My co-founders and I started Dragos ten years ago on a simple belief: our communities deserve to be protected from those cyber threats that mean them harm. To achieve that mission of safeguarding civilization we knew we needed to focus on the critical part of critical infrastructure: operational technology (OT). OT is the foundation of electric systems, water systems, manufacturing, transportation, data centers, and other critical sectors providing us with the modern world we need to live. These systems cannot be protected with tools adapted from information technology (IT) security designed against different threats and consequences, but with tools built specifically for the systems that, when they fail, people can die. That mission has not changed. The threat has, our systems have, and the consequence of failure has gotten worse.
Critical infrastructure is under more sustained, sophisticated attack than at any point in history. And the environment is becoming more complex. State-sponsored actors are becoming more bold and pre-positioning in our infrastructures for potential conflict scenarios. They are using our systems and automation against us. They are using AI to accelerate their knowledge and scale in OT to make once low frequency high consequence attacks a higher frequency reality.
The operations environments have also expanded beyond defined traditional network boundaries. What makes a system OT is the impact on the physical process, not its operating system, and those systems have extended to include control software in the cloud, interconnectivity amongst supply chains, and analytics platforms required for operations — what we now call the extended OT environment, or xOT. This is not a rebranding of the problem. It is an accurate description of how far the attack surface has grown and how our adversaries are taking advantage of it.
The community is getting better, more focus on OT is taking place in the boardrooms and national levels than ever before, and our defenders are getting wins. There is much to celebrate but we also must be honest with ourselves. The rate of change is increasing but falling behind the rate required to keep our communities safe. There are not enough OT specialists in the world to defend it all in the time required. There never will be. Not without a seismic change.
All of this is happening in the backdrop of a market moment. AI has and will continue to disrupt many companies. Many companies in the OT cybersecurity space have been bought, bankrupted, in distress, or otherwise broadened their focus away from OT. The companies who have truly unique and differentiated offerings, proprietary datasets, and more like Dragos are being rewarded though asked to do so much more. To our competitors that have remained focused we applaud them. We compete in sales discussions, but we do not compete in the mission. The market is competitive but there are too many who think IT and OT are converging, OT isn’t as critical as it is, or that this problem is just too hard to solve.
When I first raised capital 10 years ago for Dragos I was told by almost every investor I met that this was not a space that was fundable. It was “stupid” to focus on OT. It would never work. And every other aspect of “do something else.” But to me, no matter if it was financially wise it was a mission that needed to be done. It turns out it could be both: one of the biggest markets out there and very financially wise while being a mission worth pursuing.
The next phase of Dragos is about meeting this market moment and closing the gap the mission requires. Dragos is going to make OT security more effective for the specialists who have always relied on it, more accessible to the IT professionals now in the fight, and delivery at the scale and speed required to meet this moment.
Today we announce a seismic shift that will forever change the OT cybersecurity space.
Accenture, a global leader in OT cybersecurity services and delivery focused on OT for a decade, is acquiring a majority stake in Dragos at a $3.2B valuation, and all of runZero and NetRise, bringing the combined business value to $4.175B. This makes the combined business the most valued OT cybersecurity company in history. But the deal also contained specially crafted terms focused on giving Dragos autonomy and permanence as a standalone entity focused on the OT cybersecurity mission.
The employees, including myself, are choosing to continue on with our equity, our roles, and our responsibility to run the business just as we did before. This structure is not just a standard majority investment as Accenture understands not only the market opportunity but the mission imperative.
As an example, I’ve been thinking a lot about how to make Dragos a 100+ year company. How do you make something with the same values and mission focus outlive yourself and all the people you know and trust? Part of that requires codifying into the very business structure itself those ideals. Accenture did that. We always talked about the OT focus and the mission but technically the board, under our previous investors, could change that. They wouldn’t have, but will the board in 100 years? As part of this deal with Accenture, these ideals, such as the OT cybersecurity focus and mission focus, are reflected in the legally binding governing documents of the company. That is genuine permanence and a 100+ year mindset. That’s what happens when you find a partner like Accenture, who understands the mission. All while putting in a new board of directors, of which I am one, and granting me the autonomy, more than I had with my previous board of directors and investors, to lead the company in a way that is required without thinking simply in terms of quarterly goals and outcomes. The money follows the mission, not the other way around.
I will remain CEO. Dragos will remain the standalone and independent company it’s always been. And we were just granted an amazing partner with the OT and AI, services and technology expertise required, along with the financial capital, to accelerate us and our community
Earlier this month, we announced the acquisition of Phosphorus, which brought automated connected device discovery and remediation to the Dragos platform. Today Accenture announced its intent to acquire runZero, a leader in exposure management across IT, OT, IoT, and cloud environments; and NetRise, which specializes in product and software supply chain security. After regulatory sign off, Dragos will integrate runZero and NetRise inside of Dragos. Combined with Accenture’s unique proprietary OT cybersecurity datasets we will create the most complete end-to-end xOT security platform in the market. The empowerment our defenders need.
As all of our customers know, Dragos has never been just about having amazing technology. It’s been about having the experts and amazing team required to be a partner to our customers on their journey. I’m so proud to be able to acquire NetRise and runZero for the same reason – they not only built unique technologies but amazing teams of mission driven people. runZero is led by HD Moore, one of the most recognized figures in the security community, and NetRise is led by Thomas Pace and Michael Scott, two accomplished executives and U.S. Marine Corps veterans. Their decision to join this mission tells you something about where this industry is heading and why this platform matters.
Will Dragos still be Dragos?
Yes. And then some.
It’s hard to understand just how unique this deal structure is and the autonomy and permanence it gives to Dragos. There is no change to our day-to-day operations except we will get to go faster and with better partners.
Dragos will lead a platform that includes runZero, NetRise, and Phosphorus. Running through all of it will be the Dragos Intelligence Fabric and a decade of OT threat intelligence, asset insights, and work on the front lines to empower defenders. This will enable our AI capabilities with training data and expertise that no one else has access to – except now our amazing customers.
Accenture’s global network and expertise mean Dragos will be able to reach customers we have never been able to serve before with partners who appreciate what this mission requires. The mission has never had a geographic boundary. Until now, our delivery capability did.
What does this mean for customers?
Dragos will continue as an independent company. That will be the structure, and it is what drew us to this deal. We will work with any partners, even competitors to Accenture, and remain truly independent and neutral as everyone needs from us. We chose Accenture because they are the right partner and no one comes close to their capability and their understanding of why this is necessary for our global communities.
Nothing about how we work with you will change. The people you work with are staying. The technology and insights you need are being enhanced. The reality is we are accelerating our roadmap to deliver more to you than ever and we are going to be hiring a lot more to make sure you have the partners you need in an uncertain time in human history. We’re going to change the pace and put the defenders back in control.
The threat to critical infrastructure is not slowing down. State-sponsored actors are getting more capable. AI is expanding the attack surface faster than the defender community is growing. The organizations responsible for the systems that society depends on need help now, at a scale that requires more than any specialist firm can deliver alone.
Building xOT, with the best platform, the best intelligence, and with some of the best people in this industry, is what is required.
That is why we did this.
Let’s meet this mission and market moment together. Let’s safeguard civilization against those that mean our communities harm.
