Nozomi Networks

• SecurityWeek describes Schneider Electric and Mitsubishi Electric as OT equipment manufacturers, and Schneider Electric is both an investor and a named partner, so Nozomi's partner now works with a company owned by another firm in its own business and could scale that work back.
• Siemens was still preparing fixes for Nozomi Guardian and management console flaws in its RUGGEDCOM APE1808 devices in January 2026, so one Siemens decision could close a distribution path Nozomi does not control.
• ServiceNow paid $7.75 billion for Armis, which an SDxCentral article calls a Nozomi rival, and Accenture, which the same article calls a consulting giant, paid $4.1 billion for Dragos, so two vendors in Nozomi's category now sell from inside much larger owners.
• Nozomi's break-even and customer-concentration claims reach the reviewed record only through its own announcements, so a buyer weighing its finances is reading the company's own account of everything except the revenue line an SDxCentral article carries.
• Nozomi's advisory portal carries dated disclosures through August 2026 across Guardian, the management console and Arc, so operators running the sensor on a monitored network inherit its patching cycle.
• The graphic Nozomi publishes places Microsoft, Cisco and Palo Alto Networks in the same protection-platform category, so Nozomi defends its position against platform vendors as well as against the two specialists it is ranked beside.

Nozomi starts from a claim about the tools operators already own: its Arc page says traditional agents are trained on IT environments and do not understand OT protocols or recognize OT baselines. Some of these environments prohibit active querying outright, and Nozomi names grid operators under NERC CIP rules, nuclear plants and defense sites among them. Its main sensor watches rather than probes: Guardian sits on mirrored ports or taps and, in the company's description, monitors local traffic without disrupting critical processes, triggering alarms or generating additional traffic.

The named buyers are utilities and healthcare organizations. Nozomi's published case studies name Vermont Electric, the New Zealand utility Trustpower, the Valencian Health Department and Konkuk University Hospital, and the company sells a separate government edition of its cloud console for federal agencies. CISA's industrial advisories show the same population from the other side, in this case cataloguing flaws in Nozomi's own components as shipped on Siemens hardware.

Buyers of companies have been paying large sums in this category. Within roughly a year, according to SDxCentral, ServiceNow paid $7.75 billion for Armis, Accenture paid $4.1 billion for Dragos, and Mitsubishi Electric completed its purchase of Nozomi. All three targets sit in the same protection-platform category on the graphic Nozomi publishes. [s5, s7, s11, s14, s17, s20, s22]

The platform is organized into sensors that collect and managers that consolidate. Guardian handles wired networks, Guardian Air covers the wireless spectrum, Arc runs on operational endpoints, Arc Embedded runs inside industrial controllers, and Remote Collector gathers data at small remote sites. Vantage consolidates all of it in the cloud, and Central Management Console does the same job on premises, which Nozomi pitches at operators under data residency or cloud connectivity restrictions.

Two design choices show how much Nozomi bends its own product to avoid disturbing the process. Arc runs primarily in user space and uses kernel modules only when necessary, mostly read-only, which Nozomi contrasts with endpoint tools built for IT. Arc Embedded, which Nozomi says it developed with equipment makers, runs inside controllers at Purdue levels 0 and 1 and watches process variable readings and controller logic changes, which is a layer below what the network sensors observe.

The analysis layer runs on what the sensors accumulate. Guardian builds a baseline of normal behavior by observing traffic and device interactions, Vantage ranks assets by risk using anonymized asset data with customer-adjustable scoring, and the threat intelligence add-on distills feeds from Nozomi Labs and Mandiant into threat cards with suggested mitigations. Vantage IQ, which SDxCentral describes as a company-trained assistant built on a secure model that learns from an organization's own asset, vulnerability, threat and risk data, sits on top of that. [s4, s5, s6, s7, s14]

The field is laid out in a graphic Nozomi publishes itself. The Gartner Magic Quadrant for cyber-physical system protection platforms, dated March 2026, shows Nozomi Networks, Claroty and Armis as leaders, Forescout Technologies, Tenable and Fortinet as challengers, Darktrace as a visionary, and Microsoft, Cisco, Palo Alto Networks, Honeywell, TXOne Networks and Dragos as niche players. A vendor-displayed placement is real recognition and not independent confirmation, but the roster itself is useful, because large platform vendors are already inside the category.

Ownership changed for three names on that graphic in about a year. ServiceNow bought Armis, Accenture bought Dragos, and Mitsubishi Electric bought Nozomi, so three of the vendors on that graphic now sit inside larger companies. The parents differ in a way that matters here. An SDxCentral article calls Accenture a consulting giant, and a SecurityBrief article states that Mitsubishi Electric sells industrial automation and control products.

That matters because Nozomi's stated differentiator is neutrality. Its chief executive at the time of the sale called the vendor-agnostic approach a critical ingredient of the company's success, and the transaction was announced with a commitment to preserve independent operations and a vendor-neutral roadmap. The channel is where the commitment gets tested: CISA recorded in January 2026 that Siemens was preparing fixes for Nozomi Guardian and management console flaws in its RUGGEDCOM APE1808 devices, and Nozomi's own announcements name Schneider Electric, Hitachi Cyber, Nvidia, Dispel and Xona as expanded partnerships. [s1, s9, s13, s17, s20, s27]

Some of the traction evidence was reported outside the company. An SDxCentral article dated January 2026 states that Nozomi had passed $100 million in annual revenue at 33% year-on-year growth, and the company says it has reached sustained cash flow and break-even performance. Nozomi also claims 5 of the top 10 oil and gas companies, 7 of the top 10 pharmaceutical manufacturers, 7 of the top 10 utilities and 4 of the top 10 mining operations as customers, a claim the reviewed record carries in the company's own voice.

Partner and marketplace routes run alongside direct selling. Vantage is listed on AWS Marketplace with a single published pricing dimension, a twelve-month contract at $218,880 covering up to 5,000 assets, and buyer reviews on that listing describe licensing by protected asset count. Nozomi's own announcements name Schneider Electric, Hitachi Cyber, Nvidia, Dispel and Xona among recently expanded partnerships, and a federal edition of the console entered the FedRAMP process in October 2025.

Reported figures for the sale price differ, at $1 billion in the company's own announcement and around $880 million in the analyst estimates SDxCentral cites. Named references cover several regulated sectors: Vermont Electric, Trustpower's power and telecoms network in New Zealand, the Valencian Health Department and Konkuk University Hospital. Third-party recognition beyond the analyst placements is thinner in the reviewed record, resting on rankings the company reports itself, including the Deloitte Technology Fast 500 and Fast Company's innovation list. [s9, s11, s14, s19, s22, s25]

Nozomi is founder-led again. Andrea Carcano, who co-founded the company in 2013 and ran it as chief executive until 2016 before moving to product, was appointed chief executive in July 2026, six months after the sale closed. Edgard Capdevielle, chief executive for the decade in between, moved to an advisory role. The company frames the earlier arrangement plainly: the founders brought Capdevielle in to take the platform to market, build a go-to-market organization and raise capital.

The founders' credentials sit in the domain rather than beside it. Carcano earned a doctorate in computer science on software that detects intrusions into critical infrastructure control systems, and an SDxCentral article records his earlier security engineering work at the Italian energy company Eni and research for the European Commission. Moreno Carullo, the other co-founder and chief technology officer, holds a doctorate in artificial intelligence and is a long-time member of the IEC TC57 WG15 subcommittee, working to shape cybersecurity standards for power system communication protocols.

The revenue organization is run by a hire from larger security companies. Kevin Isaac, the chief revenue officer, was chief revenue officer at Forcepoint and a senior vice president at Symantec and at Sophos. The research team is a separate asset: Nozomi Networks Labs operates from Mendrisio in Switzerland with honeypots deployed globally, and NVD records list Nozomi Networks as the CVE Numbering Authority assigning identifiers for flaws in its own products. [s3, s10, s16, s19, s20]

The assurance package covers the common enterprise requirements. Nozomi's trust center lists ISO 27001:2022 certification, SOC 2 Type II reports available under non-disclosure, a downloadable SOC 3, ISO 9001, ISO 27017 and ISO 27018, and states that third-party experts run detailed annual penetration tests. Customers choose among AWS data center locations, which Nozomi ties to their own preferences and requirements.

The federal credential is the one a competitor cannot simply assert. Nozomi announced FedRAMP Moderate In Process status for Vantage for Government in October 2025, and its licence addendum for that product represents that the service has achieved FedRAMP authorization at the Moderate baseline and commits to keeping data and system components inside approved US regions. A federal buyer would confirm that status on the FedRAMP listing itself, since the reviewed record carries the claim in Nozomi's own contract language.

Product security is handled in the open. A public product security incident response portal carries dated advisories, the most recent on 11 August 2026, covering path traversal and driver permission issues in Arc and authentication, injection and denial-of-service flaws in Guardian and the management console. CISA has published advisories in 2023 and January 2026 covering Guardian and the console as installed on Siemens RUGGEDCOM devices. On AI, the trust center states that data processed by AI features is not used to train or improve models. [s5, s8, s17, s22, s23, s26, s27]

Add analyzed competitors to compare them side by side with Nozomi Networks.

Nozomi sells to organizations whose production equipment cannot be treated like office IT. Its customer-story index files references under airports, electric utilities, healthcare, manufacturing, oil and gas, pharmaceutical, stadiums and arenas, and water and wastewater, and the named references inside it are Vermont Electric, Trustpower in New Zealand, the Valencian Health Department and Konkuk University Hospital. The industry pages market to a wider set of sectors than those stories cover.

Segmentation inside that base runs by deployment constraint. Guardian's page pitches passive monitoring specifically at sites that prohibit active querying, naming grid operators under NERC CIP rules, nuclear plants and defense facilities, while Smart Polling and active collection serve operators who allow it. The cloud console and the on-premises console split the base again, with the on-premises path pitched at operators facing data residency or cloud connectivity restrictions.

The public sector is treated as its own segment with its own product. Vantage for Government is a separate edition of the cloud console built to meet federal requirements, announced as reaching FedRAMP Moderate In Process status in October 2025. Nozomi also claims concentration at the top of several industries, saying it serves 5 of the top 10 oil and gas companies, 7 of the top 10 pharmaceutical manufacturers, 7 of the top 10 utilities and 4 of the top 10 mining operations. That claim is the company's own and the reviewed record carries no independent count behind it.

The capability set is organized around collection points rather than around features. Guardian watches wired networks from mirrored ports or taps, Guardian Air covers the wireless spectrum, Arc runs on operational endpoints, Arc Embedded runs inside industrial controllers, and Remote Collector picks up asset and network data at small remote sites. Vantage and the on-premises Central Management Console aggregate what the sensors produce.

Two capabilities are hard to reach from a network-only position. Arc Embedded, which Nozomi says it built with equipment makers, runs at Purdue levels 0 and 1 and reads process variables and controller logic changes, which is a layer below what a network sensor observes. Arc itself is designed to be safe in that setting, running primarily in user space and touching kernel modules only when necessary and mostly read-only, a design Nozomi contrasts with endpoint tools built for IT.

AI is applied as method rather than sold as the subject. Guardian learns a behavioral baseline by observing traffic and device interactions, Vantage ranks asset risk from anonymized asset data with customer-adjustable scoring, and the threat intelligence add-on turns feeds from Nozomi Labs and Mandiant into cards with suggested mitigations. An SDxCentral article describes Vantage IQ as a company-trained assistant built on a secure model that learns from an organization's own asset, vulnerability, threat and risk data. The trust center states that data processed by AI features is not used to train or improve models, which is a constraint an industrial operator can check before deploying it.

Distribution runs through partners and equipment makers alongside the company's own selling. Nozomi names Schneider Electric, Hitachi Cyber, Nvidia, Dispel and Xona among recently expanded partnerships, and the CISA advisory record shows the deeper form of the same motion: Siemens RUGGEDCOM APE1808 devices run Nozomi Guardian and the management console, an arrangement CISA documented in 2023 and again in January 2026, when Siemens was preparing fixes for flaws in those Nozomi components.

Investors and partners have overlapped for years. A SecurityWeek article states that the 2024 Series E brought in Mitsubishi Electric and Schneider Electric alongside earlier equipment-maker investors Honeywell and Johnson Controls, and In-Q-Tel appears in the same investor list. What the record shows is coexistence rather than cause: OEM investment, named partnerships and one packaged deployment sit side by side, and the Mitsubishi purchase now sits on top of all three.

The revenue organization is run by a hire from larger security companies. Kevin Isaac, chief revenue officer, held that title at Forcepoint and senior vice president roles at Symantec and Sophos, and the company also sells through AWS Marketplace with a published contract price. The reviewed record therefore shows selling led by a hired chief revenue officer, running alongside two documented routes to buyers: a marketplace listing and a separate federal path through the government edition of the console.

Nozomi charges by monitored asset, and a buyer review on the marketplace listing describes the model in the same terms. The AWS Marketplace listing carries one pricing dimension, a twelve-month contract at $218,880 for a bundle covering up to 5,000 assets, with sensors not billed separately. Buyer reviews on the same listing describe the licensing model in the same terms, as a count of assets to be protected.

The published figure is a useful anchor, since it puts a 5,000-asset deployment in the low six figures per year. It also tells a buyer what growth costs: crossing the asset ceiling means moving to a larger bundle, so the bill tracks the size of the monitored estate rather than the number of sensors deployed.

No price list appears on Nozomi's own pages in the reviewed record, and the marketplace listing covers one bundle rather than the whole catalog. Add-ons including Vantage IQ, Asset Intelligence, Threat Intelligence and Smart Polling are marketed as separate items, and the reviewed record does not disclose pricing for the full catalog.

Deployment starts with placing sensors, which shapes the operational questions that follow. Guardian sensors ship as hardware appliances, virtual machines, embedded devices or containers and attach to mirrored ports or taps, and the company describes them as transparent to the monitored network, generating no additional traffic and triggering no alarms. Arc installs on operational hosts, Arc Embedded goes inside controllers built with equipment makers, and Remote Collector handles low-resource sites.

Operators choose where the aggregated data lives. Vantage is the cloud option, with a choice among AWS data center locations, and Central Management Console is the on-premises option, which Nozomi pitches at operators facing data residency or cloud connectivity restrictions. The federal edition adds a stricter version of the same promise, with a contractual commitment that storage, processing, backups, logs and administrative access stay inside approved US regions.

Nozomi markets a professional services line separately from the platform, listing a designated engineer, fast track services, a health check service and an optimization service. The software remains the delivered artifact, and the services are marketed beside it rather than bundled into it.

The certification set covers the common enterprise requirements. The trust center lists ISO 27001:2022, SOC 2 Type II reports available under non-disclosure, a downloadable SOC 3, ISO 9001, ISO 27017 and ISO 27018, and states that third-party security experts run detailed annual penetration tests. Those are the credentials an enterprise procurement review asks for, and they are table stakes rather than a barrier, since any funded competitor can obtain them.

The federal credential is the one a competitor cannot simply assert. Nozomi announced FedRAMP Moderate In Process status for Vantage for Government in October 2025, and the licence addendum for that product represents that the service has achieved authorization at the Moderate baseline and commits to maintaining it for the customer's order term. The reviewed record carries that authorization claim in Nozomi's own contract language rather than in a government listing, so a federal buyer would confirm it directly.

Product security is handled publicly and in detail. Nozomi operates a product security incident response portal with dated advisories, the most recent on 11 August 2026, covering path traversal and driver permission issues in Arc and injection, authentication and denial-of-service flaws in Guardian and the management console. NVD records show Nozomi Networks assigning CVE identifiers as a numbering authority, and CISA has published advisories in 2023 and January 2026 covering Guardian and the console as installed on Siemens RUGGEDCOM devices.

Nozomi behaves as a platform in the specific sense that other people's products carry its software. Siemens RUGGEDCOM APE1808 devices run Guardian and the management console, and CISA recorded in January 2026 that Siemens was preparing fixes for flaws in those components. Arc Embedded exists because equipment makers agreed to host a Nozomi sensor inside their controllers. Both arrangements put Nozomi code inside hardware it does not manufacture.

The surrounding ecosystem is wide. Nozomi's own announcements name Schneider Electric, Hitachi Cyber, Nvidia, Dispel and Xona among recently expanded partnerships, and the platform carries an add-on threat intelligence feed drawing on Mandiant alongside the company's own research feed. Nozomi Networks Labs adds a second kind of ecosystem presence through its CVE numbering authority role and its published research.

The Mitsubishi Electric purchase sits above that ecosystem. A SecurityWeek article describes Schneider Electric, Honeywell and Johnson Controls as OT equipment manufacturers that invested in Nozomi, and Schneider Electric is also a named partner, so at least that relationship now runs to a company owned by another equipment maker. The transaction was announced with an explicit commitment to preserve independent operations, a vendor-neutral roadmap and existing go-to-market partnerships. Whether those partners renew on the same terms is the observable test of that commitment.

The company is founder-led again, and both founders' credentials sit squarely in the problem. Andrea Carcano co-founded the company in 2013, ran it as chief executive until 2016, moved to product, and was appointed chief executive again in July 2026, six months after the sale closed. His doctorate covered software that detects intrusions into critical infrastructure control systems, and an SDxCentral article records earlier security engineering work at the Italian energy company Eni and research for the European Commission.

Moreno Carullo, the other co-founder, is chief technology officer, holds a doctorate in artificial intelligence, and is a long-time member of the IEC TC57 WG15 subcommittee, working to shape cybersecurity standards for power system communication protocols. That subcommittee writes cybersecurity standards for the power system communication protocols Nozomi's customers run.

The commercial and research benches are built out. Kevin Isaac, chief revenue officer, previously held that title at Forcepoint and senior vice president roles at Symantec and Sophos, and the alliances lead came from Dragos. Nozomi Networks Labs runs from Mendrisio in Switzerland with honeypots deployed globally and publishes threat landscape research drawn from anonymized telemetry. The handover kept continuity: Edgard Capdevielle, who built the go-to-market organization over a decade, stayed on as an advisor rather than leaving outright.