← All sectors / The AI transformation
055 · Operational technology security
Defending machines, not laptops
Curve position
Binding constraint
Downtime intolerance: you cannot patch a running production line.
Why this sector sits at Orbit
Operational technology security fails our Liftoff test because the repricing has already happened and is being realised through exits. On 18 June 2026 Accenture agreed to take a majority stake in Dragos, bundled with runZero and NetRise, at about $4.175B enterprise value on roughly $208M of combined ARR. The deal completed on 21 September 2026. Claroty raised at a $3B valuation in January 2026, and Nozomi was reported acquired in September 2025.
The leading vendors are named, and the market is growing at about 16% a year, which is steady rather than accelerating. That is Orbit: competition on execution, not on access.
The case for Flight is the 53% ARR growth Accenture cited for the Dragos bundle. A Claroty IPO at an expanded multiple, or clearly accelerating market growth, would make us reconsider.
Reviewed on a two month cycle. The position moves only when a dated, verifiable change in the binding constraint justifies it.
Heatmap / How this sector's stocks are moving
| Stock | Price | 1 Day | 1 Week | 1 Month | Year to date |
|---|---|---|---|---|---|
| $FTNT | $129.39 | +1.00% | −25.67% | −32.35% | +62.94% |
| $PANW | $348.04 | −0.62% | −11.77% | −17.12% | +88.95% |
| $CHKP | $147.41 | +3.61% | −5.03% | +11.69% | −20.56% |
| $CRWD | $241.00 | −1.50% | −9.62% | −13.58% | +105.65% |
| $ZS | $224.44 | −0.29% | −12.26% | +5.74% | −0.21% |
| Sector average | +0.44% | −12.87% | −9.12% | +47.35% |
Prices as of November 5, 2026. The sector's move is the equal-weighted average of these listed companies, a market proxy for context, not recommendations. See it on the full heatmap →
Sentiment / The mood in this sector's stocks
Since 2018, Operational technology security has been in Capitulation and falling 17 separate times. After those, its stocks beat their usual three months 9 times (53%), by a median of +2.1 points.
Confidence: low, a split like this is common by chance, so no edge is called.
Industrial control systems run water treatment: power distribution, manufacturing, and pipelines. Most were designed before networked attacks existed, many cannot be patched without stopping production, and they are now connected to networks that reach the internet.
Historical context: operational technology and information technology were genuinely separate for decades, and the air gap was real security. Efficiency drove convergence, remote monitoring and analytics required connectivity, and the gap closed before the security model caught up.
The structural driver is a combination of demonstrated attacks on physical infrastructure and regulation responding to them. Critical infrastructure rules, incident reporting requirements, and insurance conditions are all converting security from optional to mandatory.
The technology layer spans passive network monitoring that does not disturb operations, asset discovery for equipment nobody documented, segmentation between operational and corporate networks, secure remote access for vendors, and anomaly detection tuned to industrial protocols.
Adoption economics are driven by downtime avoidance and regulatory compliance rather than efficiency. A day of stopped production dwarfs any security budget, which makes the business case straightforward once a board understands the exposure.
The beneficiaries include operational technology security specialists, industrial networking equipment makers, the automation vendors adding security to their own installed base, and the services firms doing assessments in environments generalist consultants cannot safely touch.
The value chain runs from industrial equipment through networking and monitoring to managed detection services. Domain expertise is the moat: securing a refinery is not the same job as securing an office network.
The overlooked layer includes industrial networking hardware suppliers, specialist assessment and integration firms, secure remote access vendors, and the automation companies quietly building security into controllers.
Competitive dynamics favor vendors with deep protocol knowledge and existing relationships with plant engineers, who are a fundamentally different buyer than corporate security officers.
Risks: industrial capital budgets are cyclical, sales cycles are long and conservative, general purpose security platforms are extending into this space, and adoption often waits for an incident rather than anticipating one.
What to watch: critical infrastructure regulation with mandatory controls, disclosed industrial incidents, security spend within manufacturing capital budgets, and partnerships between automation vendors and security specialists.