Dragos has acquired Phosphorus, a connected-device security specialist, extending its platform to cover the full Extended Operational Technology (xOT) environment - the growing mix of industrial control systems and billions of connected devices embedded across critical infrastructure networks. The deal, announced June 1, 2026, marks Dragos's second acquisition in under two years as the company pursues a consolidated platform strategy for operational technology (OT) security.

Background

Operational networks in sectors such as energy, manufacturing, water, transportation, and data centers increasingly combine traditional industrial assets with large numbers of connected devices - cameras, sensors, badge readers, HVAC systems, and networking equipment - that often fall outside established OT security programs. This expanded environment, which Dragos defines as xOT, has become an active attack surface. According to the company, adversaries already operate across it, targeting assets that defenders lack visibility into.

The acquisition builds on Dragos's prior expansion. In October 2024, Dragos acquired Network Perception, adding OT network visibility, segmentation validation, and compliance capabilities to its platform. Where Network Perception addresses the network architecture layer, Phosphorus targets the devices operating within that architecture - creating what Dragos describes as a more integrated approach to industrial security. This move reflects broader market dynamics detailed in earlier coverage of systemic OT security gaps in 2026, including the finding that fewer than 30% of OT networks maintain cross-boundary visibility.

Details

Nashville, Tennessee-based Phosphorus had raised approximately $65 million in venture funding prior to the acquisition, including a $38 million round closed in early 2022. Financial terms of the current transaction were not disclosed. Phosphorus was founded in 2017 by Chris Rouland, Earle Ady, and Rebecca Rouland.

The Phosphorus platform discovers connected devices across OT and enterprise environments, automates remediation workflows - including password rotations, firmware updates, certificate management, and configuration hardening - and integrates with existing infrastructure without requiring disruptive architectural changes, according to the company.

"The connected devices you find everywhere in critical infrastructure are largely invisible to the cybersecurity programs that protect operational environments," said Robert M. Lee, CEO and Co-Founder of Dragos. "With Phosphorus, we close that gap and secure xOT, the full environment that matters."

Sonu Shankar, President and COO of Phosphorus, framed the combined capability as addressing persistent device-level security failures: "the unmanaged devices, the default credentials, the firmware no one was updating." Shankar will continue to lead the Phosphorus business as General Manager within Dragos through a structured, phased integration.

With the addition of Phosphorus's connected-device security capabilities, Dragos estimates its total addressable market has expanded to more than $50 billion, based on third-party research from MarketsandMarkets and Polaris Market Research. The combined entity serves critical sectors including energy, manufacturing, water, transportation, and data centers across North America, EMEA, and APAC.

Outlook

According to Dragos, existing customers will gain expanded asset visibility and integrated device intelligence in the near term, with automated remediation workflows and deeper platform integration planned through a phased rollout. Phosphorus customers will continue to receive full support as integration progresses. The deal signals accelerating consolidation in OT cybersecurity as vendors move to cover not only core industrial control systems but the broader connected-device estate that industrial attackers increasingly exploit as an entry point - a risk further documented in analysis of threat actors targeting OT/CP networks and the shift to intelligence-driven OT security.