# Accenture's $4.1 Billion OT Cybersecurity Play: Dragos, runZero, and NetRise Converge
Accenture announced a major consolidation of the industrial cybersecurity landscape on Thursday, taking a majority stake in Dragos (valued at $3.25 billion) and fully acquiring runZero and NetRise in a combined transaction valued at approximately $4.175 billion. The mega-deal signals an aggressive pivot toward operational technology (OT) security and reflects intense competition among systems integrators to own the critical infrastructure defense market.
The acquisitions are expected to close in August and September 2026, with all three companies operating under the Dragos banner as an independent business unit within Accenture's cybersecurity portfolio.
## The Players: What Each Company Brings to the Table
Dragos remains the anchor of this consolidation. Founded by former US Air Force cyber warfare officer Robert M. Lee, the platform-first vendor has spent over a decade building the industry's leading vendor-neutral OT threat detection system. Dragos' technology stack includes behavioral analytics, threat intelligence, and specialized detectors for industrial control systems (ICS) environments—the nervous systems of power grids, manufacturing facilities, water treatment plants, and other critical infrastructure.
runZero, founded by HD Moore (the creator of Metasploit), brings cutting-edge asset discovery and attack surface management capabilities. The platform excels at identifying and cataloging every connected device in sprawling OT environments—a critical foundation for security when you cannot defend what you cannot see. runZero's agentless scanning approach is particularly valuable in air-gapped or legacy systems where traditional vulnerability management tools fail.
NetRise, led by former US Marine Thomas Pace, adds deep firmware analysis and software supply chain visibility. In an era where adversaries target the firmware and software that runs industrial devices, NetRise's ability to decompose and analyze binaries for vulnerabilities and backdoors fills a significant gap in the OT security toolkit.
| Company | Founded | Core Capability | Founder Background |
|---------|---------|-----------------|-------------------|
| Dragos | 2013 | OT threat detection, behavioral analytics | Former USAF cyber officer |
| runZero | 2020 | Agentless asset discovery, attack surface | Metasploit creator |
| NetRise | 2019 | Firmware analysis, supply chain visibility | Former US Marine |
## The Strategic Rationale: Building an OT Security Powerhouse
Accenture's move should be understood in the context of ServiceNow's $7.75 billion acquisition of Armis Security announced last year—a defensive acquisition that consolidated asset intelligence and IT security under a single vendor. Accenture's response is to build an equivalent OT-focused platform by combining asset discovery (runZero), device intelligence (NetRise), and threat detection (Dragos) into a cohesive stack.
"Our agreement to acquire a majority stake in Dragos and all of runZero and NetRise is the type of move that defines our strategy," said Accenture Chair and CEO Julie Sweet. "It is expanding our addressable market, creating a new platform-led growth opportunity, and positioning Accenture at the center of one of the most critical cybersecurity challenges our clients face."
The combined entity is projected to deliver approximately $208 million in annual recurring revenue (ARR) as of June 2026—a 53% year-over-year increase—signaling the explosive growth trajectory of the OT security market as operators finally prioritize asset visibility and threat detection after decades of deferred investment.
## Why This Matters: The OT Security Inflection Point
For years, OT cybersecurity was a niche market dominated by specialized vendors with limited reach. Accenture's acquisition changes the game in three ways:
1. Scale and Distribution: Accenture's $70+ billion revenue engine and global client relationships will expose Dragos, runZero, and NetRise to thousands of enterprises and critical infrastructure operators who lack specialized OT security expertise. Many utilities, refineries, and manufacturers will encounter these tools through their Accenture consulting engagements—a massive distribution advantage.
2. Integration and Interoperability: The three platforms will begin integrating, creating a unified asset-to-threat-response workflow. An operator can now discover all assets with runZero, understand their firmware and supply chain risk with NetRise, and detect adversarial behavior with Dragos—all within a single platform and ecosystem. This interoperability gap has been a persistent pain point for customers cobbling together best-of-breed tools.
3. Threat Intelligence Amplification: Accenture brings proprietary datasets from its extensive consulting practice, managed security services, and incident response engagements. When combined with Dragos' threat intelligence and the visibility from runZero and NetRise, this creates a feedback loop where customer deployments improve the product, and the product gets better for all customers. That network effect is defensible and difficult to replicate.
## The Broader M&A Context: Industrial Cybersecurity Consolidation
This deal is part of a broader wave of consolidation in the cybersecurity market. SecurityWeek's M&A tracker has cataloged approximately 190 cybersecurity deals in 2026 to date, indicating a market still in acquisition mode as large platforms attempt to own more of the customer relationship.
Accenture itself acquired IAMConcepts and CyberCX in 2025, both moves designed to deepen its consulting bench and platform capabilities. The Dragos, runZero, and NetRise acquisitions follow a similar pattern: acquire specialized platforms, integrate them into the larger consulting practice, and monetize through advisory services, managed services, and platform licensing.
## Market Implications and Competitive Dynamics
For independent OT security vendors: This deal raises the bar for survival. Single-point-of-sale vendors (threat detection only, or asset discovery only) will face pressure to consolidate or differentiate sharply. Competitors like Fortinet, Claroty, Waterfall Security, and Schneider Electric's cybersecurity arm will need to respond with equivalent platform breadth or risk losing deals to Accenture's integrated approach.
For Dragos' customers: The Dragos platform remains independent under CEO Robert Lee's leadership, maintaining its vendor-neutral stance. However, Accenture's ownership will inevitably create closer ties to Accenture's broader services and infrastructure. Customers should anticipate integration with Accenture's Security Operations Center (SOC) services, managed response offerings, and consulting workflows.
For runZero and NetRise customers: Expect rapid platform convergence. The asset discovery and firmware analysis tools will likely be bundled with Dragos threat detection, creating a unified data model and user experience. Standalone subscriptions may migrate toward tiered platform offerings.
## Technical and Organizational Details
Robert Lee will continue as CEO of Dragos and will oversee runZero and NetRise as subsidiaries. Lee is also a Lieutenant Colonel in the Army National Guard serving as Executive Officer at the Integrated Operations Security Center (IOSC) in the 91st Brigade, focused on OT and Industrial Control System (ICS) cybersecurity and incident response—a detail that underscores the military-grade credibility behind this platform.
The deals are structured as follows:
Closings expected in August and September 2026, subject to standard regulatory and closing adjustments.
---
## HackWire Analysis
Why This Matters Right Now
This acquisition reflects a market inflection point that should concern every organization running OT environments. For two decades, critical infrastructure operators deferred OT cybersecurity investments, treating it as a "keep the lights on" problem rather than a strategic security challenge. Accenture's $4.1 billion bet signals that this era is ending.
The timing is critical: industrial ransomware has evolved from crude attacks on IT networks to sophisticated threats targeting PLCs, HMIs, and safety systems directly. The Dragos intelligence feeds track this escalation in real-time, and the runZero asset discovery addresses the visibility gaps that make these attacks possible. Accenture's acquisition packages these tools into a vendor-neutral, scalable offering that finally brings OT security to the mainstream consulting agenda.
The Hidden Competitive Angle
ServiceNow's $7.75 billion Armis acquisition was widely read as a move to compete with Crowdstrike and CrowdStrike. But it was actually a land grab for device-centric security—the idea that if you can see and understand every connected asset, you can detect and respond to threats at scale. Accenture's Dragos deal is the OT world's answer to that same thesis. Both are betting that asset intelligence, not perimeter defense, is the future of infrastructure security.
The difference: ServiceNow targets IT and IoT; Accenture is targeting OT and critical infrastructure. These markets barely overlap. The real competition will be between Accenture (now with Dragos) and vendors like Fortinet, Schneider Electric, and Claroty who are building similar stacks in-house or through acquisition.
The Vendor Consolidation Risk
For organizations already invested in Dragos, runZero, or NetRise, this raises an important question: will these platforms remain truly vendor-neutral and independent, or will they gradually favor Accenture-native integrations? Lee's public statements emphasize independence, and Dragos' track record supports vendor neutrality. But shareholders and integration pressures will eventually push for tighter coupling. Organizations should negotiate for platform independence and data portability guarantees before signing multi-year contracts with the combined entity.
— HackWire Editorial
---
## Related Coverage