2026 | 7,750 | 340 | 22.8 |
Capital Markets
| Item | Position |
|---|---|
Dividend policy | None; growth-stage company |
Credit ratings | None; financed by equity, with Accenture as majority owner. Accenture plc is rated investment grade |
Exit path | The IPO path management discussed earlier is superseded for now by Accenture's majority ownership; the terms for any remaining minority stakes have not been published |
Analyst Conclusions
Management guidance
Dragos gives no financial guidance. Management's stated priorities are to integrate Phosphorus, NetRise and runZero into a single xOT platform; to invest the new capital mainly in R&D, with more than 100 open roles and hundreds more planned; to scale internationally through Accenture; and to build the U.S. federal business through Dragos Public Sector. Accenture expects the transactions to dilute EPS at first and add to EPS and free cash flow over time.
Growth expectations
No consensus forecasts exist for a private company. The market backdrop is a roughly 16% CAGR for OT cybersecurity through 2031. Dragos's combined growth of 53% in the year to June 2026 and the large planned hiring suggest the business is expected to keep growing well ahead of the market as Accenture distribution takes hold.
Bull case
-
Distribution step-change. Accenture's roughly 9,000 clients and its OT engineering acquisitions (Cimation, Revolutionary Security, Callisto, Electro 80, True North Solutions, SYSTEMA) give Dragos a services-led channel no other OT specialist has. That could sustain growth above 40% from a USD 208 million ARR base.
-
xOT platform breadth. runZero, NetRise and Phosphorus close the gaps rivals exploited: devices beyond monitored networks, firmware risk and active remediation. Dragos can now compete on platform breadth with Armis while keeping its intelligence edge.
-
Regulatory tailwinds. CISA BOD 26-04, OMB M-26-14, NIS2, NERC CIP, TSA directives and SEMI E187/E188 turn OT visibility from optional to mandatory. The federal subsidiary is positioned for the December 2026 deadlines.
Bear case
-
Neutrality erosion. Rival consultancies and some automation vendors may treat Dragos as an Accenture asset and steer clients to Claroty or other platforms. That would weaken the channel breadth that drove growth.
-
Integration and culture risk. Four acquisitions, a change of control, a new Chair/CEO structure and hiring of hundreds could strain a company of about 700 people. Dragos's 2023 forecast miss shows its sensitivity to execution.
-
Commoditization of visibility. If buyers treat passive OT monitoring as a feature of firewalls, SOC platforms or IT asset management (ServiceNow–Armis), pricing could compress before Dragos's intelligence and AI differentiation is monetized.
Key catalysts and monitorables (next 12 months)
| Timing | Catalyst / monitorable | What to watch |
|---|---|---|
| December 7, 2026 | CISA BOD 26-04 reaches full operation | Federal pipeline and contract awards through Dragos Public Sector and Accenture Federal Services |
| December 2026 | Accenture fiscal Q1 2027 results | First commentary on Dragos contribution, dilution and pipeline |
| Q4 2026 – Q2 2027 | Integration releases combining runZero, NetRise and Phosphorus into the Dragos Platform | Product unification, packaging and pricing |
| February 2027 | 2027 OT/ICS Cybersecurity Year in Review | Threat trends; new threat groups; manufacturing and semiconductor ransomware data |
| Early 2027 | Gartner Magic Quadrant for CPS Protection Platforms (third edition) | Whether Dragos keeps Leader status as the xOT platform takes shape |
| 2,027 | Possible Claroty IPO or sale | Valuation benchmark and competitive shift |
| Ongoing | Executive and talent retention after liquidity | Departures among founders, acquired-company leaders or senior intelligence staff |
| Ongoing | EmberAI adoption and Azure SaaS uptake | Evidence that AI and cloud delivery speed land-and-expand |
December 7, 2026: Catalyst / monitorable: CISA BOD 26-04 reaches full operation; What to watch: Federal pipeline and contract awards through Dragos Public Sector and Accenture Federal Services
December 2026: Catalyst / monitorable: Accenture fiscal Q1 2027 results; What to watch: First commentary on Dragos contribution, dilution and pipeline
Q4 2026 – Q2 2027: Catalyst / monitorable: Integration releases combining runZero, NetRise and Phosphorus into the Dragos Platform; What to watch: Product unification, packaging and pricing
February 2027: Catalyst / monitorable: 2027 OT/ICS Cybersecurity Year in Review; What to watch: Threat trends; new threat groups; manufacturing and semiconductor ransomware data
Early 2027: Catalyst / monitorable: Gartner Magic Quadrant for CPS Protection Platforms (third edition); What to watch: Whether Dragos keeps Leader status as the xOT platform takes shape
2027: Catalyst / monitorable: Possible Claroty IPO or sale; What to watch: Valuation benchmark and competitive shift
Ongoing: Catalyst / monitorable: Executive and talent retention after liquidity; What to watch: Departures among founders, acquired-company leaders or senior intelligence staff
Ongoing: Catalyst / monitorable: EmberAI adoption and Azure SaaS uptake; What to watch: Evidence that AI and cloud delivery speed land-and-expand
Analyst verdict
Dragos enters late 2026 as the best-validated specialist in OT cybersecurity under a new ownership model. For a decade it built its franchise on rare credibility. Its founders came from government industrial cyber operations, its researchers wrote the defining analyses of grid- and safety-system attacks, and its software turns that frontline knowledge into detection content that generic tools struggle to match. Gartner's back-to-back Leader placements, combined ARR of USD 208 million growing 53%, and a USD 3.25 billion valuation from a sophisticated strategic buyer all confirm the strength of that franchise.
The 2026 transformation is bold and carries risk. In five months Dragos bought three companies, redefined its market as xOT, launched an OT-native AI product, and handed majority control to the world's largest IT services firm. The strategy fits the consolidating market: Nozomi now belongs to Mitsubishi Electric and Armis to ServiceNow, so staying small and independent was getting harder to defend. Accenture offers distribution, capital and a services engine that can turn Dragos's platform into a default part of industrial security programmes, including in semiconductor fabs and data centres, where demand is accelerating.
The open question is whether Dragos can keep its neutrality and culture while scaling inside a consultancy. Its sales pitch has long relied on being the independent, practitioner-led choice. Dragos has guarded against this risk structurally: the brand is preserved, Lee is now both Chairman and CEO, the public-sector entity is ring-fenced, and new capital is going mainly into R&D. Whether rivals' channels and automation partners stay engaged is something only the market will show.
On balance, the investment case has moved from a venture-stage bet on category creation to an execution story. If integration of the acquired products is delivered by mid-2027 and Accenture's channel produces visible pipeline, Dragos has a credible path to sector-leading scale in a market expected to more than double by 2031. The main monitorables are integration milestones, retention of key people, federal wins and Accenture's first quantified disclosures on the business.
Unlock Company Financials
Unlock this company profile to view its financial data.
View Subscription PlansExecutive Leadership
Executive Leadership Team
| Name | Title | Tenure / start | Background |
|---|---|---|---|
Robert M. Lee | Chairman and Chief Executive Officer; co-founder | CEO since 2016; Chairman since September 2026 | Former U.S. Air Force Cyber Warfare Operations Officer in the intelligence community; built an ICS threat-hunting mission; long-time SANS Institute instructor and course author on ICS security and threat intelligence; U.S. Air Force Academy graduate with postgraduate study at King's College London; has testified before Congress on energy infrastructure security; also Chief Executive of Dragos Public Sector and an inside director of its board |
Jon Lavender | Chief Technology Officer; co-founder | Since 2016 | U.S. intelligence community background in industrial cyber operations; leads the technology architecture, cloud partnerships and AWS competency work |
Justin Cavinee | Co-founder (data science leadership) | Since 2016 | About 20 years at the U.S. Department of Defense as a software engineer, network analyst and data scientist |
Mark Matheos | Chief Financial Officer | Since November 2024 | Former senior finance executive at Appian, where he helped grow the company from about 500 to more than 2,000 employees and led its IPO |
Eric Cross | Chief Revenue Officer and President, Go-to-Market | Since August 2025 | More than 20 years leading enterprise sales organizations; oversees sales, customer success, partners and channels, and marketing |
Darren Sankbeil | Chief Strategy Officer | CSO since November 2024; previously CFO | Long-serving finance leader at Dragos |
Mark Packham | Chief Marketing Officer | Since November 2024 | Former EVP of Marketing at DigiCert |
Jodi Schatz | Chief Product Officer | In role by 2026 | Leads the platform roadmap |
Dawn Mitchell | Chief People Officer | Appointed January 2026 | Succeeded Angela Crossman, Dragos's first CPO (appointed February 2024) |
HD Moore | runZero leader, key Dragos executive | Since September 2026 | Creator of Metasploit; founder and CEO of runZero |
Thomas Pace | NetRise leader, key Dragos executive | Since July 2026 | Co-founder and CEO of NetRise; former U.S. Marine |
Michael Scott | NetRise CTO and Chief Scientist, key Dragos executive | Since July 2026 | Co-founder of NetRise |
Sonu Shankar | General Manager, Phosphorus | Since June 2026 | Former President and COO of Phosphorus |
Daniel Dorchinsky | General Manager, Dragos Public Sector | Confirmed October 2026 | Leads the U.S. government subsidiary |
Phil Tonkin | Field CTO | — | Customer-facing technical leadership |
Governance Overview
| Governance feature | Position |
|---|---|
Chair / CEO separation | Combined since September 2026 (Robert M. Lee) |
Controlling shareholder | Accenture (majority) |
Operating model | Dragos runs as an independent business with its own brand, vendor-neutral stance, partner ecosystem and product roadmap |
Committee structure | Not published |
Board of Directors
| Name | Role | Background |
|---|---|---|
Rob Joyce | Outside director | Former NSA Cybersecurity Director |
Lt. Gen. (ret.) Maria Barrett | Outside director | Former Commander, U.S. Army Cyber Command |
Tim Conway | Outside director | SANS Institute fellow; leads its ICS/SCADA technical work |
Robert M. Lee | Inside director | Chairman and CEO, Dragos |
David Fitch | Inside director | Accenture Americas cybersecurity lead |
Daniel Dorchinsky | Officer director | General Manager, DPS |
Major Shareholders
| Investor | Involvement |
|---|---|
Accenture | Majority owner since September 2026 |
DataTribe | Seed lead (2016) |
AllegisCyber | Series A lead; board seat (Bob Ackerman) |
Energy Impact Partners | Series A lead; board seat (Sameer Reddy) |
Canaan Partners | Investor since the early rounds; board seat (Joydeep Bhattacharyya) |
National Grid Partners | Strategic investor since 2018 |
Koch Disruptive Technologies | Series D co-lead (2021) |
BlackRock (funds) | Series D co-lead (2021) |
WestCap | Series D extension lead (2023) |
Strategic industrial investors (including Emerson and Rockwell Automation) | Strategic minority investors |
Competitive Landscape
Key Competitors
| Competitor | Category | Ownership | Scale indicator | Relative positioning against Dragos |
|---|---|---|---|---|
Claroty | Pure-play CPS security (OT, IoT, healthcare) | Private | More than USD 200 million ARR; reported USD 3 billion valuation (January 2026) | Closest peer; Gartner Leader; wider in healthcare and building systems; strong automation-vendor backing (Rockwell, Schneider, Siemens historically) |
Armis | Asset intelligence and exposure management across IT, IoT and OT | ServiceNow (USD 7.75 billion) | More than USD 340 million ARR; more than 50% growth | Gartner Leader; agentless discovery breadth; now bundled with ServiceNow CMDB and workflows; competes directly with runZero's capabilities |
Nozomi Networks | OT/IoT visibility and threat detection | Mitsubishi Electric (about USD 1 billion, closed January 2026) | — | Strong in passive discovery and IoT; owned by an automation vendor, which Dragos uses to argue its own neutrality |
TXOne Networks | OT endpoint and network protection | Private (Trend Micro affiliate) | — | Strong in semiconductor fabs and SEMI E187; endpoint-heavy where Dragos is monitoring-heavy |
Fortinet | Network security with OT ruggedized firewalls | Public (NASDAQ: FTNT) | Multi-billion-dollar revenue | Gartner Challenger; competes on segmentation and bundling |
Palo Alto Networks | Network and SOC platform with OT/IoT security | Public (NASDAQ: PANW) | Multi-billion-dollar revenue | Platform consolidation pitch to CISOs |
Cisco (Cyber Vision) | OT visibility built into industrial networking | Public (NASDAQ: CSCO) | Multi-billion-dollar revenue | Gartner Niche Player; distribution through industrial switches |
Microsoft (Defender for IoT) | OT/IoT detection within Microsoft security | Public (NASDAQ: MSFT) | Multi-billion-dollar revenue | Both partner and competitor; Dragos is now integrated with Sentinel and sold via Azure Marketplace |
Tenable (OT Security) | Vulnerability-led OT security | Public (NASDAQ: TENB) | About USD 1 billion revenue | Vulnerability management focus |
Forescout | Device visibility and network access control | Private | — | Strong in device control across IT and OT |
Darktrace / OT | Anomaly-based detection | Private (Thoma Bravo) | — | AI anomaly-detection approach; Dragos emphasizes intelligence-driven detection instead |
Automation vendors' security arms (Honeywell, Siemens, Schneider Electric, Rockwell) | Services and embedded security | Public | Large | Often partners, sometimes competitors in managed OT security |
“—” = not publicly disclosed.
Key Competitors by Company
| Company | ARR (USD Mn, latest) | ARR growth (%) | Latest valuation / deal value (USD Mn) |
|---|---|---|---|
Dragos (with runZero and NetRise) | 208 | 53 | 4,175 |
Armis | 340 | 50 | 7,750 |
Claroty | 200 | — | 3,000 |
