Security1 publisher2 min readPublished
Dragos folds runZero's discovery and NetRise's firmware data into one OT platform
Accenture's majority stake closed first, then Dragos completed both acquisitions on Monday. One supplier now holds network discovery, firmware inventory and OT threat detection. Neither price was disclosed.
The Watch · Security desk
What happened
- Accenture's majority investment in Dragos has closed, the first of the two transactions in the arrangement to complete.
- Dragos followed on Monday with an announcement that it had completed its acquisitions of NetRise and runZero.
- Both sit inside the $4.1 billion OT cybersecurity push that Accenture announced in June.
- Robert M. Lee stays on as CEO and has been named chairman, with new board members coming from Accenture and Dmitri Alperovitch returning to the Dragos board.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Sites that bought discovery from one vendor and OT detection from another now face both renewals across the same table, with a single supplier setting both prices.
- exposure The device inventory, the firmware bill of materials and the detection telemetry for the same plant will sit with one supplier, so concentration risk goes from three vendor relationships to one.
- constraint Customers who bought runZero as an independent check on their OT inventory can no longer treat the two products as separate sources of truth.
- precedent At more than 280 cybersecurity deals cataloged this year, an OT buyer choosing a point tool in 2026 should price in the odds of it being inside someone's platform by the next renewal.
runZero maps what is on the network, bringing asset discovery, exposure assessment and attack surface intelligence [7]. NetRise looks inside the devices, with firmware-level insight into device exposure and software supply chain visibility [6]. Dragos said the two acquisitions add exposure management and software supply chain security to the OT asset visibility and threat detection it already sold [8].
"Organizations across electric, oil and gas, manufacturing, data centers, and other critical infrastructure sectors need to defend every system that can influence a physical process. That extended environment is xOT. NetRise, runZero, and Dragos defend it together," Lee said [9].
Dragos did not disclose terms for either acquisition [10]. The one number on the record comes from earlier reporting: of the $4.1 billion total deal value, Accenture took its majority stake in Dragos at an enterprise valuation of $3.25 billion [15]. Subtract, and $850 million of the announced push is accounted for somewhere other than the Dragos stake [11]. A majority stake costs less than the whole enterprise value, so the real unallocated figure is larger than $850 million.
For an operator already running runZero for discovery and Dragos for plant detection, the change lands at renewal. The commitments in Monday's announcement are personnel: Moore, Pace and Scott arrive with their teams to lead platform integration [12]. Whether runZero stays purchasable on its own, at a stated price and with a support term, is a question for the account team; Monday's announcement does not answer it.
The overlap is narrower than the marketing suggests. runZero's asset discovery and Dragos's existing OT asset visibility cover adjacent ground [7][8], and from Monday those two roadmaps are decided in the same engineering organisation.
What an intruder can reach in a substation this week is unchanged. The immediate work for OT teams is license mapping and contract review. The wider pattern is a market-wide one: SecurityWeek's tracker has cataloged more than 280 cybersecurity deals so far this year [13], including 33 announced in August 2026 [14].
What to watch
- Whether runZero remains sold on its own to buyers outside OT, and at what list price.
- Any Accenture disclosure that allocates the rest of the $4.1 billion beyond the Dragos stake.
- Whether Accenture OT engagements start arriving with Dragos platform licenses attached.