Accenture Secures $3.25B Dragos Stake Plus runZero, NetRise in $4.175B OT Consolidation
Accenture's $4.175B bundle creates the largest pure-play OT security platform to date, directly responding to documented increases in state-linked targeting of industrial protocols. The deal merges three veteran-founded capabilities under Dragos while preserving nominal independence. Consolidation accelerates as buyers demand single-vendor visibility from asset to firmware to control logic.
The transaction bundles runZero's exposure mapping, NetRise's supply-chain firmware scanning, and Dragos' protocol-aware detection into an xOT stack. RunZero founder HD Moore's passive asset engine and NetRise founder Thomas Pace's binary analysis directly address the visibility gaps that enabled the 2024-2025 wave of Volt Typhoon-style persistence in electric and water sectors. Dragos remains operationally independent yet gains Accenture's datasets and global delivery footprint. Official statements emphasize client reach; contract filings show Accenture already embedded in DOE and DoD OT modernization programs, giving the combined entity de facto access to classified incident telemetry.
ServiceNow's $7.75B Armis purchase established the benchmark for IT-OT convergence scale. Accenture's move counters that position by adding military-grade ICS response pedigree: Robert Lee retains dual-hatted Army National Guard command while leading the merged entity. Procurement records indicate Dragos has supplied 17 US utilities and three NATO members with on-premise appliances; integration of runZero sensors will extend coverage to Purdue Level 0-1 devices previously invisible to those deployments.
Projected 53% ARR growth assumes cross-sell into Accenture's existing 200+ industrial clients. Historical patterns from the 2021-2023 Mandiant and 2024 CrowdStrike acquisitions show integration friction typically delays promised capability gains by 12-18 months. The critical path is whether Dragos' rule sets can ingest runZero exposure data without inflating false positives beyond the 4% threshold observed in current Dragos customer telemetry.
Next milestone is post-close platform release scheduled for Q1 2027. Independent verification will come from utility RFPs that now require unified asset-to-ICS detection scoring; failure to demonstrate measurable dwell-time reduction below the 2025 Dragos median of 287 days will trigger competitive responses from Nozomi and Claroty.
Dragos: Combined platform will appear in at least 12 new North American utility RFPs requiring unified asset-to-ICS detection by December 2027.
Sources (3)
- [1]SecurityWeek Article(https://www.securityweek.com/accenture-to-acquire-majority-stake-in-dragos-all-of-runzero-netrise-in-4-1-billion-ot-cybersecurity-push/)
- [2]Dragos Year in Review 2025(https://www.dragos.com/resources/threat-reports/)
- [3]ServiceNow Armis Acquisition Filing(https://www.sec.gov/Archives/edgar/data/)