Accenture Drops $4.2B on OT Security Powerhouse Dragos, runZero, NetRise
Key Takeaways
- In a landmark OT cybersecurity consolidation, Accenture takes majority stake in Dragos and acquires runZero and NetRise, combining threat detection, asset discovery, and firmware analysis into a unified platform for critical infrastructure.
Mentioned
Key Intelligence
Key Facts
- 1Accenture is acquiring a majority stake in Dragos and 100% of runZero and NetRise in a transaction valued at approximately $4.175 billion.
- 2Dragos, valued at an implied $3.25 billion according to CEO Robert Lee, will remain an independent vendor‑neutral OT security company, with runZero and NetRise to operate under Dragos.
- 3runZero, founded by Metasploit creator HD Moore, provides advanced asset discovery, exposure assessment, and attack surface intelligence.
- 4NetRise contributes deep firmware analysis and software supply chain visibility, critical for securing embedded industrial components.
- 5Accenture Chair and CEO Julie Sweet described the move as expanding addressable market and creating a platform‑led growth opportunity in OT security.
- 6The acquisitions are expected to close in August and September 2026, subject to standard price adjustments and regulatory approvals.
Our agreement to acquire a majority stake in Dragos and all of runZero and NetRise… is expanding our addressable market, creating a new platform-led growth opportunity.
Accenture’s announcement
For industrial cybersecurity platform
Analysis
For CISOs and OT security teams, the deal brings together three best-of-breed technologies under a vendor-neutral umbrella—Dragos' ICS threat intelligence, runZero's active discovery, and NetRise's software supply chain and firmware analysis—creating a comprehensive defense without locking customers into a single stack.
Accenture’s June 18, 2026 announcement that it will take a majority stake in Dragos and acquire 100% of runZero and NetRise marks one of the most significant consolidations in operational technology (OT) cybersecurity to date. With a combined enterprise value of approximately $4.175 billion, the triple deal places Accenture at the forefront of industrial and critical infrastructure defense—a sector that has seen escalating ransomware and state‑sponsored attacks against power grids, water systems, and manufacturing plants. Dragos, widely regarded as a leader in vendor‑neutral OT threat detection, brings a deep bench of forensics and intelligence capabilities honed through years of incident response. NetRise fills a critical gap in software supply chain visibility by performing deep firmware analysis—increasingly important as embedded devices proliferate in industrial settings—while runZero contributes real‑time asset discovery and attack surface intelligence, rooted in founder HD Moore’s legendary security expertise. Together, the three companies form a unified platform that can inventory every connected asset, analyze firmware for hidden vulnerabilities, detect advanced persistent threats, and orchestrate response across IT and OT environments.
The valuation of Dragos at $3.25 billion—roughly 80% of the total $4.1 billion package—underscores the premium placed on advanced threat intelligence and operationalized know‑how.
The strategic logic is twofold. First, by acquiring best‑of‑breed point solutions, Accenture can offer a platform‑led, managed security service that addresses the entire kill chain—from discovery to remediation—for industrial operators who often lack in‑house expertise. Second, the move is a capital allocation bet on the secular growth of OT security spending, which Gartner and other analysts project to grow at double‑digit rates as governments mandate stricter resilience standards for critical infrastructure. Accenture Chair and CEO Julie Sweet explicitly framed the acquisition as “expanding our addressable market, creating a new platform‑led growth opportunity.” Importantly, Dragos will remain an independent, vendor‑neutral company under CEO Robert Lee, with runZero and NetRise operating under Dragos. That structure preserves Dragos’s existing relationships with competing industrial control system vendors and avoids channel conflict—a critical concession that likely helped secure the deal.
What to Watch
From a market perspective, the combined entity disrupts the competitive landscape. Pure‑play OT security firms such as Nozomi Networks, Claroty, and Armis now face a well‑funded competitor backed by a global consulting and systems integration giant with deep client relationships across utilities, energy, and manufacturing. The valuation of Dragos at $3.25 billion—roughly 80% of the total $4.1 billion package—underscores the premium placed on advanced threat intelligence and operationalized know‑how. The remaining portion for runZero and NetRise highlights the value of complementary asset discovery and firmware analysis tools that, while smaller in scale, are indispensable for a comprehensive defense.
The deal is expected to close in stages beginning August 2026, pending customary regulatory approvals. Integration will be closely watched: cultural alignment between a professional services firm and a product‑centric startup is notoriously difficult, and the independence promise must be backed by operational autonomy to retain talent and customer trust. However, if executed well, the combination could set a new benchmark for how enterprises buy industrial cybersecurity—not as a patchwork of tools, but as an integrated, managed offering. For the broader industry, the message is clear: OT cybersecurity is no longer a niche; it is a board‑level imperative, and the market is consolidating around platforms that can deliver visibility from silicon to system.
Sources
Sources
Based on 2 source articles- SecurityWeekAccenture to Acquire Majority Stake in Dragos, All of runZero, NetRise in $4.1 Billion OT Cybersecurity PushJun 18, 2026
- finanznachrichten.deAccenture To Acquire 100 % Of RunZero And NetRise , Majority Stake In DragosJun 18, 2026
How we covered this story
Every story in our cybersecurity coverage is assembled from multiple primary sources, cross-referenced for factual consistency, and scored along three independent dimensions: sentiment, operational impact, and source-cluster confidence. Single-source rumors and unverifiable claims do not pass our editorial gate. When a story shows "Verified by N sources" with N≥2, the development is independently corroborated; when N=1, we mark it explicitly so readers can weigh the signal accordingly.
Impact scoring uses a 1-10 scale weighted toward regulatory, financial, and operational consequence rather than coverage volume. A topic that runs in every outlet but moves no real decisions ranks lower than a niche regulatory filing that reshapes how operators in the cybersecurity space have to behave. Read our full methodology for the scoring rubric, our glossary for term definitions, and our trends index for the longitudinal view across the beat.
| Signal on this page | What it tells you |
|---|---|
| Verified by N sources | Independent corroboration count. N≥2 is our confidence floor; N=1 is marked explicitly. |
| Impact score (1-10) | Regulatory + financial + operational weight. 8+ signals an experienced-operator action item. |
| Sentiment | Five-tier classification trained on labeled cybersecurity-specific corpora. |
| Timeline | Where applicable, the related-events sequence that contextualizes today's development. |