Market position and operating model
Dragos presents its platform for OT asset visibility, vulnerability management, threat detection, investigation, and response, supported by industrial threat intelligence and services.
The current official product record places Dragos Platform inside the maintained OT-defense market boundary and supports the documented operating role and capability map.
The primary classification describes where Dragos Platform begins in the buyer's operating problem. It does not imply that every module, jurisdiction, workflow, integration, service, or data dependency is interchangeable with another organization in the same category. Buyers should confirm the exact product, edition, service boundary, and accountable party included in a proposal.
Who should evaluate Dragos Platform
Asset owners and critical-infrastructure defenders evaluating a purpose-built OT monitoring platform with threat intelligence and incident-response context.
The reviewed record names or supports these market segments: Energy, Manufacturing, Oil And Gas, Water, Transportation, Data Centers. Segment positioning is useful for scoping diligence, but it does not establish configuration fit, regulatory applicability, implementation capacity, or customer outcome.
A strong evaluation begins with a real scenario and its exception path. Ask the organization to identify inputs, authoritative content, configured rules, decision owners, handoffs, evidence retained, exports available, and the behavior when required data is missing or contradictory.
Documented capability record
| Capability | Evidence state | What remains to verify |
|---|---|---|
| Passive OT Asset Discovery And Inventory Open provider-specific evidence record → | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Industrial Protocol Identification And Deep Packet Inspection Open provider-specific evidence record → | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Topology, Communication, And Dependency Mapping Open provider-specific evidence record → | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Asset Criticality And Operational Context | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Vulnerability And Exposure Correlation | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Configuration, Baseline, And Change Monitoring | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Anomaly And Behavioral Detection | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| OT Threat Intelligence And Detection Content | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Alert Triage And Investigation Workflow | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Packet Capture And Forensic Evidence | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Incident Response And Recovery Support | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Multi-Site Sensor, Data, And Policy Management | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| IT Security-Operations Integration And APIs | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
| Offline And Air-Gapped Environment Support | Documented in approved official positioning | Depth, package, configuration, data dependency, and production behavior require further verification. |
Known evidence limits
This seed review did not independently test deployment safety, detection efficacy, protocol depth, sensor performance, integration behavior, operational impact, implementation effort, package availability, or customer outcomes.
A documented capability means a current official source supports relevant positioning. It is not an independent observation of configured behavior, accuracy, completeness, latency, usability, implementation effort, integration depth, support quality, customer outcome, or legal and regulatory fitness. Missing public evidence remains not established; it is not silently converted into feature absent.
Enterprise demonstration agenda
- Confirm the precise product, edition, service, geography, and customer population under evaluation.
- Trace one representative case from intake through decision, exception, evidence retention, reporting, and downstream exchange.
- Repeat the workflow with missing data, a conflicting rule or record, a changed authority source, and a user override.
- Identify which content, interpretation, configuration, integration, review, approval, and validation responsibilities remain with the customer or another party.
- Export the decision history and reconcile it to the governing source, configured version, user action, timestamps, and affected records.
Questions to take into diligence
- Which named workflows and capabilities are available in the proposed package today?
- Which authority, content, data, or network dependencies are maintained by the provider, a partner, or the customer?
- How are changes detected, assessed, tested, approved, released, and preserved historically?
- What implementation roles, controlled configurations, integrations, migrations, and ongoing services are required?
- What can an auditor, regulator, clinical reviewer, compliance owner, or operational leader reconstruct from the exported record?
Source and research record
The dossier uses 21 normalized record elements and 1 linked evidence records internally. Those operational totals are not presented as a quality score. The decision-relevant public record is the claim, its source, evidence class, scope, and limitation.
- Dragos Platform official product recordprimary · monitored monthly