Organizations are securing an operational environment that is broader and more connected than it was even a few years ago. The goal has not changed: operations still have to run safely and reliably. What has changed is the range of technologies that can affect whether they do or not. More technologies, users, connections, and third parties are now connected to or capable of affecting physical processes, creating an extended OT (xOT) environment. At the same time, adversaries continue to develop new ways to cause disruption. The OT cybersecurity market has evolved rapidly in response.
That evolution is reflected in The Forrester Wave™: Operational Technology Security Solutions, Q3 2026, where Dragos was named a Leader. Dragos received the highest score possible in eight criteria, including Vision, Innovation, and OT-specific incident investigation and response. Forrester also reports that customers greatly appreciate our focus on OT cybersecurity and our contributions to the community through Neighborhood Keeper.
We could make this whole post about that, but you’ve read that blog before. What makes this year’s Wave interesting is the market it reflects and the speed in which it has evolved.
Organizations have moved beyond debating OT cybersecurity’s necessity. The importance of securing critical operational environments is now reflected in boardrooms, government priorities, and compliance mandates. Capabilities have deepened, vendors have multiplied, and investment has grown.
That progress is important. But as the market expands, the work has to stay grounded in the environments it protects: physical operations, long-lived systems, and the safety, reliability, and uptime requirements those environments depend on.
Operational environments have a complicated relationship with change. Equipment can remain in service for decades while new technologies, connections, and threats emerge around it. For OT cybersecurity vendors, that creates an important responsibility: innovate in ways that account for the operational realities of the environment you’re protecting.
That is the approach Dragos was built around. As Forrester writes:
“Customers who want to approach OT security from the operations side, and not as a subtask under IT security operations, will do well to partner with Dragos.”
Oftentimes evolving with our customers and their environmental and operational realities means asking more of foundational capabilities.
There’s a familiar phrase in OT: “You can’t protect what you can’t see.” It’s still true. But building an asset inventory was never the end goal. Teams need to understand what matters to operations, why it matters, and what to do about it.
It’s a distinction Forrester calls out plainly in this year’s Wave:
Asset discovery is important, but what’s crucial is recognizing what risks exist inside your zone/site/geography/enterprise and what actions you can take to reduce those risks.
That’s where an OT-native approach matters. Forrester notes that Dragos detection takes “into account anomalies in the operational state as well as how crucial the asset is when rating severity.” The same OT context helps teams prioritize vulnerabilities based on what requires attention Now, Next, or potentially Never.
Building specialized OT cybersecurity technology doesn’t mean keeping OT security isolated. Forrester also notes that Dragos “integrates well with IT security operations centers while preserving OT context.” As OT and enterprise security operations become more connected, the priority is to enable that connection without losing the OT context that makes the information useful.
That collaboration can extend beyond the walls of any one organization. Dragos Neighborhood Keeper was built on the idea that industrial organizations are stronger when they can contribute to and benefit from collective defense. By anonymously sharing threat insights across the community, organizations can learn from activity seen elsewhere without exposing sensitive information about their own environments. That is how everyone gets stronger, not one organization at a time.
This is what OT context is for: it turns visibility into understanding, and understanding into action.
That brings us back to one of the results we mentioned earlier: Dragos received the highest score possible in both Vision and Innovation. For us, those scores reflect a deeply established OT foundation and a view of how OT cybersecurity needs to evolve as the environments themselves expand.
In industrial environments, innovation rarely replaces what came before it. Equipment can remain in operation for decades while new technologies are introduced, connected, and increasingly capable of affecting operations. That means innovation has to account for OT constraints: what can be deployed safely, what can be trusted in operations, and what helps teams act without adding complexity.
Forrester frames that discipline plainly, reminding buyers that OT security is “about protecting the systems within your business that simply cannot go offline.” Innovation matters in these environments, but risking operational resilience is a redline that no security vendor can cross.
The Wave captures the market at a transition point. The question is no longer whether industrial environments need specialized cybersecurity. The question is how that specialized approach extends as more technologies become connected to and capable of affecting operations. Dragos is responding to that transition by extending its OT-native foundation into the broader xOT environment.
Forrester notes that the Phosphorus acquisition will expand Dragos’s capabilities. Since the Forrester evaluation closed, that strategy has continued to move forward, including the first phase of Phosphorus integration, bringing device intelligence into the Dragos Platform. It is a practical example of the broader strategy: extending OT-native visibility, intelligence, and response to more of the technologies capable of affecting operations.
The OT cybersecurity market has come a long way since the case for specialized security still had to be made. And it will keep evolving, as it should. Analyst evaluations like the Forrester Wave have kept pace: as the market expands, capabilities advance, and expectations change, so does the bar for what it takes to lead.
Industrial environments will evolve too, even if change happens differently here than in other technology environments. That makes how we innovate, and what we build from, increasingly important.
There will always be a something new to build. Our responsibility is to make sure what’s next strengthens the security of xOT environments without losing what made OT cybersecurity work in the first place. The mission hasn’t changed: Safeguarding Civilization. The environment we defend it in has.
The full Forrester Wave™: Operational Technology Security Solutions, Q3 2026 offers a valuable look at where the market stands today, the capabilities organizations should consider, and the vendors helping move it forward.
