In June, Accenture agreed to take a majority stake in Dragos and buy runZero and NetRise outright, totaling a $4.175 billion bet on OT security. The shakeup followed ServiceNow’s own $7.75 billion move for Armis earlier this year.
Two of the largest professional services and enterprise software companies in the world have decided, within a few months of each other, that owning OT visibility data is worth billions. Accenture alone estimates the broader OT cybersecurity software market at $27 billion today, growing to nearly $60 billion by 2031.
What’s Going On Here?
I have spent over a decade in this space, first at Symantec’s embedded and IoT security business and now running Asimily, and I don’t think the headline is really about who bought whom and for what. If you depend on OT security to protect your factories, power grid, or distribution center, you should pay attention to what the buyers are chasing.
Large platform companies that already sell into IT can expand into OT, IoT and IoMT far more easily if they acquire the technology and the data rather than build it themselves, because that data is genuinely hard to gather. You need to discover devices through passive monitoring and active safe scanning where appropriate, classify them well enough to run real risk analysis on equipment that was never designed to be monitored the way a laptop or server is, and do that without disrupting the processes those devices control.
Credibility in this space takes years to build, and that is what these acquisitions are buying.
Manufacturers, utilities, and other OT-dependent businesses should care more about what happens to their plants and production lines while these deals close and integrate, because acquisitions have a tendency to slow companies down even when they do not slow down an industry. The industrial sector cannot afford to wait for integration work to finish neatly.
Food and beverage manufacturers are already running AI models against plant data to improve throughput. Every AI deployment increases the attack surface at the same time it increases the value on the table. Attackers are well aware of that.
That brings me to the part of this story that gets buried under the acquisition headlines.
When a manufacturing security leader reads about the next OT security acquisition, the question worth asking is whether the combined platform genuinely closes the gap between owning segmentation infrastructure (including microsegmentation) and being able to run it, as opposed to whether the acquirer has an impressive logo or a bigger balance sheet.
What's Old is New Again
Segmentation is not new. It has been in NIST guidance and best-practices documents for OT security for two decades, almost always framed as a way to contain the damage once something gets in. The manufacturers I talk with already own the NAC and firewall infrastructure to do it, often purchased ten or fifteen years ago.
What they have not done is operationalize any of it. Segmentation has functioned as de facto lip service for most of that time, sitting next to endpoint security and multi-factor authentication as a compliance checkbox rather than an active program.
Two things are changing that, quickly. Cyber insurers are now pushing harder on segmentation, the same way they pushed on authentication and endpoint controls a few years ago. And more urgently, AI agents are showing up inside industrial networks carrying a risk profile that the existing segmentation posture was never built to contain.
Take a plant that bought a PLC from an established industrial supplier. That supplier controlled its own supply chain and could be held accountable for it. But an AI agent bought to improve a production process might come from a startup with no comparable supply chain discipline, running on a model built by a company with a handful of employees.
Nobody fully controls where that model has been embedded, and a single agent behaving unpredictably is enough to cause damage across a network that was never built to contain it. Segmentation has gone from a compliance line item to an active project for industrial security teams this year because the risk calculus changed, not because the technology did.
A typical manufacturer we work with has upward of 100,000 devices and two million active connections. You cannot hand a plant security team that raw connection data and ask them to write segmentation policies from it. They need risk context of which of those connections are actually exploitable by an attacker given the specific device and the specific network topology they sit in (not just which connections exist).
That is what ATT&CK Analysis does, and it is what separates a prioritized queue from a sorted spreadsheet. They also need a way to generate policy from observed device behavior rather than staring at a blank slate, which is what Policy Auto-Recommendation does.
They need to simulate the impact of a policy change before it goes live so it does not take down a production line, which is what Policy Simulation does. And they need to manage that policy over time as devices change, firmware updates, and new assets arrive, which is what Continuous Segmentation does.
The full chain of discovery, prioritization, policy generation, simulation, and ongoing management is how segmentation orchestration needs to be defined. Owning the right NAC infrastructure for over a decade without a way to run it is exactly the problem segmentation orchestration solves.
Visibility for standard IT and conventional OT assets has improved significantly over the past few years. The harder gap is in the devices that do not speak standard protocols, cannot run agents, and sit outside the reach of conventional scanners.
Getting any production network from full-scope visibility to a segmentation policy that holds up under an AI-driven attack without breaking the line is the problem that will determine which of these newly consolidated platforms actually earns its price tag with manufacturers.
