Dragos Expands Into Connected Devices With Phosphorus Buy

Endpoint Security , Governance & Risk Management , Internet of Things Security Dragos Expands Into Connected Devices With Phosphorus Buy OT Firm Looks to Secure IoT, Industrial and Medical Devices Shaun Waterman • June 1, 2026     Share Post Share Credit Eligible Get Permission Image: Metamorworks/Shutterstock Dragos, one of the first operational technology cybersecurity companies, announced Monday it acquired Phosphorus, the internet of things security and management player, a move analysts said was designed to catch Dragos up with its competitors and expand its offerings to cover the quickly growing IoT sector. See Also: Airlines and Airports: Visibility Across OT, IoT, and IT The firm called the acquisition part of "a deliberate strategy to protect the full operational environment as it exists and operates today." Dragos historically focused on traditional OT, rather than IoT, it's more mechanized counterpart, the Industrial IoT or the world of medical device cybersecurity, said Hollie Hennessy, lead OT/IoT cybersecurity market analyst with technology research and advisory group Omdia. "This acquisition puts them more in line with some of their competitors who offer security solutions for IoT or medical devices," she told ISMG. OT is no longer just about programmable logic controllers, human-machine interfaces and distributed control systems, said Dragos Vice President of Product Marketing Michael Rothschild. "Of course you have industrial controllers, but you also have these IoT and edge devices, you have different types of enterprise-connected devices [like Building Management Systems], and you also have physical security devices like cameras and building access systems," all of which are either connected to the OT environment, or might provide an access point to it, he told ISMG in an interview. Dragos uses the term "extended operational technology," or xOT, to describe these kinds of connected non-traditional OT devices, which can make up half of the tech environment and are critical to maintaining security. "If you're not covering sensors or these other devices, you're essentially covering nothing. You're covering very little," Rothschild explained. "Anybody that doesn't address those devices obviously has this uncontrollable risk. And we're really seeing it in every vertical," he added. With the Phosphorus acquisition, Rothschild said, Dragos is "putting a stake in the ground," over coverage, visibility and management of this xOT ecosystem. "The idea is really to be able to span across anything that could be construed or viewed as an industrial infrastructure," he concluded. "It's about the control loop, the physics, not the operating system," added Dragos CEO Rob M. Lee in a Monday LinkedIn post. Both companies are privately held and the terms of the deal were not disclosed. Since 2022, Nashville, Tennessee-based Phosphorus has raised three rounds of funding. Two rounds in 2022 and one in 2023 totaling $65 million, which gave the company a $100 million-plus valuation - not including a 2025 round of undisclosed size. Phosphorus was co-founded in 2017 by CEO Chris Rouland, CTO Earle Ady and CFO Rebecca Rouland. Chris Rouland previously founded startups Bastille and Endgame, and also launched IBM's security focused X-Force division. The Phosphorus platform detects connected devices on the network, and can automatically log on to each of them to perform security remediation work like password rotations, firmware updates, certificate management and configuration hardening, said Hennessy. "Phosphorus has some really interesting capabilities which are more than just granular visibility down to the firmware level and device configuration - but extend to control," she said. Omdia research shows security concerns are a major issue in IoT adoption, Hennessy added. Data, network and device security "is the number one challenge to IoT adoption," she said. "So the demand [for security products] is there." The market is "moving beyond just visibility into management, hardening, native remediation and automation," she said. The key to Phosphorus' value proposition was the enormous scale of that problem, with hundreds of manufacturers, thousands of software versions and billions of devices, said company President and COO Sonu Shankar. Even ignoring the looming specter of artificial intelligence-assisted reconnaissance, vulnerability discovery and exploit writing, he pointed out, "This has already gone way beyond being a human-scale problem." "Suppose I want to turn Telnet on every connected device in a certain environment," Shankar continued, "How would you accomplish that goal manually? You'd have to have someone first find the devices, then figure out are they turned on or off, then log into that console for that manufacturer, then discover, oh well, that requires additional access, or additional privileges, or additional training to find the button to click to turn Telnet off. Now imagine doing that for 150 different types of devices in that same environment. It's insane right?" Phosphorus is able to achieve all that with a single command, he said, adding "There's a lot of flexibility for the customer." Certain critical OT assets might need a more manual touch. "There might be a long tail of connected devices that have only an indirect impact on the environment that you will think about automating. There may be certain actions that you automate. There may be other actions that you want to have a human come in and approve, for example." Dragos says the acquisition builds on its October 2024 acquisition of Network Perception. "Where Network Perception maps and secures the network architecture [for xOT], Phosphorus secures the devices running on it," the company said in a release. With the addition of Phosphorus, the company says its total addressable market opportunity is now in excess of $50 billion.