Dragos Segmentation
Every permitted path. Every rule behind it. Dragos Segmentation reveals what your network permits from the configurations you already have.
81% of Dragos architecture reviews found poor IT/OT segmentation. When boundaries fail, an intrusion can move toward critical operations. Validation turns segmentation from an assumption into evidence for security and compliance.
From Network Configurations to Evidence
Upload configuration files or schedule automated collection from more than 25 vendors. Dragos Segmentation parses them into a topology map of your network.
Use the Connectivity Matrix to see which zones are permitted to communicate, then trace permitted paths between assets to the rules behind them.
Flag overly broad or undocumented access, then trace each finding to the exact rule and source file responsible.
Produce Segmentation, Best Practice, and NERC CIP-005 PDF reports from current configurations, ready for security reviews and audits.
ICS networks span legacy and modern infrastructure, multiple vendors, and sites with different connectivity requirements. Dragos Segmentation works across that reality.
Network segmentation in OT environments is verified by analyzing the configurations that enforce it, not by traffic monitoring alone. Monitoring shows which systems are communicating; configuration analysis shows which systems are permitted to communicate. Dragos Segmentation reads firewall, router, and switch configurations and shows every path they permit, traced to the rule behind each one.
No. Dragos Segmentation does not require sensors, and uploading configuration files generates no traffic on the OT network. It is licensed independently and runs on a Dragos SiteStore, so it can assess sensitive, brownfield, and air-gapped environments.
Yes. Dragos Segmentation generates a NERC CIP-005 Report, along with Segmentation and Best Practice reports, directly from current configurations. It provides evidence for compliance work and audit preparation; it is not an attestation of compliance.
NERC CIP-005 asks whether your boundaries are controlled; CIP-015 asks whether you can see what happens inside them. CIP-015 requires internal network security monitoring, and FERC approved CIP-015-2 in August 2026, extending that monitoring beyond the Electronic Security Perimeter to EACMS and PACS. Dragos Segmentation does not perform that monitoring. It shows what the configurations permit inside the boundary, which is what makes monitoring meaningful: you can only recognize unexpected traffic if you know what traffic should be there. Dragos Platform monitoring provides the internal network security monitoring; Dragos Segmentation provides the permitted-access context around it.
Yes. Section 8C of Australia’s Enhanced CIRMP Rules requires operators of nine critical infrastructure asset classes to maintain an inventory of critical systems and how they connect, and to segregate those systems with logical access controls on network traffic. Dragos Segmentation provides evidence for the connectivity inventory and logical access control elements of 8C, drawn from the firewall, router, and switch configurations that enforce them. It does not test the three-month independent operation requirement or collect access logs, and it is not an attestation of compliance.
Yes, as a source of evidence. Article 21 of NIS2 requires essential and important entities to secure their networks, set access control policies, and assess whether those measures work. Dragos Segmentation shows what the network configurations permit, which supports both the access control policies and the assessment of whether they are enforced as intended.
Yes, as a source of evidence. TSA security directives for pipelines and rail require network segmentation policies and controls so OT can keep operating safely if IT is compromised, along with access controls for the paths between them. Dragos Segmentation shows every path the configurations permit between IT and OT, traced to the rule behind each one, which supports documenting and reviewing those controls.
Yes, as a source of evidence. IEC 62443 organizes an OT network into zones and the conduits that connect them, with access between zones restricted to what is needed. Dragos Segmentation shows which zones can reach which and the rules that permit each conduit, so teams can check that permitted access matches the zone design.
Dragos Platform monitoring shows which systems are communicating, and Dragos Segmentation shows which systems are permitted to communicate. Used together against one asset inventory, they let teams verify compensating controls for unpatched assets, scope an incident by permitted reach, and check whether legacy or undocumented assets are exposed.
Dragos Segmentation is the evolution of NP-View into the Dragos Platform. Dragos acquired Network Perception, the company behind NP-View, in 2024. Dragos Segmentation builds on the same configuration analysis technology NERC auditors in all six regions have trusted for years in CIP-005 audits, and brings it into the Dragos Platform with enhanced speed, enterprise scale, improved reporting and more.