The IT Nerd

Dragos today announced the release of EmberAI, an OT-native AI built on the Dragos Intelligence Fabric, the world’s largest OT cybersecurity data set. EmberAI gives every analyst immediate access to Dragos OT-specific intelligence gained from over a decade of OT actions, activity and knowledge.

Putting historical and real-time intel in the hands of every security analyst, EmberAI enables teams to gain detailed visibility into assets, vulnerabilities, and network activity across their OT environment. They can prioritize threats by operational impact and act on findings specific to their environment. EmberAI empowers every analyst, regardless of experience, to move from alert to informed action faster, and make defensible decisions grounded in real adversary data.

Threat activity against critical infrastructure is accelerating. Concurrently, the OT cybersecurity skills gap to address these complex tactics and techniques is widening. Existing tools prioritize visibility over understanding, and general-purpose AI lacks the operational context to distinguish a critical exposure from background noise or to prioritize threats by their actual impact on operations. In OT, any delayed or incorrect decision can have direct consequences to operational safety, resilience, and control.

Organizations responsible for securing extended operational technology (xOT) environments, including power grids, manufacturing plants, water systems, pipelines, and data center environments, need AI that is built on the right intelligence and grounded in operational reality. EmberAI empowers analysts across the full range of experience—from IT practitioners and plant engineers operating in OT environments to seasoned OT professionals—to gain the situational visibility and awareness, intelligence and actionality of an OT expert to prioritize what matters operationally, and act effectively on findings that threaten safe operations.

The Dragos Intelligence Fabric is built on over five petabytes of daily OT telemetry, 10-plus years of adversary tracking across named OT threat groups, proprietary OT vulnerability research as a CVE Numbering Authority, asset and protocol research spanning more than 600 OT protocols, and frontline incident response experience from critical infrastructure environments. The Dragos Intelligence Fabric continuously learns as new intelligence surfaces, field insights accumulate, and threat groups adopt new behaviors.

This foundation enables EmberAI to operate on a principle that distinguishes it from generic AI: OT specific intelligence applied in context. EmberAI is central to Dragos’s xOT security strategy—the company’s architecture for securing Extended Operational Technology, the full environment of systems influencing critical operational processes. As xOT integrations expand the Intelligence Fabric with new data sources, EmberAI’s intelligence and capabilities will grow with it.

How It Works

• Intelligence-Driven Query Engine: Analysts ask questions in plain language and receive precise, OT-contextual answers grounded in the Dragos Intelligence Fabric. This eliminates the need to manually pivot across disconnected tools or correlate data from multiple sources.
• Contextual Correlation Across the Environment: EmberAI connects assets, vulnerabilities, threat intelligence, and network activity into a unified, real-time understanding. Decisions are based on full operational context, not isolated or irrelevant technical signals.
• Adversary-Informed Guidance: Detections and alerts are mapped to known OT threat groups, observed attack patterns, and real behaviors drawn from the Dragos Intelligence Fabric. Analysts understand not just what is happening, but what it means for their environment and what to do from a prioritization approach.
• Workflow Acceleration and Automation Support: From alert triage to incident summaries and reporting, EmberAI reduces hours of friction laden and often error prone manual work. Analysts spend less time gathering data and more time making informed decisions.
• Expert-Built OT Skills: Dragos analysts are building and validating a rich library of guided, repeatable workflows. Encoding the same expertise they apply during proactive services, investigations, and incident response, this library will be available soon.
• Continuous Learning Through the Intelligence Fabric: As new intelligence and field insights surface, Dragos Intelligence Fabric evolves—and EmberAI becomes more efficient and effective.
  Design Principles

The analyst remains in control at every step. Every recommendation EmberAI surfaces is transparent and auditable, enabling defensible workflows. Customer data never leaves the customer’s environment. EmberAI operates inside the Dragos Platform deployment the organization already controls. These design choices reflect a foundational “human in the loop” principle about OT: the person responsible for protecting an environment must own the final decision.EmberAI is generally available today inside the Dragos Platform.

More information is available at dragos.com/emberai.

Dragos Inc., the global leader in cybersecurity for operational technology (OT) environments, today announced it has appointed ​Ekta Singh-Bushell as Dragos’s first Chief Operating Officer. Transitioning from her role as chair of the Audit Committee on Dragos’s Board of Directors, Singh-Bushell brings extensive experience in leading business transformation through operational excellence to Dragos’s executive leadership team. As COO, Singh-Bushell will oversee go-to-market, customer experience, and people teams and collaborate across the company to help Dragos fulfill its strategic vision as it progresses in its next phase of growth.

Singh-Bushell brings diverse global management experience from some of the world’s leading companies, combined with expertise in high growth technology sectors including cybersecurity. Notably, she was the COO of the Executive Office at the Federal Reserve Bank of New York. During her more than 17 years at EY, she was in various leadership roles, including as senior managing partner leading transformative initiatives across industries impacted by digital, technology, data, and cyber advancements. Early in her tenure at EY, she served as Global Information Security Officer. Singh-Bushell’s extensive operating experience includes advising and collaborating with CEOs, CFOs, and boards, having served as a board member focused on audit and risk, technology and cyber, for companies including Cisco Systems, Huron Consulting Group, Lesaka Technologies, ChargePoint, Designer Brands, and Datatec.

Singh-Bushell is known for her practical global commercial business practices and insights, having worked with companies in more than 60 countries. Her contributions have been recognized by Cranfield University, which nominated her to the 2017 Female FTSE Board Index: 100 Women to Watch; and by Directors & Boards in their 2017 Year-End list. The Council of Urban Professionals (CUP) honored her with the Catalyst: Change Agent award in 2013. Her credentials include being a Certified Public Accountant (CPA) and certifications in cybersecurity (CISSP, CISA), governance (NACD.DC, CGEIT), and sustainability (FSA). Ekta holds a master’s degree in electrical engineering & computer science from the University of California, Berkeley, and a bachelor’s degree in engineering from the University of Poona, India.

Singh-Bushell’s appointment caps a year of major milestones for Dragos, including ​the acquisition of Network Perception, makers of NP-View, an award-winning network visualization platform for OT networks, and the formation of Dragos Public Sector LLC, a dedicated subsidiary, delivering OT cybersecurity solutions to address the unique needs of government including US federal agencies. This year Dragos also was named to the Deloitte Technology Fast 500 for the fourth consecutive year.

Dragos Inc. today announced the latest release of the Dragos Platform, the industry’s most effective OT network visibility and cybersecurity platform. The updates provide industrial and critical infrastructure organizations with even deeper and enriched visibility into all assets in their OT environments, streamlined workflows for threat detection and vulnerability management that allow for efficient and effective response, and powerful integration of Dragos WorldView intelligence and Neighborhood Keeper community intelligence on current and emerging threats. 

Industrial organizations worldwide are grappling with the rise of threat groups that scale attacks on widely-used technologies and common security weaknesses in OT environments, as well as a 50% year-over-year increase in reported ransomware attacks on these organizations. At the same time, they must balance the need for safety, quality, intellectual property protection, and financial and reputational safeguards with the competing priorities of uptime and availability of complex industrial infrastructure. IT cybersecurity approaches do not adequately protect these systems; threat and vulnerability methods not tailored to OT environments can disrupt essential processes and overburden security teams with irrelevant alerts.

The Dragos Platform provides comprehensive OT-native cybersecurity as a non-intrusive overlay to operations environments. Updates include new local collector and file ingestion capabilities that expand data collection options for increased flexibility; also included are new filtering capabilities that create powerful asset inventory views to answer key visibility questions for IT security and operations alike. The evolved integration of the Platform with Dragos’s Neighborhood Keeper and WorldView threat intelligence streamlines vulnerability management, threat detection, and response workflows to meet emerging threats like FrostyGoop and PIPEDREAM malware; Unitronics vulnerabilities; and VOLTZITE, CyberAveng3rs, and CHERNOVITE threat groups targeting OT environments.  

Enhancing Asset Inventory Capabilities

Sixty-one percent of industrial organizations struggle to effectively monitor their critical assets, limiting visibility into their risk. The latest updates to the Dragos Platform introduce advanced features that streamline and enhance asset inventory management:

• Expanded asset enrichment with project file and data import: The new file ingest feature allows for seamless import and enrichment of asset data from existing project files or other devices, simplifying the process of maintaining a comprehensive and up-to-date asset inventory.
• New lightweight collector for enhanced monitoring: A containerized traffic forwarding solution, this collector operates on edge switches and routers to provide data collection for space-constrained locations deep within OT environments. It captures and processes critical data, ensuring that even the most remote assets are monitored effectively with minimal impact on operations.
• Expanded environment support: Dragos sensors now support Hyper-V and ESXi environments, allowing for broader deployment across different OT infrastructures.

Advancing Vulnerability Management and Asset Operationalization

The Dragos Platform’s latest enhancements also focus on turning asset data into actionable insights, enabling more effective and targeted cybersecurity measures through Dragos’s corrected severity scoring with “now next never” prioritization, alternative mitigation.

• Advanced asset filtering features: The introduction of customizable filters allows users to efficiently manage and analyze asset data, facilitating the identification and prioritization of assets and their vulnerabilities. 
• Automated alerts with Neighborhood Keeper trusted insights – Context of newly discovered vulnerabilities or threat activity relevant to users’ environment can be pushed via Neighborhood Keeper to their Platform console from Dragos directly or from our Trusted Insight Partners, often before the vulnerabilities or threat activity are disclosed publicly. 
• Added intelligence context with pivots to WorldView OT analysis – In-Platform pivots to WorldView intelligence analysis & reporting on specific vulnerabilities providing deep intelligence analysis to enable risk management (additional license required).

Leading the Market in Threat Detection

As threats to OT environments continue to evolve, Dragos remains at the forefront of OT-specific threat detection:

• Over 1,000 new threat detections, vulnerabilities and response playbooks added: The latest updates introduce over 1,000 new threat detections, addressing emerging threats such as CyberAveng3rs, FrostyGoop and other advanced threats. The Dragos Platform’s rapid development and deployment of threat analytics enable organizations to respond swiftly to emerging threats. This capability is vital in maintaining the security and integrity of OT environments, ensuring that critical operations are protected from disruption.

The Dragos Platform’s ability to quickly turn threat intelligence into actionable guidance for customers was most recently demonstrated in response to FrostyGoop, the ninth known ICS malware, which directly interacts with industrial control systems (ICS) using Modbus TCP over port 502, and was discovered by Dragos in April 2024. Dragos Threat Intelligence experts quickly developed new detection analytics and response playbooks and pushed them to Platform users through a Knowledge Pack update. New to this release, opted-in organizations in Neighborhood Keeper can automatically receive these pushed content updates within their Platform instances for immediate coverage. 

The Dragos Platform was awarded Best Industrial Security Solution by SC Awards (2023), won gold in two categories – Critical Infrastructure Security and ICS/SCADA Security – in the Cybersecurity Excellence Awards (2024); recognized as Market Leader in OT Security and Most Comprehensive Industrial Cybersecurity solution by Cyber Defense Magazine’s Global InfoSec Awards (2023); and was a Platinum award winner in ASTOR’s American Security Today Homeland Security Awards for Best ICS/SCADA Cybersecurity (2023).The latest updates further enhance the Dragos ecosystem, equipping it to more effectively tackle critical OT cybersecurity challenges. To gain deeper insights into the newest version of the Dragos Platform, Dragos is offering a public webinar. During this session, Dragos will discuss how new features operationalize asset data for prioritizing and addressing vulnerabilities, as well as how the platform’s threat analytics are developed and deployed to safeguard essential operations.

According to cybersecurity firm Dragos, ransomware attacks on industrial infrastructure more than doubled last year. Of the 600 industrial sector ransomware attacks tracked by Dragos in 2022, three-quarters of them (437) targeted manufacturing in 104 subsectors. That was a 92% increase over the 315 attacks the firm detected in 2021.

The Dragos report also highlighted the emergence of a new, highly dangerous threat group, Chernovite, which developed a modular ICS toolset designed to cause destruction against critical infrastructure companies in the US and Europe.

International conflicts and wars have exacerbated the use of cyber attacks as compliments to political pressure. During 2022, Ukraine saw increased threat group activity targeting its energy and critical industrial infrastructure sectors. Russia’s 2022 invasion of Ukraine provide opportunities for Russia-aligned actors to use their cyber offensive capabilities preemptively and in parallel to its kinetic attacks.

Top 10 Ransomware Group attributions from study:

1. LOCKBIT: 169
2. CONTI: 58
3. BLACK BASTA: 54
4. ALPHA V: 43
5. HIVE: 33
6. KARAKURT: 30
7. ROYAL: 22
8. SNATCH: 17
9. AVOS LOCKER: 14
10. BIANLIAN: 14

Morten Gammelgard EVP, EMEA at BullWall has this perspective:

“Anyone who’s looking at Ransomware as strictly a financial play by criminal enterprises is missing the bigger picture. We are, in most senses, in a war. North Korea, China and Russia are the biggest players in the Ransomware game and as tensions and armed conflicts with these nations continue to escalate the threat actors are shifting their focus to industries that will harm the US and its allies the most: Infrastructure, communications, supply chain, manufacturing and even the government itself. 

“Countless government agencies have been under attack and some, particularly tax assessor offices, have been inoperable for months due to successful ransomware events. We will continue to see maximum focus on these parts of our economy as China, Russia and North Korea attempt to exacerbate our already record inflation to do maximum damage on our economy. The Ransom is only part of a longer game.

“With Russia, China and North Korea so focused on hurting our supply chain and production capability these organizations have to realize they won’t be able to stop those ransomware events from a determined nation-state actor. They MUST also have a solid response and containment strategy, including automated ransomware containment.

What’s clear from this report is ransomware is not going away anytime soon. Thus organizations need to ensure that they are fully protected from the threat that ransomware poses, or be prepared to suffer the consequences if they aren’t.