Dragos has acquired Phosphorus, adding connected-device discovery and remediation to its operational technology cybersecurity platform as industrial networks become harder to defend at the asset level. Terms were not disclosed.
The target fills a practical gap in Dragos's product stack. Dragos built its franchise on OT visibility, threat detection, and incident response for critical infrastructure operators. Phosphorus brings control over the devices that often sit outside formal security programs but still shape operational risk, including unmanaged equipment, internet-connected sensors, building systems, and other embedded assets spread across plants, pipelines, utilities, and data centers.
That matters because industrial cybersecurity has moved beyond the classic OT perimeter. Attackers do not care whether a vulnerable asset is labeled IT, OT, or IoT if it can provide access, persistence, or operational disruption. Buyers increasingly want one platform that can identify assets, map risk, and automate fixes such as password rotation, firmware updates, certificate management, and configuration hardening. Dragos is buying that capability rather than building it slowly in-house.
The acquisition also looks defensive. OT security has been converging toward broader exposure management, where vendors that only monitor networks risk being pushed down the stack by platforms that can also remediate. Dragos's October 2024 purchase of Network Perception added segmentation validation and network architecture analysis. Phosphorus extends that logic from the network layer to the device layer, giving Dragos a more complete claim on the industrial cyber budget.
There is a market timing element as well. Acquire.fyi data shows technology M&A volume is down 9.5% year to date, while median deal size has risen 34.1%, a pattern that suggests buyers are becoming more selective and paying for assets that close product gaps quickly. Phosphorus fits that mold.
Integration will be the real test. Dragos said Phosphorus customers will continue to be supported and that Phosphorus President and COO Sonu Shankar will remain with the business as a general manager. Keeping the leadership team in place should help preserve technical continuity, but customers will want proof that automation can be layered into sensitive industrial environments without creating operational friction or compliance headaches. Rivals in OT and cyber-physical security are unlikely to wait long before answering with acquisitions of their own.
Source: Company press release and Acquire.fyi's proprietary data
