ORDR is a connected device security company. Its platform finds, classifies and controls every device on an organisation’s network, including IoT, OT and medical equipment that cannot run a security agent.
It is used mainly by hospitals, banks and manufacturers whose networks are full of such devices.
At A Glance
| Vendor | ORDR |
|---|---|
| Category | Connected device, IoT and OT security |
| Identities covered | IT, IoT, OT, clinical and cloud assets |
| Deployment | Agentless, using passive monitoring and integrations |
| Agentic AI | ORDR IQ multi-agent orchestration with human-approved actions |
| Customers | Cleveland Clinic, Engie, Cook Medical, Christus Health |
| Certifications | SOC 2 Type II, HIPAA compliant |
| Founded | 2015, Santa Clara |
| Market classification | OT/IoT Security; also Network Security |
What ORDR Does
Security teams often cannot say how many connected devices are on their network, let alone what each one talks to. ORDR answers both questions and then limits each device to the communication it actually needs. The emphasis is on enforcement as well as visibility: once a device is identified, the platform works out least-privilege rules for it and applies them through the switches, firewalls and access control systems the customer already owns, so segmentation does not need new hardware. Identification relies on behavioural fingerprinting trained on “over 100 million real-world devices”.
Products
AI Protect For Security
This is the starting point for teams that need an accurate inventory of connected assets. It discovers devices through passive monitoring and integrations, classifies each one from its observed behaviour, ranks devices by risk and tracks compliance. When a device is compromised, the same layer supports threat containment.
AI Protect For Segmentation
Network segmentation projects often stall because nobody knows which flows are safe to block. AI Protect for Segmentation removes that guesswork by writing least-privilege policies from real device communication. Teams see the flows in an enforcement matrix, simulate a policy with built-in validation before it goes live, and then enforce it through existing infrastructure.
ORDR IQ
ORDR IQ gives analysts a natural-language way to work with the platform. They can ask which devices are at risk or which IoT devices need policy updates, and ORDR IQ, a set of cooperating AI agents, triages alerts, investigates, drafts policies and prepares segmentation changes. Nothing is enforced until a person approves it: “Every action is human-approved.”
How It Works
The platform runs without agents on the devices it protects.
| Component | What it does |
|---|---|
| Discovery | Devices are found through passive network monitoring and integrations with existing tools, with initial discovery typically within 24 to 48 hours of deployment. |
| Classification | Each device is profiled from its behaviour using the fingerprinting model, which assigns type and risk. |
| Policy and enforcement | Policies built from real communication are validated, then pushed to the customer’s switches, firewalls and network access control. No new inline hardware is needed. |
| Orchestration | ORDR IQ runs inside the platform, and its recommended actions go to the customer’s team for approval before enforcement. |
Identities And Systems Covered
ORDR protects devices and connected assets rather than user accounts.
| IT assets | Conventional managed IT devices |
|---|---|
| IoT and OT | Internet of Things and operational technology equipment |
| Clinical devices | Medical equipment in hospitals and care settings |
| Cloud assets | Connected assets in cloud environments |
| Agentless devices | Anything that cannot host an agent, covered through passive monitoring |
Integrations
The platform connects to 130+ tools across security, networking and cloud.
| Area | Integrations |
|---|---|
| Network and access control | Cisco, Cisco ISE, Aruba, Aruba ClearPass, Juniper, Forescout |
| Firewalls | Palo Alto Networks, Fortinet |
| Endpoint | CrowdStrike, SentinelOne |
| SIEM and IT service management | Splunk, Microsoft Sentinel, ServiceNow |
| Vulnerability management | Tenable |
Company Background
| Headquarters | Santa Clara, California, United States |
|---|---|
| Customers | A reported 500+ organisations in healthcare, banking and manufacturing |
| Funding | A $40M Series C in June 2022, jointly led by Battery Ventures and Ten Eleven Ventures, bringing total funding to a reported $90 million plus |
| Compliance | GDPR and CCPA compliance |
| Recognition | Included in the G2 Network Segmentation Platform report (2025), Gartner Cool Vendor for Network Analysis and Monitoring (2024), Deloitte Technology Fast 50 (2023), Forbes Cloud 100 (2023) and the International Cybersecurity Awards (2022) |
Note: This overview is compiled from ORDR’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.