Nozomi pushes OT data into Sophos Fusion, and Fusion's integration count gets its first real test

Nozomi Networks and Sophos announced on Aug. 13, 2026 that operational technology telemetry from Nozomi's Vantage platform will flow into Sophos Fusion, the AI-native defense system Sophos launched in July ^[1][2]. It matters less as an OT story than as a platform story: this is one of the first significant third-party integrations Sophos has disclosed since Fusion shipped, against a stated catalog of more than 500 ^[3][4].

The mechanics are unglamorous and that is the point. Vantage is Nozomi's cloud-hosted monitoring platform for industrial control systems and other connected equipment, handling asset discovery and vulnerability management in environments where security teams usually have thin visibility ^[5][6]. Under the integration, Vantage asset data, threat detections and alerts appear inside Fusion alongside the endpoint and identity signals Sophos already collects from the corporate network, so an analyst can work both estates without changing consoles ^[7][8]. The companies also say orchestration and automation playbooks will be able to act on the combined data ^[9].

Two claims about that catalog now sit next to each other. Sophos has said Fusion supports more than 500 third-party integrations ^[4]; roughly a month after launch, this is among the first it has named publicly ^[3][10]. A supported connector and a jointly engineered, jointly announced data path are not the same artifact, and the gap between the two numbers is the thing to track over the next few quarters.

The sales argument is that industrial outages often start on the IT network, which makes routing plant-floor data to the analysts already watching everything else the fix ^[11][12]. Matt Cowell, Nozomi's vice president of strategic alliances, said the IT/OT intersection "has long been misunderstood by the cybersecurity industry, leading to inefficiencies and potential danger for critical infrastructure" ^[13]. Chris Bell, Sophos senior vice president of global channel and alliances, framed the result as putting OT and IT vulnerabilities in front of defenders in a single place ^[14]. The supporting evidence comes from Nozomi's own research arm, which is worth naming: a February report found transportation absorbed more ransomware than any other sector last year, and that roughly 98% of the industrial wireless networks it examined still authenticated devices with pre-shared keys ^[15][16]. That leaves about 2% using anything stronger ^[17].

Nozomi has run this play before, piping Mandiant threat intelligence into its own platform in 2024 and then shipping an expansion pack built on Mandiant data in the other direction later the same year ^[18]. Both parties are now owned by acquirers with integration agendas. Mitsubishi Electric paid $883 million for the Nozomi shares it did not already hold in a deal that closed in January, and Nozomi has told customers a vendor-neutral roadmap survives the change of ownership ^[19][20]. Sophos has belonged to Thoma Bravo since 2020, closed its $859 million purchase of Secureworks in February 2025, and Fusion carries much of that managed detection and response business ^[21][22][23].