Dragos, Inc.

1.1 Corporate Identity, Operating Footprint, and Strategic Mission

Dragos, Inc. is a specialized operational technology (OT) and industrial control systems (ICS) cybersecurity software and services provider founded in 2016 and headquartered in Hanover, Maryland. The company's corporate identity is anchored in a dedicated industrial defense mission: protecting physical infrastructure—including electricity transmission, oil and gas pipelines, water distribution, and discrete manufacturing facilities—from state-sponsored adversaries and criminal extortion groups. Unlike traditional IT security platforms that rely primarily on endpoint agents or enterprise event logging, Dragos provides specialized network monitoring, passive protocol inspection, asset discovery, vulnerability prioritization via its Now-Next-Never model, and codified threat intelligence specifically engineered for cyber-physical systems. As of 2026, Dragos operates globally across North America, EMEA, and APAC, employing approximately 580 personnel from its Hanover headquarters alongside regional presences in the United Kingdom, Australia, New Zealand, the Middle East, and Japan.[CO001, CO002, CO003, CO004]

1.2 Founders, Executive Leadership, and Governance Architecture

Dragos was co-founded by ex-National Security Agency (NSA) cyber operators Robert M. Lee, Justin Cavinee, and Jon Lavender, who established the firm following high-profile industrial incident investigations, notably the cyberattacks on the Ukrainian electric grid. Robert M. Lee serves as Chief Executive Officer, leading executive strategy, product vision, and government relations, while maintaining a high public profile across national critical infrastructure policy forums. The executive bench combines commercial enterprise scaling with specialized industrial intelligence capabilities, supported by regional leaders such as Hayley Turner (Vice President for Asia-Pacific) and Kaori Nieda (Country Manager for Japan). Under the pending June 2026 Accenture majority acquisition structure, Dragos will continue operating as an independent business unit led by Lee, while absorbing runZero and NetRise under its operating umbrella to integrate attack-surface intelligence and firmware software-bill-of-materials capabilities into a unified extended operational technology (xOT) defense platform.[CO002, CO005, CO006, CO007]

1.3 Capitalization History, Investor Base, and Majority Acquisition

Dragos's balance sheet development reflects substantial strategic and institutional backing across energy, defense, and industrial automation sectors. The company raised a landmark $200M Series D round in October 2021 co-led by Koch Disruptive Technologies and funds managed by BlackRock, establishing a $1.7B private market valuation. Total venture funding across nine rounds reached between $364M and $438M, supported by institutional venture firms including Canaan Partners, AllegisCyber Capital, Energy Impact Partners, and DataTribe, alongside strategic corporate investors such as Emerson, Rockwell Automation, Hewlett Packard Enterprise, National Grid Partners, Schweitzer Engineering Laboratories, and Aramco Ventures. In June 2026, Accenture entered into definitive agreements to acquire a majority stake in Dragos alongside 100% of runZero and NetRise for an aggregate enterprise value of approximately $4.175B, representing an estimated $3.25B standalone transaction value for Dragos and validating the high strategic premium commanded by specialized industrial cybersecurity assets.[CO008, CO009, CO010, CO011, CO012]

1.4 Operational Environment, Ransomware Headwinds, and Threat Exposure

Dragos operates in an increasingly volatile industrial threat landscape characterized by aggressive double-extortion ransomware and nation-state reconnaissance against critical infrastructure supply chains. In its Q1 2026 industrial ransomware analysis, Dragos recorded 1,020 ransomware incidents worldwide impacting manufacturing (633 incidents), ICS engineering and equipment suppliers (139 incidents), and transportation logistics (87 incidents), led by RaaS syndicates including Qilin, Akira, and The Gentleman. While adversaries rarely manipulate industrial control protocols directly, enterprise IT compromises routinely cascade into operational shutdowns, production halts, and data extortion. For Dragos, this climate creates powerful procurement tailwinds but also imposes severe operational risks: client deployments carry zero-tolerance availability requirements, and any failure to detect lateral movement across converged IT/OT boundaries or third-party engineering access poses reputational exposure to the firm.[CO013, CO014, CO015, CO016]

1.5 Exhibits

2.1 Market Boundary, Taxonomy, and Included Spend

Operational technology (OT) cybersecurity encompasses purpose-built hardware, software, and professional incident response services designed to protect industrial control systems (ICS), supervisory control and data acquisition (SCADA) networks, and cyber-physical systems (CPS) against unauthorized access and operational disruption (CM001). The addressable perimeter covers Level 0 through Level 3 of the Purdue Enterprise Reference Architecture, including programmable logic controllers (PLCs), distributed control systems (DCS), remote terminal units (RTUs), and industrial human-machine interfaces (HMIs) (CM001, CM008). Traditional enterprise IT cybersecurity tools—such as active endpoint detection and response (EDR) scanners, routine patch orchestration agents, and corporate vulnerability assessment scanners—are explicitly excluded from safe deployment on native OT networks because active network probing can destabilize fragile industrial automation controllers and trigger catastrophic physical process halts (CM001, CM006). The core spend comprises passive network traffic inspection, specialized industrial protocol parsing (e.g., Modbus, DNP3, Ethernet/IP, PROFINET), OT-specific vulnerability prioritization, and continuous threat intelligence (CM001, CM008). Status quo substitutes remain heavily reliant on basic network air-gapping, manual spreadsheet-based asset inventories, static industrial firewalls, and general IT security platforms relabeled with basic operational marketing stickers (CM001, CM008). Enterprise IT security giants increasingly serve as distribution partners or SIEM/SOC integration hubs rather than direct physical process visibility replacements (CM001, CM007).[CM001, CM006, CM007, CM008]

2.2 Market Sizing, Growth Trajectory, and TAM/SAM/SOM Lenses

Evaluating the industrial cybersecurity market requires distinguishing between broad industrial digital security estimates and the serviceable market for specialized critical infrastructure OT platforms (CM002). Independent market research from Frost & Sullivan projected the global industrial cybersecurity market to expand from $3.3 billion in 2020 to $10.2 billion by 2025, reflecting a compound annual growth rate (CAGR) of 25.3% driven by accelerating infrastructure threat actor activity (CM002). Concurrently, Gartner established the cyber-physical systems (CPS) protection platform category to classify vendors capable of discovery, categorization, mapping, and protection of production and mission-critical environments outside enterprise IT (CM001). Dragos addresses this sector through the Dragos Platform, threat intelligence feeds, and incident response services, recording estimated annual revenue of approximately $96.6 million in 2026 with an estimated workforce of 529 to 877 employees (CM003, CM004). The overall funding environment for pure-play industrial security reached historic peaks following Dragos's $200 million Series D funding round at a $1.7 billion valuation in October 2021, supplemented by a $74 million Series D extension in September 2023, bringing cumulative financing to approximately $438 million to $440 million (CM002, CM005, CM011). However, market sizing disclosures exhibit variance across intelligence providers, and private market ARR transparency remains limited, necessitating structured sizing layers across total addressable spend, serviceable focus segments, and obtainable vendor capture (CM002, CM003, CM012).[CM002, CM003, CM004, CM005, CM011, CM012]

2.3 Buyer Segmentation, Budget Ownership, and Procurement Path

Adoption of OT cybersecurity solutions operates across distinct organizational hierarchies spanning operational engineering teams, plant managers, corporate CISOs, and enterprise risk committees (CM006, CM007). In traditional infrastructure operators, operational technology is managed by VP of Operations, plant engineers, or SCADA directors whose core operational priority is uninterrupted system uptime and physical human safety (CM006, CM009). Conversely, cybersecurity budget ownership is increasingly shifting to corporate Chief Information Security Officers (CISOs) and Chief Information Officers (CIOs) tasked with mitigating corporate-wide cyber catastrophe risk and maintaining board-level governance (CM006, CM007). In municipal utilities and co-ops, supervising engineers and utility operations directors frequently initiate evaluations to resolve critical blind spots in regional grid or water infrastructure (CM007). In large-scale industrial conglomerates and brewing or manufacturing giants, corporate CISOs sponsor standardized platform procurements to eliminate operational blind spots across distributed plant facilities (CM007). Enterprise procurement workflows typically begin with passive architecture assessments or network visibility pilot deployments to establish baseline asset inventories without interrupting active controls (CM008, CM009). Full enterprise rollouts typically span 12 to 18 months, often utilizing IT/OT cloud marketplaces such as Microsoft Azure Sentinel integrations or systems integrator channels like Accenture and World Wide Technology for contract vehicle execution (CM001, CM007, CM009).[CM001, CM006, CM007, CM008, CM009]

2.4 Adoption Drivers, Operational Constraints, and Diligence Gaps

Adoption of specialized industrial cyber protection is accelerated by compounding adversary pressure and strict compliance mandates, but counterbalanced by structural plant constraints (CM006, CM009, CM010). In the first quarter of 2026, Dragos tracked 1,020 ransomware incidents affecting industrial organizations worldwide, with manufacturing accounting for 62% (633 incidents), ICS-related supply chain organizations accounting for 139 incidents, and transportation accounting for 87 incidents (CM010). Modern extortion campaigns systematically weaponize virtualization infrastructure, compromised administrative credentials, and enterprise IT pivots to force operational shutdowns even without executing specialized ICS payload code (CM010). Regulatory requirements—including NERC CIP standards in electric power, IEC 62443 industrial control standards, and national directives such as the U.S. National Cybersecurity Strategy—further compel operators to implement verifiable cyber controls (CM002, CM009). Despite strong demand tailwinds, significant adoption bottlenecks persist (CM009, CM012). Plant operations teams display resistance toward introducing network tooling near legacy controllers, citing potential disruption risks and scarce scheduled maintenance outage windows (CM009). Furthermore, public market sizing data exhibits substantial variance regarding exact pure-play OT software spend versus bundled integration services, while detailed customer count, churn rates, and contractual net revenue retention remain private, representing material diligence gaps (CM003, CM012).[CM002, CM003, CM006, CM009, CM010, CM012]

2.5 Exhibits

3.1 Competitive landscape and buyer alternatives

The relevant competitive set is wider than purpose-built OT monitoring vendors. Dragos officially presents an xOT platform for asset inventory and network monitoring, while the reported addition of NetRise extends the scope toward software and firmware transparency. Those surfaces compete for a consolidated platform decision, but buyers can also assemble adjacent IT detection products, services partners, specialist tools, and internal response teams. An open-source cybersecurity AI framework placed sixth in Dragos's 2025 OT CTF after solving 32 of 34 challenges, demonstrating that task-level automation is becoming a credible substitute for part of the analyst workflow rather than a complete platform substitute. Company product roles spanning MDR, XDR, threat intelligence, cloud delivery, and AI also signal that category boundaries are expanding. Crucially, none of the eight retained sources independently names and benchmarks Dragos against a direct purpose-built OT peer, so the direct-peer row remains an explicit evidence gap rather than a guessed comparison.[CP001, CP006, CP010, CP015, CP016]

3.2 Capability differentiation and delivery posture

The strongest documented differentiation is workflow context around industrial environments, not a verified superiority score. Dragos says its prioritization model narrows action to the 3-6% of vulnerabilities that matter and pairs identified threats with response playbooks and expert xOT insight. Its incident-response paper explains why generic enterprise playbooks can fail in legacy OT: unsupported systems, fragile processes, missing backups, and limited endpoint telemetry make ordinary remediation unsafe. A company-issued job repost describes a planned unified customer experience with a central API serving SaaS, on-premises, and machine integrations, which could reduce fragmentation across intelligence, services, AI, and documentation. These are meaningful product-design signals, but they remain company-issued claims rather than independent performance evidence. Dragos's Q1 2026 ransomware analysis further supports the need for IT-to-OT context, although its 1,020-incident count is based on public victim disclosures and data-leak-site posts rather than a complete market census.[CP002, CP003, CP005, CP007, CP008, CP009]

3.3 Pricing, switching costs, and distribution power

No retained source discloses current Dragos list pricing, realized contract value, discounting, or directly comparable peer pricing. The resulting underwriting gap is material because platform breadth does not establish price competitiveness or expansion economics. Switching costs are more visible qualitatively: the planned unified portal, central API, fleet management, entitlements, and hybrid interfaces would concentrate customer workflows and subscriptions in one control plane. At the same time, Dragos markets distribution through Accenture governance and integration, Microsoft Azure Marketplace and Sentinel, and World Wide Technology services. These routes can lower adoption friction and let customers layer Dragos into existing estates rather than replace every control, but they also give powerful partners influence over implementation, account access, and the surrounding architecture. Dragos's historical $364.2 million funding total and $1.7 billion 2021 valuation indicate substantial prior scale, but neither metric measures current competitive traction.[CP004, CP005, CP013, CP014, CP015]

3.4 Moat durability and displacement risk

Dragos's defensibility appears strongest where industrial context, threat research, response expertise, and deployment knowledge reinforce one another. Legacy OT conditions make generic IT remediation risky, while ransomware-driven IT failures can still cascade into operations; that combination rewards vendors able to interpret both environments. The durability risk is that parts of the workflow are becoming automatable. In the Dragos CTF, CAI showed a 37% early-phase velocity advantage over the top-five human average, yet the same research found that extended judgment and cognitive endurance remained human advantages and warned that a CTF does not reproduce ambiguous, continuously adapting production incidents. The likely outcome is hybrid substitution: AI and adjacent MDR/XDR tools compress routine analysis while specialists retain higher-consequence decisions. Dragos must therefore convert intelligence and services into a cohesive product experience faster than adjacent platforms and channel partners can absorb those functions. Without independent named-peer testing, customer switching data, or comparable pricing, the evidence supports a plausible moat but not a durable winner-take-most conclusion.[CP007, CP009, CP010, CP011, CP012, CP015, CP016]

3.5 Exhibits

4.1 Revenue model is visible; monetization detail is not

The retained evidence supports two commercial pathways: subscription access to an OT cybersecurity platform and specialized services around assessments, incident response, and threat hunting. Multiples labels the revenue model as subscription, while Tracxn describes both the platform and services; Dragos's own site presents platform capabilities and partner-enabled delivery. None of those sources provides list prices, realized prices, contract duration, billing units, revenue recognition policy, or revenue mix. Threat intelligence is clearly part of the offer, but the public material does not establish whether it is sold separately, bundled into platform subscriptions, or used primarily to support services. The resulting model is plausible recurring software plus labor-based delivery, not a quantified SaaS mix.[CI001, CI002, CI003, CI016]

4.2 Top-line signals are unusable without denominator reconciliation

Multiples displays $208 million as June 2026 Dragos revenue and uses it to calculate a 20.1x acquisition multiple, yet the same page describes approximately $208 million of ARR for the combined Dragos, runZero, and NetRise entity. Revenue and ARR are different metrics, and Dragos-only and combined-company denominators are different populations; the source does not reconcile either difference. The page's reported $4.2 billion acquisition price is therefore a transaction marker rather than proof of standalone recurring revenue quality. Dragos's own 2026 threat reporting documents persistent industrial cyber risk, which supports market need, but demand conditions do not establish company revenue, growth, retention, or profitability.[CI004, CI005, CI006, CI013, CI014]

4.3 GTM breadth creates opportunity and an unquantified cost base

Dragos publicly names Accenture, Microsoft, and World Wide Technology as delivery or integration partners, while a 2021 financing report said proceeds would support geographic expansion and practitioner programs. That suggests a direct-and-partner enterprise motion, but the retained evidence contains no channel fees, partner-sourced pipeline share, sales-cycle data, quota productivity, CAC, or payback period. LeadIQ's broad 501-1,000 employee classification and description of a global office presence indicate a meaningful operating footprint, not its cost or efficiency. Service delivery, international coverage, and partner enablement may raise customer value while also adding labor and support costs. Without revenue mix and cost-of-revenue detail, gross-margin quality cannot be inferred from the subscription label.[CI003, CI010, CI011, CI015, CI016]

4.4 Historical financing does not establish current capital adequacy

Funding databases disagree on cumulative capitalization: Tracxn reports $439 million across eight rounds, whereas Multiples reports $432 million across six rounds. Enterprise Times independently documented the $200 million 2021 Series D, a then-total of $364.2 million, and a $1.7 billion valuation, but historical funding raised is not cash available in October 2026. The accessible Nasdaq Private Market text supplies only general investor and legal disclaimers, not issuer transaction data that could resolve current liquidity. No retained source discloses cash, debt, burn, runway, working capital, capex, profitability, or the allocation of acquisition consideration. The financial verdict is therefore evidence-constrained: recurring characteristics are possible, but revenue quality, margin path, and financing dependency remain blocked pending private financial statements and transaction documents.[CI006, CI007, CI008, CI009, CI011, CI012, CI016]

4.5 Exhibits

5.1 Operating Model, Data Collection Modalities, and Scaled Architecture

The core architectural philosophy of the Dragos Platform rests on safe, deterministic visibility across industrial control systems and operational technology (ICS/OT) networks without disrupting sensitive physical automation processes. Industrial operating environments—spanning electric power substations, oil refineries, water treatment plants, and discrete manufacturing facilities—contain sensitive programmable logic controllers (PLCs), remote terminal units (RTUs), and safety instrumented systems (SIS) that cannot tolerate conventional IT vulnerability scanners or high-frequency active polling. To address this operational constraint, Dragos implements a tiered multi-source telemetry architecture comprising distributed passive network monitoring sensors, targeted host-based active collection agents, engineering project file data importers, and localized data aggregation nodes (SiteStores and CentralStores). Passive monitoring operates non-intrusively via network tap or switch SPAN/mirror ports. Dragos hardware and virtual sensors inspect operational network communications in real time using deep packet inspection (DPI) capable of parsing and decoding over 600 proprietary and open industrial protocols, including Modbus, DNP3, EtherNet/IP, IEC 61850, and PROFINET. Because passive monitoring cannot observe endpoints residing on unmonitored network segments or devices that communicate infrequently, Dragos complements passive listening with a safe active collection executable. Deployed directly on Windows-based human-machine interfaces (HMIs) and engineering workstations, the lightweight Dragos Agent interrogates local host configuration, installed patches, firmware revisions, and peripheral connections without injecting disruptive probe packets into operational control loops. Project file imports further ingest logic files from vendor-specific control software to map controller I/O racks and logic configurations offline. Telemetry collected by local sensors flows upstream into Dragos SiteStores (STS-550-E hardware or virtual STS appliances), which aggregate asset inventory, vulnerability mappings, and detection telemetry across connected sensors. A single hardware SiteStore can ingest telemetry from connected sensors monitoring up to 20 Gbps of aggregate industrial network traffic and track up to 500,000 industrial assets. For enterprise-wide critical infrastructure operators managing geographically distributed utilities or multi-facility manufacturing footprints, Dragos CentralStore instances aggregate up to 50 distinct SiteStores, providing a centralized operational console for global querying, multi-site dashboarding, and coordinated incident investigation.[CE001, CE002, CE003, CE004, CE005, CE006]

5.2 Core Platform Capabilities, Threat Behavior Analytics, and Vulnerability Triage

The Dragos Platform operationalizes industrial cyber defense through four core functional capabilities: continuous asset identification, threat behavior detection, risk-based vulnerability management, and guided incident investigation. Unlike conventional IT intrusion detection systems that rely primarily on generic anomaly detection—which frequently triggers massive alert fatigue in industrial environments when batch manufacturing runs shift or operational setpoints change—Dragos prioritizes threat behavior analytics as its primary detection methodology. These analytics characterize specific adversary tactics, techniques, and procedures (TTPs) observed in real-world critical infrastructure intrusions. Dragos encodes threat intelligence directly into executable platform logic through regularly distributed Knowledge Packs. Researched and compiled by Dragos threat intelligence analysts, Knowledge Packs enrich the platform with detection rules, protocol dissectors, asset characterization algorithms, and step-by-step investigation playbooks specifically aligned to tracked industrial threat activity groups such as CHERNOVITE and ELECTRUM. When an alert triggers, the platform provides security analysts with operational context, affected control system asset roles, and scripted response workflows designed to minimize mean time to recovery (MTTR). For industrial vulnerability management, Dragos departs from raw Common Vulnerability Scoring System (CVSS) metrics—which routinely overstate severity in air-gapped or segmented OT networks—by employing its proprietary Now, Next, Never triage model. Platform analysis indicates that only 3% to 6% of disclosed industrial vulnerabilities represent actionable, weaponizable operational threats requiring immediate remediation ('Now'), while the vast majority lack network reachability or operational impact and can be addressed during scheduled maintenance ('Next') or safely deprioritized ('Never'). This prioritization prevents industrial operators from taking critical production equipment offline for non-critical software patches.[CE007, CE008, CE009, CE010, CE011, CE012]

5.3 Integration Ecosystem, Enterprise SOC Convergence, and Diligence Risks

Operational technology security cannot function in isolation from enterprise security operations. Dragos addresses IT/OT convergence through certified API-driven integrations with major enterprise security providers, including Fortinet, Sophos, Microsoft Sentinel, and Splunk. In joint deployments with Fortinet, the Dragos Platform synchronizes dynamically generated asset profiles and threat notifications directly into FortiGate next-generation firewalls and FortiSIEM. Firewalls consume Dragos asset sync profiles to populate dynamic address groups and enforce microsegmentation policies, while enterprise security operations center (SOC) analysts monitor industrial threat events within standard SIEM interfaces without requiring specialized OT engineering console access. Despite these integrations, technical diligence highlights meaningful operational dependencies and architectural limitations. The hardware appliance portfolio spans ruggedized substation-ready DIN-rail units (NS-25-DR certified to IEC 61850-3 and IEEE 1613) to enterprise rackmount units (NS-2050-E processing up to 10 Gbps and 300,000 flows). However, low-power rugged sensors support sustained bandwidth of only 25 Mbps and up to 1,000 monitored assets, requiring substantial hardware replication in sprawling industrial facilities. Furthermore, virtual appliances demand high server compute and storage commitments—requiring up to 48 virtual CPU cores and 192 GB RAM for virtual CentralStore instances—which creates implementation friction in brownfield industrial plants lacking modern hypervisor clusters. From a threat landscape perspective, Dragos intelligence confirms that while ransomware adversaries such as Qilin, Akira, and The Gentleman frequently disrupt manufacturing and energy organizations (accounting for 1,020 industrial ransomware incidents globally in Q1 2026, with manufacturing representing 62%), attackers overwhelmingly gain access via compromised IT enterprise systems, remote access VPNs, and virtualization infrastructure rather than native ICS protocol manipulation. This dynamic places intense commercial pressure on Dragos to expand beyond traditional OT into extended operational technology (xOT), including IoT, IIoT, and enterprise edge devices. Finally, developer and practitioner engagement remains heavily proprietary: the company's public open-source surface is strictly limited to legacy indicators of compromise (such as CRASHOVERRIDE malware IOCs) and minimal customer portal SDK wrappers, reflecting an enterprise-closed ecosystem heavily dependent on proprietary vendor threat feeds.[CE013, CE014, CE015, CE016]

5.4 Exhibits

6.1 Target Customer Segmentation and Buyer Dynamics

Dragos focuses specifically on asset-intensive, operationally dependent critical infrastructure sectors where cyber downtime risks catastrophic safety, environmental, or economic harm. The primary vertical segments comprise electric utilities, oil and gas production and transport, heavy manufacturing, municipal and regional water systems, transportation networks, and defense or government installations (CU001, CU002, CU006). Within these enterprise accounts, buying authority typically bridges Chief Information Security Officers (CISOs) and Vice Presidents of Operational Technology, Engineering, or Plant Operations (CU003). Procurement dynamics historically required specialized justification due to the friction of deploying passive hardware network sensors across proprietary industrial control systems. However, Dragos has mitigated procurement barriers through strategic channel partnerships—most notably an expanded enterprise collaboration with Microsoft enabling platform procurement via Microsoft Marketplace against Azure consumption commitments (MACC), alongside native telemetry ingestion into Microsoft Sentinel (CU004, CU005). Regional expansion is supported by specialized domestic distribution partners, including Macnica in Japan (CU008).[CU001, CU002, CU003, CU004, CU005, CU006, CU008]

6.2 Named Customer Proof and Operational Outcomes

Publicly referenced customers validate production deployments across public power utilities, energy conglomerates, regional water authorities, and industrial manufacturers. Littleton Electric Light and Water Department (LELWD) utilizes the Dragos Platform for real-time asset visibility, network monitoring, and accelerated incident response across municipal power and water systems (CU009). Orlando Utilities Commission (OUC) relies on Dragos to harden municipal electric and water infrastructure security posture (CU010). Koch Industries operationalizes the Dragos Platform to detect ICS threats and filter false-positive alerts across diversified global manufacturing facilities (CU011). Similarly, Trinity River Authority of Texas leverages the Dragos OT Watch managed threat-hunting team to supplement in-house security bandwidth across municipal water treatment infrastructure (CU012). The Boston Beer Company deployed Dragos to secure distributed commercial brewing and packaging plants (CU013). Beyond commercial enterprise accounts, Dragos engages over 1,000 practitioner teams globally via community cyber competitions, including the annual Dragos OT Capture The Flag (CTF) (CU015).[CU009, CU010, CU011, CU012, CU013, CU015]

6.3 Adoption Trajectory, Expansion Surfaces, and Concentration Risks

Dragos's commercial trajectory reflects steady platform expansion within the cybersecurity sector for operational environments, with private-market tracking services estimating 2024 revenue at $154.4M ARR alongside an estimated 566 employees (CU007, CU014). The expansion trajectory is driven by land-and-expand mechanics: customers initially adopt the Dragos Platform for passive asset discovery and vulnerability triage under the 'Now, Next, Never' framework, then expand into Dragos Threat Intelligence, the Neighborhood Keeper collective defense network, on-demand training via Dragos Academy, and professional incident response retainers (CU002, CU003, CU016). Nevertheless, significant diligence gaps persist: contract duration, gross retention rate (GRR), net revenue retention (NRR), and exact customer logo counts remain closely held private figures without third-party audit. Furthermore, while the expanded Microsoft partnership and systems integration alliances with Accenture and World Wide Technology provide scalable distribution, they introduce counterparty channel concentration risks and margin exposure if hyperscalers enhance native OT security monitoring (CU004, CU005, CU006).[CU002, CU003, CU004, CU005, CU006, CU007, CU014, CU016]

6.4 Exhibits

7.1 Threat pressure and residual risk ranking

Dragos reported 1,020 industrial ransomware incidents in Q1 2026, including 633 manufacturing victims, or 62% of its observed total. That dataset is company-issued and derives from public victim disclosures and ransomware-group leak sites, so it measures observed claims rather than a complete incident population. Nevertheless, NCC Group separately reported that industrials represented 30% of ransomware attacks in its Q3 threat-intelligence data. The combined evidence supports a high-likelihood threat environment for Dragos customers, while Dragos's own finding that ordinary enterprise-system loss can cascade into OT disruption makes response quality a high-impact operating and reputation risk. The heatmap therefore uses categorical placement tied to cited frequency, consequence, and evidence gaps rather than unsupported numerical probabilities.[CR001, CR002, CR003, CR004, CR005, CR016]

7.2 Operational and technical execution risk

The central execution risk is that OT incident response cannot simply inherit enterprise IT processes. Dragos warns that conventional IT response tools can be ineffective or dangerous in industrial environments, while specialist staffing, operator control, legacy assets, proprietary data sources, and vendor-specific logs complicate investigations. Historical Dragos service engagements reinforce the problem: the 2021 review reported limited OT visibility, external connections, shared credentials, and improper segmentation across substantial shares of engagements. Dragos's 2025 financial-risk report models incident-response planning, architecture, monitoring, remote access, and vulnerability management as complementary controls, not a single cure. Investment diligence should therefore test time-to-triage, time-to-containment, false-positive burden, specialist coverage, and post-incident customer outcomes rather than infer resilience from market demand.[CR003, CR004, CR008, CR009, CR010, CR011, CR016]

7.3 Regulatory, legal, and assurance exposure

The assigned evidence establishes rising customer compliance obligations, not Dragos-specific compliance. NCC Group identifies NIS2 and the EU Cyber Resilience Act among frameworks relevant to critical-infrastructure customers and notes potentially significant sanctions for noncompliance. Dragos also serves environments where availability, integrity, safety, and forensic traceability can matter more than ordinary data recovery. Those conditions create consequential product-assurance, contracting, notification, and professional-services exposure, but the pool contains no regulator filing, court record, audit opinion, certification register, or verified Dragos incident notice. The legal register is therefore a partial risk map rather than evidence of an existing violation. Closing that gap requires counsel-confirmed litigation and enforcement schedules, jurisdictional product-compliance mapping, insurance terms, and incident-notification history.[CR003, CR006, CR008, CR015, CR016]

7.4 Dependencies, financial opacity, and thesis-break triggers

Delivery is visibly ecosystem-dependent. The NCC retainer combines NCC's digital forensics with Dragos's OT technology and expertise; Dragos also presents Accenture, Microsoft, and World Wide Technology as governance, marketplace, telemetry, and integration partners. These relationships can expand coverage, but they introduce integration, service-quality, platform, and channel dependencies that must be tested contractually. Financial evidence is weaker: independent reporting verifies a $200 million Series D and $1.7 billion valuation in 2021, but that historical funding is neither current revenue nor cash available. The same report noted that the announcement did not allocate a stated amount to product and services development. A material customer-impacting outage, sustained response-SLA deterioration, loss of a major platform or response partner, or inability to evidence adequate runway should break the operating thesis pending remediation.[CR007, CR009, CR012, CR013, CR014, CR015, CR016]

7.5 Exhibits

8.1 Price-sensitive investment call

The appropriate recommendation is research-more, with low confidence in any current valuation and a high underwriting risk rating. This is not a negative judgment on Dragos's product or market; it is a refusal to convert sparse, definition-mismatched public data into false precision. A current entry price, security class, ownership percentage, liquidation stack, audited revenue, ARR, retention, margins, burn, and cash balance are all absent from the reviewed evidence. The retrieved Nasdaq Private Market text contains general platform disclosures but no auditable Dragos quote or trade record, while third-party transaction sources disagree on status and value. Without those inputs, neither a target return nor a defensible standalone valuation range can be calculated. Capital should remain uncommitted until a data room reconciles the price, instrument, financial baseline, and exit economics.[CV001, CV007, CV008, CV009, CV014, CV015, CV016]

8.2 Financing history is not current fair value

The cleanest financing anchor is Dragos's September 2023 announcement: a $74 million Series D extension increased the round to $274 million and cumulative funds raised to approximately $440 million. An independent 2021 report separately recorded a $1.7 billion valuation for the original $200 million Series D. Both are historical transaction facts, not evidence of today's cash available or common-equity value. Growjo currently displays estimated annual revenue of $154.4 million and a $1.7 billion valuation; dividing those two directory figures gives roughly 11.0x estimated revenue. That calculation is explicitly not an ARR multiple, and neither input is audited or dated in the retrieved page. It therefore illustrates why the public evidence cannot support a current pricing decision rather than supplying one.[CV002, CV003, CV004, CV005, CV006, CV014]

8.3 Thesis, anti-thesis, and bounded scenarios

The thesis rests on durable industrial-cybersecurity need, product specialization, and international expansion signals. Dragos reported 1,020 ransomware incidents affecting industrial organizations in Q1 2026, and its product page says its prioritization model directs immediate action to only 3-6% of OT vulnerabilities. The April 2026 appointment of a Japan country manager and a third-party 501-1,000 employee band indicate operating scale, but both growth and scale signals lack audited economics. The anti-thesis is therefore financial rather than categorical: the company may have a strong strategic position while still offering an unattractive security at the wrong price or preference terms. Bull, base, and bear cases below are decision conditions, not point forecasts; all retain an indeterminate value until standalone financials and transaction consideration are reconciled.[CV010, CV011, CV012, CV013, CV015, CV016]

8.4 Exit evidence and final diligence asks

Public evidence signals strategic buyer interest but does not establish a completed, priced exit for a new investor. YesPress describes Accenture's June 2026 agreement for a majority stake in Dragos as subject to closing conditions and states that a $4.175 billion enterprise value covers three transactions, including full acquisitions of runZero and NetRise, rather than Dragos alone. Preqin's preview, by contrast, labels Dragos acquired and attributes $3.25 billion to the transaction. The issuer, instrument, enterprise-versus-equity bridge, ownership purchased, proceeds allocation, rollover, and closing evidence are not in the assigned record. Final diligence must obtain the signed transaction documents, current cap table and preference waterfall, audited financials, ARR reconciliation, cohort retention, gross margin by software and services, burn, cash, debt, and management's post-deal operating plan. A failed closing, weak retention, or preference-heavy proceeds allocation would break the investable thesis.[CV007, CV008, CV009, CV014, CV015, CV016]

8.5 Exhibits