Deploying OT monitoring that plant engineers accept and the SOC can act on.
We deploy and tune Claroty, Nozomi Networks and Dragos in plants, substations and pipelines. Sensors go where the traffic actually is. Results are mapped to the IEC 62443 zones and conduits your engineers already know.
Mitsubishi Electric completes Nozomi Networks acquisition28 Jan 2026
Claroty product line
connects with
in short·20-second read
Cohash deploys and runs OT security platforms from Claroty, Nozomi Networks and Dragos.
We plan sensor placement on SPAN and TAP points and baseline the traffic. Alerts are tuned with plant engineers and fed to the SOC, and assets are mapped to IEC 62443 zones and conduits. We also staff certified engineers, onsite at US sites or from nearshore and offshore teams across all time zones, on contract, contract-to-hire or permanent terms.
you probably need this if
Nobody can say how many PLCs, RTUs and HMIs run at each site.
The OT platform is installed, but its alert queue hasn't been opened in weeks.
Vendor engineers reach controllers through a shared remote desktop account.
28 Jan 2026Mitsubishi Electric completes Nozomi Networks acquisition Nozomi Networks now operates independently as a wholly owned subsidiary of Mitsubishi Electric. The deal was announced on 9 Sep 2025. source ↗
today · Oct 22, 2026
no date yetClaroty product lineClaroty lists xDome, xDome Secure Access and Continuous Threat Detection (CTD) for industrial sites.source ↗
no date yetDragos Platform and servicesDragos lists the Dragos Platform alongside the OT Watch managed service and the Neighborhood Keeper community program.source ↗
no date yetISA/IEC 62443 seriesISA publishes the series, including ANSI/ISA-62443-2-1-2024 for asset owner security programs and 62443-3-2 for risk assessment in system design.source ↗
the story · ot security: claroty, nozomi, dragos estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your OT security: Claroty, Nozomi, Dragos estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · ot security: claroty, nozomi…3 open
openNobody can say how many PLCs, RTUs and HMIs run at each site.
recurringThe OT platform is installed, but its alert queue hasn't been opened in weeks.
blockedVendor engineers reach controllers through a shared remote desktop account.
exposure
Platform selection and proof of…Sensor architecture and deploymentBaselining and alert tuningIEC 62443 zones and conduitsSOC and ticketing integrationOT security staffing
startrehearsehandover
Site walk and switch trace
Pilot and baseline
Zones, conduits and SOC…
Rollout and handover
we are here
ready to hand over
Each site now has a live inventory, the SOC gets alerts it can actually triage, and the…
The platform sees the traffic that matters, the asset count matches the floor, and the…
Switch trace and SPAN/TAP plan per site and Purdue level
Platform trial scorecard from two vendors on the same traffic
chapter 01 · where it hurts
Why teams reach out
Nobody can say how many PLCs, RTUs and HMIs run at each site.
The OT platform is installed, but its alert queue hasn't been opened in weeks.
Vendor engineers reach controllers through a shared remote desktop account.
chapter 02 · what we change
How we solve it
Platform selection and proof of value
Sensor architecture and deployment
Baselining and alert tuning
IEC 62443 zones and conduits
SOC and ticketing integration
OT security staffing
chapter 03 · how it runs
Our approach
Site walk and switch trace
Pilot and baseline
Zones, conduits and SOC playbooks
Rollout and handover
chapter 04 · where you end up
What changes
Each site now has a live inventory, the SOC gets alerts it can actually triage, and the OT engineer only gets called for real events.
The platform sees the traffic that matters, the asset count matches the floor, and the 62443 zone design rests on real communication paths.
Switch trace and SPAN/TAP plan per site and Purdue level
Platform trial scorecard from two vendors on the same traffic
what we do
Our OT security: Claroty, Nozomi, Dragos work
6 kinds of OT security: Claroty, Nozomi, Dragos work, each run by engineers who have done it on live tenants.
A side-by-side trial of two platforms on the same mirrored traffic at one site, scored on asset discovery, protocol coverage and alert quality with your engineers in the room.
SPAN and TAP planning per cell and level, switch capacity checks, and sensor and central console builds for Claroty CTD or xDome, Nozomi Guardian with Vantage or the Central Management Console, or the Dragos Platform.
Learning periods run with plant staff, so expected engineering traffic, vendor sessions and maintenance windows stop paging the SOC at night.
Asset inventory grouped into zones and conduits in the style of IEC 62443-3-2, with target security levels and the firewall rules that enforce them.
Alerts to the SIEM, assets and vulnerabilities to the CMDB, and playbooks written so a SOC analyst knows when to call the plant rather than isolate a host.
OT security engineers and analysts who have worked in control rooms, onsite at US plants or remote, on contract, contract-to-hire or permanent terms.
capability 01 / 06in production
Platform selection and proof of value
A side-by-side trial of two platforms on the same mirrored traffic at one site, scored on asset discovery, protocol coverage and alert quality with your engineers in the room.
SPAN and TAP planning per cell and level, switch capacity checks, and sensor and central console builds for Claroty CTD or xDome, Nozomi Guardian with Vantage or the Central Management Console, or the Dragos Platform.
Alerts to the SIEM, assets and vulnerabilities to the CMDB, and playbooks written so a SOC analyst knows when to call the plant rather than isolate a host.
OT security: Claroty, Nozomi, Dragos situations we walk into
We pieced these together from OT security: Claroty, Nozomi, Dragos situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Twelve water treatment sites, one OT engineer and no inventory
composite · not a client story
Beforethe situation
A water utility runs twelve treatment and pumping sites on a mix of PLC brands. One OT engineer covers all twelve, there's no asset inventory, and the state regulator wants evidence of monitoring.
What we dothe work
We trace switches at the two biggest sites, place sensors on SPAN ports per cell and run a two-week baseline with the OT engineer. Smaller sites get a lighter pattern, and alerts route to the existing IT SOC with OT playbooks.
Afterwhere you end up
Each site now has a live inventory, the SOC gets alerts it can actually triage, and the OT engineer only gets called for real events.
case file 02
Sensors on the core switch, blind inside the cells
composite · not a client story
Beforethe situation
A manufacturer deployed an OT platform two years ago with one sensor per plant on the core switch. Most PLC-to-HMI traffic never reaches it, and the asset count looks far too low.
What we dothe work
We trace cell switches on one line, add TAPs where SPAN capacity is short and compare discovered assets before and after. Then we design the zone and conduit model from the fuller picture.
Afterwhere you end up
The platform sees the traffic that matters, the asset count matches the floor, and the 62443 zone design rests on real communication paths.
How a OT security: Claroty, Nozomi, Dragos engagement runs
We don't start a step until the last one has produced something you can check.
step 01
Site walk and switch trace
We walk the site with a controls engineer, trace switch topology per Purdue level and pick SPAN and TAP points. Switch load is measured before anything is mirrored.
step 02
Pilot and baseline
Sensors go in at one site first. The baseline covers a normal production week and a maintenance window, and plant staff sit with us to review every alert.
step 03
Zones, conduits and SOC playbooks
We group assets into IEC 62443 zones and conduits and switch on the SIEM and CMDB integrations. The playbooks tell analysts when an alert means calling the plant.
step 04
Rollout and handover
Remaining sites follow the pilot pattern. We hand over sensor configs, tuning notes and a monthly review routine to the team that will run it.
ai on ot security: claroty, nozomi, dragos
Where AI fits on OT security: Claroty, Nozomi, Dragos, and where it needs guardrails.
All three OT security vendors have AI on their monitoring data now, shipped or in the works (Nozomi Vantage IQ, Dragos EmberAI, Claroty Claire). They help analysts triage and investigate. Plant engineers still have to agree before anything touches the process.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
OT security: Claroty, Nozomi, Dragosdoes the work
Claroty, Nozomi Networks and Dragos don't have official MCP servers, as far as we found. Agents should read from the central console's APIs in the industrial DMZ, with a read-only service account and every call logged. Never let them send active queries to controllers. Changes go through plant change control.
Nozomi Vantage IQ
AI analytics in Nozomi Vantage that rank the most urgent asset, vulnerability, sensor and alert issues, correlate alerts into events and recommend sensor placement. We tune it with plant staff so its priorities match how the site actually runs.
Dragos EmberAI
Dragos trained this AI on its xOT intelligence. Ask it about assets, alerts, vulnerabilities and threats in plain language and it walks you through investigation steps. Our part is fitting it into SOC playbooks, so analysts know when it's time to call the plant.
Claroty Claire
Claroty describes Claire as a CPS-native AI security agent it's building, aimed at contextual insights and agentic actions with human-in-the-loop protection. Until engineers approve more, we'd limit any automated action to alerts and tickets.
AI around OT programs
We'd use AI for two things here: drafting IEC 62443 zone and conduit documentation from asset inventories, and summarizing alert history for monthly reviews. OT engineers correct the drafts and approve them.
Passive sensors read mirrored traffic from control and site networks and report to a central console in the industrial DMZ. The console feeds alerts to the SOC and assets to the CMDB, while vendor access reaches the plant only through a recorded jump path.
01 · Control (levels 0 to 2)
PLCs and RTUsModbus · DNP3 · EtherNet/IP → OT sensors · mirrored traffic
HMIs and engineering WSoperator · vendor tools → OT sensors · mirrored traffic
02 · Site operations (L3)
OT sensorsClaroty · Nozomi · Dragos → Central console · alerts · assets
HistorianPI or IP.21 → Central console · asset context
03 · Industrial DMZ
Central consoleon-prem console or SaaS → SIEM · syslog alerts→ ServiceNow · asset inventory
What a OT security: Claroty, Nozomi, Dragos engagement leaves behind
These are working documents, written against your configuration, so your team can run them without us.
plan01
Switch trace and SPAN/TAP plan per site and Purdue level
yours to keep
report02
Platform trial scorecard from two vendors on the same traffic
yours to keep
report03
Baseline report with every pilot alert explained or tuned
yours to keep
design04
IEC 62443 zone and conduit diagram with target security levels
yours to keep
runbook05
SOC playbooks for OT alerts, including when to call the plant
yours to keep
document06
Sensor configuration and tuning notes for the run team
yours to keep
talent and delivery · ot security: claroty, nozomi, dragos
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
due diligence · ot security: claroty, nozomi, dragos
Questions to ask any partner, including us.
Put these to anyone bidding on your OT security: Claroty, Nozomi, Dragos work. The ones who've done it answer differently from the ones who've read about it.
Q1
How will you decide where sensors go inside our cell networks?
Control traffic often stays inside cell switches. A partner who only proposes one sensor per site on the core switch will miss most of it.
Q2
What is your plan if SPAN load is too high on our older switches?
Mirroring on old managed switches can affect performance. TAPs, aggregation or staged mirroring need to be in the plan before work starts.
Q3
Which of our control vendors' protocols does each shortlisted platform decode in depth?
Asset detail and alert quality depend on protocol support for your exact PLCs and DCS. Ask for proof on your traffic, not on a lab capture.
Q4
How will OT alerts reach our SOC, and who writes the playbooks?
Give a SOC analyst an OT alert and no playbook, and they'll either ignore it or isolate a host that runs the process. Neither is good.
Q5
How does the asset inventory turn into IEC 62443 zones and conduits?
Monitoring data is only the input. Regulators and insurers ask to see the zone model, the target security levels and the firewall rules.
01Claroty, Nozomi Networks or Dragos?
It depends on your protocols, your sites and who will run it. All three do passive asset discovery and threat detection. The differences that matter show up in protocol depth for your control vendors, how the central console fits your network, managed service options and how well alerts read to your SOC. We test two on your own mirrored traffic before you buy.
02Does passive monitoring put the process at risk?
Passive sensors read mirrored traffic from SPAN ports or TAPs and don't send anything to controllers. The risks are switch capacity on old hardware and active queries if you switch them on. We check SPAN load first and agree any active polling with the plant engineers before it runs.
03How many sensors do we need?
It depends on where traffic actually flows. One sensor per site is rarely enough when control traffic stays inside cell switches. We trace the switch topology and pick SPAN or TAP points per level, then size the sensors from measured traffic.
04What does IEC 62443 work involve here?
The monitoring platform gives you the asset and communication inventory. We group those assets into zones and conduits, set target security levels with your engineers and write the firewall rules and remote access controls that enforce them.
05Has the Nozomi Networks ownership change affected customers?
Mitsubishi Electric completed its acquisition on 28 January 2026, and Nozomi Networks says it operates independently as a wholly owned subsidiary and stays vendor-agnostic. Customers should still check renewal terms and the product roadmap with their account team.
06Can you staff OT security analysts for our SOC?
Yes. We place OT security engineers and analysts who understand control networks, onsite at US plants or remote from nearshore and offshore teams, across all time zones.
services
Related services
Projects on OT security: Claroty, Nozomi, Dragos usually end up touching one of these, so they're worth a look.
Reviewed by the Cohash teamOT security: Claroty, Nozomi, Dragos is a trademark of its owner, used here to identify the platform.how we handle facts and data →
next step
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
