Cynalytica and Dragos link OT monitoring across serial, analog and IP networks

Cynalytica and Dragos Public Sector announced a technical integration that combines serial and analog monitoring with IP-based OT threat detection. The partnership is aimed at water, electric and government critical infrastructure operators that need visibility across legacy and modern industrial systems.

Why it matters: - Critical infrastructure operators often run a mix of legacy field devices and modern IP networks. - The integration is designed to close visibility gaps across serial, analog, and IP industrial communications. - Unified monitoring can help security teams spot cross-layer attack patterns earlier and with less operational disruption.

What happened: - Cynalytica announced a partnership and technical integration with Dragos Public Sector on September 16, 2026. - The combined offering links Cynalytica's OTNetGuard, SerialGuard, and AnalytICS Engine with the Dragos Public Sector OT threat detection platform. - The integration is available now for water utilities, electric operators, and government critical infrastructure customers.

The details: - Dragos Platform provides asset visibility, vulnerability management, and threat detection across xOT environments. - Dragos uses passive network monitoring and active collection, with deep packet inspection across 600+ industrial protocols. - Dragos also uses behavioral baselining and detections mapped to known adversary TTPs through the MITRE ATT&CK for ICS framework. - Cynalytica OTNetGuard passively monitors IP-based industrial network traffic and correlates it with non-IP communications. - Cynalytica OTNetGuard also provides out-of-band monitoring of serial links such as RS-232, RS-485, and RS-422, plus analog communications including current loop and voltage-based signals. - Cynalytica OTNetGuard extracts protocol telemetry from Modbus RTU, DNP3 serial, and proprietary vendor protocols without adding latency or risk to control loops. - Cynalytica AnalytICS Engine applies behavioral analytics and anomaly detection across non-IP data streams. - Dragos ingests the correlated Cynalytica telemetry alongside its native IP monitoring and applies threat detection, vulnerability management, and playbook-driven response. - The combined system creates a single visibility layer spanning Level 0 through Level 3 of the Purdue Model. - The integration can correlate a serial RTU command injection with anomalous reconnaissance activity on the IP side of the network. - Both platforms operate out-of-band and require no changes to existing control system configurations. - The deployment model also avoids active polling of field devices and does not introduce new network paths into operational environments. - The approach is intended to preserve fail-safe operations in water and electric utility environments. - The companies say the integrated approach supports compliance reporting aligned with NERC CIP, AWWA, and other sector frameworks.

Between the lines: - The move reflects a broader OT security challenge: most security tools are strongest on IP traffic, while many real-world industrial assets still depend on serial and analog communications. - By combining data at the field-device layer and the IP layer, the two platforms are trying to reduce blind spots that separate tools can miss. - The pitch is as much about operations as security, since passive monitoring is a better fit for environments where uptime matters more than active scanning.

What's next: - Cynalytica and Dragos are positioning the integrated stack for deployment across water, electric, and public-sector environments. - The companies say analysts will work from a single, correlated dataset as deployments expand.

The bottom line: - The integration aims to give industrial defenders one view of OT activity across legacy field systems and modern networks without changing the control environment.