TL;DR: Accenture is acquiring a majority stake at a $3.2B valuation, with runZero and NetRise included, as the combined business targets a $4.175B value and a broader xOT platform spanning IT, OT, IoT and cloud environments, according to Dragos. The real issue is governance at scale: expanded surface area, deeper dependency on specialist data, and stronger pressure to separate platform reach from operational accountability.
At a glance
What this is: This is a market consolidation story in OT cybersecurity, with Dragos positioning the acquisition as a way to extend xOT coverage across IT, OT, IoT, cloud, and supply chain risk.
Why it matters: It matters because OT and identity governance are colliding across broader attack surfaces, and practitioners now need to reassess how visibility, access, and operational trust are governed across extended environments.
Context
Operational technology security is no longer confined to isolated plant networks. The attack surface now extends into cloud control planes, supply chain dependencies, and analytics platforms that influence physical process outcomes, which means governance has to follow the system boundary, not just the network diagram.
This announcement is best read as a sign that OT security buyers are being pushed toward broader xOT operating models rather than narrow point controls. That creates new questions about how identity, access, asset visibility, and response workflows stay consistent across OT security environments that now span more than one traditional domain.
Key questions
Q: What should security teams do first when xOT expands beyond the plant network?
A: Start by building one inventory of operational assets, supporting cloud services, vendor connections, and remote access paths. Then classify each path by the operational consequence it can create, because OT risk is driven by process impact, not just technical exposure. That gives you a defensible way to prioritise controls and response planning.
Q: Why do remote access and third-party support increase OT risk?
A: They create durable pathways into environments that were designed for stability, not frequent remote interaction. Each pathway expands the number of identities, systems, and trust relationships that can be abused if a session, gateway, or vendor workstation is compromised. That is why OT access needs explicit scope and continuous review.
Q: What breaks when OT security is treated like IT security?
A: OT security breaks when teams rely on generic vulnerability handling instead of process context. An exposed device is not just a patching issue if it sits on a production control path or supports a safety-critical dependency. Without operational context, teams overreact to low-impact issues and underreact to exposures that can affect availability, safety, or change control.
Q: Which governance model best fits extended operational environments?
A: A single xOT governance model is better than separate IT and OT programmes when the same access paths, vendors, and tooling can influence physical process outcomes. The key is to unify visibility, access governance, and consequence-based prioritisation without losing the operational context that OT needs.
Technical breakdown
Why xOT expands the control boundary
xOT describes operational environments that now depend on cloud services, enterprise analytics, supply chain integrations, and remote support paths in addition to plant-floor systems. The security problem changes when the control boundary moves outward: the attacker no longer needs only direct access to an OT segment, because exposed supporting systems can become the path into operational impact. This is why visibility, segmentation, and access governance need to be evaluated as one environment rather than as separate IT and OT programmes. Read Top 10 OT Security Risks.
Practical implication: Treat external dependencies as part of the OT security boundary and map access paths across them.
Why exposure management matters in OT programmes
Exposure management in xOT is not just about finding assets. It is about understanding which devices, services, and supporting applications create credible paths to process disruption, especially where legacy systems, vendor access, and cloud-connected tooling overlap. In OT, the consequence of a missed exposure is not merely data loss. It can be unsafe process behaviour, downtime, or loss of operational control. That makes asset discovery, context, and prioritisation inseparable from response planning. See the OT Asset Visibility Guide.
Practical implication: Build exposure context around operational consequence, not just device inventory.
How identity governance enters OT and xOT
As OT environments extend into remote access, third-party support, and connected software platforms, identity becomes a control plane for operational trust. Shared accounts, standing access, and weak offboarding create pathways that adversaries can exploit without needing to break industrial logic directly. This is where OT security and IAM finally intersect in a material way: governance failures in access management can become physical process failures. [[L1|OT identity and access]] controls are therefore not optional adjuncts to OT security. See the OT and ICS Identity and Access Guide.
Practical implication: Audit privileged and third-party access paths as operational risk, not just account hygiene.
Threat narrative
Attacker objective: To reach the systems that govern physical process outcomes and use that access to disrupt or influence critical infrastructure operations.
- Entry can occur through expanded xOT dependencies such as remote access, cloud-linked tooling, or supply chain-connected services rather than only through the plant network itself.
- Escalation follows when exposed supporting assets, weak trust boundaries, or overextended access paths let an intruder move closer to operational systems.
- Impact emerges when operational control, visibility, or process integrity is affected, creating downtime, unsafe behaviour, or loss of critical service.
Breaches seen in the wild
- Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
xOT is now the right governance model for OT security: the attack surface no longer stops at the control system boundary. Cloud services, analytics platforms, and supply chain dependencies now participate in operational risk, so the discipline has to govern the whole extended environment, not just field devices. Practitioners should treat xOT as a control scope issue, not a branding exercise.
Identity is becoming the hidden control plane of OT risk: once vendors, remote operators, and support platforms can reach operational assets, access governance becomes a process safety issue. Standing privilege, shared accounts, and weak offboarding are not administrative flaws in this context; they are pathways to physical consequence. The OT security agenda now has to include privileged access governance and third-party identity lifecycle control.
Market consolidation will reward platforms that understand operational consequence, not just asset count: buyers will increasingly judge xOT tooling on whether it reduces exposure in ways that change operator behaviour and response timing. A broader platform can help, but only if it preserves context, neutrality, and operational decision quality. The practitioner test is whether the platform improves control fidelity across the full environment.
Specialist OT security data is becoming a strategic asset: threat intelligence, asset context, and remediation knowledge are now differentiators because AI and automation only work when the underlying data is operationally specific. That means practitioners should be wary of generic security telemetry dressed up as OT coverage. The right question is whether the data model reflects how critical infrastructure actually fails.
Read next: OT Security Guide
What this signals
xOT governance is becoming a control requirement, not a category label: once cloud, supply chain, and remote access are part of the operational path, organisations need a single view of exposure and privilege across them. That means the next generation of OT programmes will be judged on whether they can govern trust across boundaries, not just monitor assets.
Identity failures will increasingly show up as operational failures: as OT expands, the weak point is often not the protocol stack but the access path into it. Teams should expect privileged access reviews, third-party offboarding, and session control to become core OT assurance activities rather than adjacent IAM tasks.
For practitioners
- Map the full xOT attack surface Include cloud-linked OT services, remote access paths, third-party tooling, and supply chain dependencies in one asset and trust map.
- Review privileged access across operational workflows Identify shared accounts, standing privileges, and vendor support paths that can reach process-relevant systems.
- Prioritise exposures by operational consequence Rank discovered assets and pathways by the impact they could have on safety, uptime, and process integrity, not just exploitability.
- Align OT and IAM owners on offboarding and remote access Make sure access removal, session governance, and third-party termination are handled as a single control problem.
- Test whether AI-assisted analysis reflects real plant context Validate that automation and analytics use OT-specific data before they are trusted for prioritisation or response.
Key takeaways
- The article frames OT security as an extended environment problem, where cloud, supply chain, and remote access dependencies now shape operational risk.
- The consolidation story matters because it reflects a market shift toward broader xOT governance, not just narrower device protection.
- Practitioners need one model for asset visibility, access governance, and consequence-based prioritisation across the full operational stack.
Related NHI Mgmt Group resources: OT and ICS Identity and Access Guide · Top 10 OT Security Risks · OT Asset Visibility Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on access paths and trust boundaries across extended operational environments. |
| ID.AM-01 — Physical devices and systems within the organization are inventoried | The post stresses visibility across OT, cloud, and supply chain dependencies. | |
| Recommendation — Apply PR.AA-05 to govern privileged and third-party access across OT, cloud, and remote support paths. Inventory operational assets and supporting systems as one environment rather than separate silos. | ||
| CIS Controls v8 | CIS-5 — Account Management | Shared accounts and offboarding failures are presented as a key OT governance risk. |
| Recommendation — Use CIS-5 to remove shared access, enforce account ownership, and terminate stale support accounts. | ||
| MITRE ATT&CK | TA0001;TA0008 — Initial Access; Lateral Movement | The article describes attacker movement through trusted access paths into operational environments. |
| Recommendation — Map OT attack paths to TA0001 and TA0008 to prioritise exposed support routes and trust boundaries. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Operational tooling and supporting services often rely on identities with excess scope in extended environments. |
| Recommendation — Review service and support identities for excess scope wherever OT control depends on connected systems. | ||
Key terms
- Extended OT Environment: The extended OT environment is the set of systems that influence operational technology beyond the plant floor, including cloud services, analytics platforms, remote support tools, and supply chain dependencies. Security teams must govern it as one operational trust boundary because compromise anywhere along that path can affect physical process outcomes.
- xOT: xOT is the broader operational technology environment that includes any connected system whose compromise can affect physical processes or high-impact operations. It extends beyond classic industrial controls to cameras, radios, badge readers, and other devices that may not appear on a traditional OT inventory but still carry material risk.
- Operational Consequence: Operational consequence is the real-world effect a security failure can have on safety, uptime, or process integrity in critical infrastructure. In OT programmes, it is the right lens for prioritisation because the most important exposure is not always the most technically severe one.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect operational access control to the broader governance decisions their programmes must make.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org