Exposure Management

Threat Detection & Monitoring

Dragos

Key Findings

• Comprehensive OT asset discovery and inventory.
• Behavioral and anomaly-based threat detection.
• OT asset visibility for PLCs, HMIs, DCS, and SCADA systems.
• Supports vulnerability management and incident response.

Strengths

• OT-aware analytics.
• SIEM integration through Splunk.
• Reduced false positives through OT-focused detections.

Trellix

Key Findings

• Discovers unmanaged OT assets automatically.
• Integrates operational threat intelligence and investigation workflows.
• Centralized management through ePO.

Strengths

• Extensive threat intelligence visibility.
• Automated asset discovery.
• Supports threat hunting and investigations.

Limitations

• Some features require supporting subscriptions and integrations.
• Legacy OT environments may limit endpoint visibility.

OT Asset Visibility

Executive Summary

OT visibility platforms provide foundational capabilities for inventory management, behavioral baselining, protocol awareness, and security operations integration.

Core Findings

Asset Discovery

• Inventories PLCs, HMIs, DCS, SCADA, operating systems, and industrial protocols.
• Uses passive monitoring to avoid operational disruption.

Asset Context

• Correlates protocol, behavioral, and communications data.
• Enables better risk prioritization and asset classification.

Integration

• Integrates with SIEM platforms such as Splunk.
• Shares asset visibility data across security platforms.

Recommended Practices

• Deploy passive sensors first.
• Establish complete OT asset inventories.
• Integrate OT telemetry into enterprise SIEM platforms.
• Leverage OT-focused threat intelligence feeds.