Last week founders HD Moore of RunZero and Tom Pace of NetRise joined Dragos founder and CEO Rob Lee on a webinar to discuss how they will work together now that they are all Dragos. The first 53 minutes are filled with HD’s and Tom’s career origin story, personality meshing, and other lighthearted banter. The last 5 minutes are the must see as Rob unveils the “Integrated Platform Story”, and the slide you see in this article.
The pull quote from Rob:
Here’s the vision that I have. I like the idea that you have some firewall or data diode. Your segmentation strategy. And then south of that firewall is Dragos. And I don’t want you to have 20 or 30 point solutions. And I don’t want you to have a vendor that says I can do IT and OT. We’re not going to be that. We are going to be the people that tell you we can do Operational Technology.
This isn’t quite as broad as it sounds. I asked Rob if this means Dragos is going to acquire or build an OT EDR solution. He said no, but they would be looking to “collect more data from assets”. There are likely a couple of other OT security product categories that aren’t in the vision, but not many. I wouldn’t be surprised if there are additional Accenture/Dragos acquisitions (maybe a risk management solution).
This is a challenge, or acquisition opportunity, for companies with adjacent or complementary technology to the Dragos platform. Take Frenos as an example. Their focus may lead them to have the best technical “point” solution. And for a Dragos customer or prospect it will need to compete against all the other Dragos offerings in the platform. Often there is one pot of OT security money that multiple different solution types are fighting over.
I wrote a three-part analysis series on the Accenture/Dragos/runZero/NetRise deal. From Part 2: The Dragos Product:
Successfully integrating one acquired product into your platform is challenging. Dragos is trying to integrate four (Network Perception, Phosphorus, runZero, NetRise). The right thing to do would be to analyze each of the four product integrations based on the fit and market demand. I can’t get over the audacity (mistake?) of trying to do four at once. If they are successful, measured by the resulting platform and marginal sales, with two of the four it would be a huge accomplishment.
This remains my thinking four months later. It’s based on history in and out of the cybersecurity world. McAfee/Network Associates tried it and failed. Cisco has tried it and failed. Fortinet offers a broad suite of solutions, and yet almost all of the revenue is from firewalls and switches. There are books on the difficulty of combining two tech stacks after an acquisition.
Perhaps they will not combine the tech stacks, and rather bring them forward as multiple tech stacks that communicate with each other. This is made much easier with agentic AI. A problem with this approach is you also carry forward a lot of visible and hidden technical debt.
Enough of that, let’s look at the integrated platform vision which Rob walked through in the final five minutes.
- Exposure Management is the runZero solution
- Software & Supply Chain Management is the NetRise solution
- Device Remediation & Validation is the Phosphorus solution
- Segmentation Validation is the Network Perception solution
The long term win I’d bet on is the OT Software & Supply Chain Management solution. It’s an early solution segment in a still early OT security market. This is true even though we started seeing OT focused SBOM solutions in 2021/2022. Asset owners will want to be able to query something to determine if the firestorm vulnerability du jour is in their system. They will want something that has their OT cyber asset inventory, and can send SBOM queries to an authoritative source. Dragos is now well positioned to be that source.
The product is part of it, but more importantly it is the relationships, resources, and mindshare Dragos has. I’ll be watching to see if any of the large ICS vendors, Emerson, Siemens, Honeywell, … decide to share their SBOMs with a Dragos service offering. This could be another source of ARR that Accenture craves.
I’ll close this with one last quote from Rob Lee’s vision:
Put that all together to just let you type a question and get an outcome, get an answer.