Nozomi Networks, Inc. is a cybersecurity company headquartered in San Francisco, United States. It focuses on operational technology, known as OT, which controls physical facilities, as well as connected Internet of Things devices. Its solutions are aimed particularly at organizations in the energy, manufacturing, transportation and water sectors, where a cyber incident can have direct consequences for production or safety.
Roots in industrial systems security
Founded in 2013 by Andrea Carcano and Moreno Carullo, Nozomi Networks was built around a problem specific to industrial environments: how can networks made up of heterogeneous, sometimes aging equipment be monitored without disrupting their operation? In these infrastructures, conventional IT security methods are not always applicable. An industrial controller cannot necessarily be updated like a computer, and a service interruption may be difficult to accept.
The company expanded its business as factories and critical infrastructure became increasingly connected to business IT systems. This convergence between traditional IT and operational networks broadens monitoring capabilities, but also the paths an attacker can take to reach field equipment.
Observing networks, identifying risks
Its offering is built on asset discovery and communications analysis. Guardian sensors monitor networks and establish an inventory of devices, their communications and their behavior. Passive traffic monitoring plays an important role in this approach: it aims to collect information without directly interacting with potentially sensitive systems.
The Vantage cloud platform centralizes visibility and analysis across multiple sites. It helps security teams correlate alerts, vulnerabilities and operational context to prioritize their responses. Nozomi Networks also offers Arc, a software sensor deployed on endpoints that supplements the information available from the network.
These tools aim to identify both suspicious behavior and unusual changes within facilities. Their value depends in particular on an understanding of industrial protocols and the expected operation of equipment. The work of Nozomi Networks Labs, dedicated to threats and vulnerabilities, contributes to this expertise. The solutions can also send their information to the security monitoring tools already used by customers.
What comes next?
The proliferation of remote connections and communicating devices sustains the need for visibility into industrial environments. For Nozomi Networks, the challenge will be to turn this visibility into relevant operational decisions without multiplying alerts that are difficult to act on. Stricter regulatory requirements, particularly in Europe with NIS 2, support this demand. The ability to support legacy equipment, integrate operators’ processes and demonstrate a tangible reduction in risk will remain decisive.