The best cyber-physical and OT security tools in 2026: Claroty, Dragos, Darktrace OT, Armis, Palo Alto Medical Device Security, Zscaler IoT/OT, and CrowdStrike Falcon for XIoT compared.
Claroty Exposure Management is the pick for industrial, commercial, and healthcare estates that need one inventory and risk view across OT, IoT, medical devices, and building systems. Dragos is the choice for ICS and SCADA operators who need OT-specific detection, intelligence, and incident response playbooks. Armis Centrix for Medical Device Security and Palo Alto Networks Medical Device Security lead for hospitals, where passive monitoring and virtual patching of devices you cannot touch are the requirements.
Cyber-physical security covers the systems where a security incident becomes a safety incident: industrial control systems, SCADA, building management, connected medical devices, and the wider Internet of Things. These devices cannot take an agent, often cannot be patched, and cannot be taken offline for a scan. The tools that work here are built around passive discovery, protocol-aware monitoring, segmentation without touching the device, and response that respects uptime.
The list below covers the main buying situations: a platform for the whole cyber-physical estate, specialist OT detection and response for industrial operators, medical device security for healthcare delivery organizations, and zero trust segmentation and access for IoT and OT from a network security vendor.
Commercial products only, one product per company, paid placements labeled. None of the seven is a paid placement.
See All Cyber-Physical Security Vendors.
The full Cyber-Physical Security market mapped by company-size fit, deployment type, NIST coverage, and pricing. No analyst paywall.
Best for: CrowdStrike customers extending Falcon visibility to IoT and OT
CrowdStrike Falcon for XIoT brings extended Internet of Things assets, meaning IoT, OT, ICS, and other connected devices, into the Falcon platform. It is aimed at the environments where a traditional endpoint agent cannot be installed, providing visibility and protection for mission-critical devices without downtime for deployment.
The advantage is the platform: XIoT asset context sits next to endpoint, identity, and cloud telemetry, so an attack that moves from IT into OT shows up as one incident rather than two alerts in two consoles.
Our database holds a short feature list and no named integrations for this product, so confirm protocol coverage and discovery methods for your specific equipment. It fits mid-market and enterprise and is cloud-delivered; the natural buyer already runs Falcon and wants the plant floor in the same view.
Palo Alto Networks Medical Device Security
Best for: Hospitals that need device visibility and policy enforcement on the Palo Alto network
Palo Alto Networks Medical Device Security discovers and identifies connected medical devices in healthcare environments, from MRI scanners to cameras, and gives real-time visibility into medical and IoT devices including the unmanaged ones. Risk assessment prioritizes vulnerabilities and carries recommendations from CISA and device vendors.
Where it differs from pure visibility products is enforcement. Virtual patching protects devices that cannot be updated, and identity-aware policy is enforced on the network, so a device with a known exposure can be restricted without touching it. Continuous monitoring and posture management round it out.
It fits mid-market and enterprise and is hybrid-deployable. The case is strongest for healthcare organizations already running Palo Alto Networks firewalls, where the policy enforcement is native. Our data lists no named integrations.
Claroty Exposure Management
Best for: Organizations that need one exposure view across OT, IoT, medical, and building systems
Claroty Exposure Management is the exposure component of the Claroty Platform for cyber-physical systems in industrial, commercial, and healthcare environments. It covers OT, IoT, the Internet of Medical Things, and building management systems, and uses an AI-driven CPS library to attribute vulnerabilities to the exact asset and model.
Discovery uses several methods that respect fragile equipment: passive monitoring, safe active queries, and project file analysis for identifying assets from engineering files. Ecosystem enrichment adds context, risk assessment prioritizes what to fix, and compliance management maps to regulatory frameworks.
Claroty fits mid-market and enterprise and is hybrid-deployable. It is the broadest cyber-physical platform in this list and the usual benchmark for organizations with mixed estates. Our data lists no named integrations.
Zscaler IoT and OT Security
Best for: Segmenting IoT and OT devices and giving vendors remote access without a VPN
Zscaler IoT and OT Security applies zero trust to operational technology and IoT. AI and machine learning discover and classify devices by behavioral identity and risk, then each device is segmented into a network of one without agents or additional firewalls, which prevents lateral movement between devices.
It provides secure connectivity to the internet and private applications, privileged remote access for third-party vendors with governance controls, and remote management of devices. For Industry 4.0 environments with vendors dialing into equipment, replacing the VPN with governed access is often the first win.
Zscaler fits mid-market and enterprise and is cloud-delivered. It is a segmentation and access product rather than a detection and response platform, so many organizations run it alongside Claroty, Dragos, or Darktrace. Our data lists no named integrations.
Looking for Cyber-Physical Security Alternatives? Start with the Right Shortlist.
Compare drop-in replacements for popular Cyber-Physical Security tools, ranked by feature overlap, integrations, and customer fit.
Best for: ICS and SCADA operators who need OT-specific detection and response
Dragos OT Incident Response is built for investigating and responding to incidents in industrial control systems and SCADA environments. Detection uses four detection types enriched with WorldView threat intelligence, which tracks the threat groups that target industrial operators and ships weekly Knowledge Packs.
Investigation tooling is OT-specific: Insights Hub prioritizes urgent threats, Case Management organizes investigations, Timeline reconstructs event sequences, and Query-Focused Datasets let analysts test hypotheses. Expert-authored incident response playbooks guide the team, and OT Watch adds continuous monitoring and threat hunting from Dragos.
Dragos fits mid-market and enterprise and is cloud-delivered in our data. It is the specialist choice for utilities, manufacturing, and energy operators who need people and playbooks that understand industrial protocols. Our data lists no named integrations.
Armis Centrix™ for Medical Device Security
Best for: Healthcare organizations that must monitor devices without disrupting patient care
Armis Centrix for Medical Device Security gives healthcare delivery organizations visibility, security, and management of medical devices, including the unagented and unmanaged ones, using passive, non-invasive monitoring that does not disrupt patient care.
It discovers medical devices, IT systems, and other connected assets across the network, compares each device to a global baseline through its Asset Intelligence Engine, analyzes behavior for anomalies, manages vulnerabilities on medical devices, and reports on compliance. Utilization tracking and patient-centric risk prioritization speak to clinical engineering as well as security.
Armis fits mid-market and enterprise and is cloud-delivered. It competes most directly with the Palo Alto product for hospitals; Armis is the broader asset intelligence approach, Palo Alto the network-enforcement approach. Our data lists no named integrations.
Darktrace OT
Best for: Operators who want self-learning detection across OT and IT without signatures
Darktrace OT provides visibility, threat detection, and risk management for industrial control systems and critical infrastructure. Self-Learning AI builds a baseline of normal operations across OT and IT, then detects insider threats, zero-day attacks, and other anomalies without signatures.
A continuous asset inventory comes from passive and active scanning across all levels of the environment, with real-time monitoring of industrial protocols and IT infrastructure. Cyber AI Analyst investigates and prioritizes incidents automatically, autonomous response takes configurable actions, and risk analysis combines CVE data, end-of-life status, MITRE ATT&CK techniques, and attack path mapping.
Darktrace OT fits mid-market and enterprise and is hybrid-deployable. It suits operators who want one detection model across IT and OT and are comfortable with autonomous response under policy. Our data lists no named integrations.
How to Choose the Right Tool
In cyber-physical security the wrong tool can stop production or a clinic. Evaluate on how the product discovers assets, what it does to them, and whether the vendor understands your industry's protocols and constraints.
Insist on passive or safe discovery. Ask how each product identifies assets without active scans that could disturb equipment (Claroty, Armis, Darktrace list passive methods).
Match the product to the estate. Healthcare points at Armis or Palo Alto Medical Device Security; industrial and critical infrastructure at Dragos, Claroty, or Darktrace; mixed IoT estates at Claroty or Zscaler.
Separate visibility, detection, and enforcement. Claroty and Armis lead on inventory and exposure; Dragos and Darktrace on detection and response; Zscaler and Palo Alto on segmentation and policy enforcement.
Check protocol coverage against your equipment list, including building management systems and legacy PLCs.
Ask what remediation looks like when patching is impossible: virtual patching (Palo Alto), segmentation (Zscaler), compensating controls and prioritization (Claroty, Darktrace).
Solve vendor remote access early. Third-party VPN access into OT is a common root cause; Zscaler's privileged remote access is built for it.
Run the pilot on a real segment with the operations team in the room and measure false positives that would have triggered an unnecessary shutdown.
Skip the Vendor Demos. Compare Cyber-Physical Security Tools in 10 Seconds.
Side-by-side features, integrations, and ratings for Cyber-Physical Security tools.
For a mixed cyber-physical estate, Claroty is the platform to evaluate first. Industrial operators facing targeted threats should look at Dragos for its intelligence and playbooks, or Darktrace for self-learning detection across IT and OT. Hospitals choose between Armis and Palo Alto Networks Medical Device Security depending on whether they want asset intelligence or network enforcement. Zscaler solves segmentation and vendor access, and Falcon for XIoT is the natural extension for CrowdStrike customers. Pilot with operations, not against them.
Frequently Asked Questions
What are cyber-physical systems?
Systems where computing controls physical processes: industrial control systems and SCADA, building management, connected medical devices, and IoT. Security incidents in these systems have physical and safety consequences, which shapes how the tools in this list work.
Why can't I use regular endpoint security on OT devices?
Most OT and medical devices cannot run an agent, cannot be patched on a normal schedule, and cannot be rebooted for a scan. CrowdStrike Falcon for XIoT, Claroty, Armis, and Darktrace rely on passive monitoring and network data instead.
What is virtual patching?
Blocking the exploitation of a known vulnerability at the network layer when the device itself cannot be updated. Palo Alto Networks Medical Device Security lists it for medical devices.
Which products are built for healthcare?
Armis Centrix for Medical Device Security and Palo Alto Networks Medical Device Security are healthcare-specific. Claroty covers the Internet of Medical Things within its broader platform.
Do I need separate tools for OT detection and OT segmentation?
Often yes. Dragos, Darktrace, and Claroty focus on visibility, detection, and response; Zscaler IoT and OT Security focuses on segmentation and access. Many operators run one of each.
How is OT security priced?
By number of sites, monitored assets, or sensors, with intelligence subscriptions and managed monitoring as add-ons. None of the vendors here publish enterprise list prices.
How this list was made
Commercial products only, one product per company, companies that were acquired are excluded. Ranked by market signals and an editorial review. Paid placements are labeled. Read the full methodology at /methodology.
Medical device security platform for healthcare asset monitoring & compliance
Vendor: Armis · Deployment: Cloud · Pricing model: Commercial, price not published · Certifications: SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, FedRAMP Moderate Authorized, DoD IL4 Authorized +3 more
Highlights
Passive non-invasive device monitoring
Medical device and IT asset discovery
Asset Intelligence Engine with global baseline comparison
Exposure management platform for cyber-physical systems (CPS) security
Vendor: Claroty · Deployment: Hybrid · Pricing model: Commercial, price not published · Certifications: ISO 27001, SOC 2 Type II, ISO 27701, ISO 27017, ISO 27018, FedRAMP (In Process)
Highlights
AI-driven CPS library for visibility and vulnerability attribution
Multiple asset discovery methods including passive monitoring and safe queries
