Nozomi Networks Vantage OT & IoT Security Solution

My main use case is to promote their technologies across the region, where use cases differ widely. I serve a range of clients in different sectors, including oil and gas, chemicals, aviation, and petrochemicals. Each use case is unique, typically starting with needs like electronic asset inventory, vulnerability management, or standard IDS tasks.

There was a client in the petrochemical industry that I consider one of the biggest in their sector, where the main challenge began with their inventory management. Their inventory situation was quite scattered, and they were unsure what assets they had within their network or infrastructure. This was particularly critical as it aligned with a mandate from the local cybersecurity regulators here in Saudi Arabia, the National Cybersecurity Agency, which has a regulation called OTCC for operational technology networks that requires an electronic asset inventory. The client was amazed by the capabilities of Nozomi Networks solution, which quickly revealed most of their systems. Within a few minutes, I was able to showcase the systems, and within a couple of days, they discovered things they never imagined or expected.

On top of the asset inventory, that client was also focused on monitoring process variables and any deviations from the PLCs, as this is crucial for production where financial implications are high in a typical industrial environment. The passive detection capabilities of Nozomi Networks aided them greatly, along with the vulnerability management aspect that involved looking at vulnerability databases like CVEs, NVD, or Nozomi Networks' own curated database. This setup provided clarity on which systems or vulnerabilities they needed to address.

The best features offered by Nozomi Networks include asset inventory, vulnerability management, a deep understanding of OT protocols, extensive support for these protocols, behavioral baselines, anomaly detection, risk management, communication mapping, dependency mapping, and passive monitoring. The integrations form a strong ecosystem to work with, allowing me to connect with many major players that most Fortune 500 companies are already using. This capability makes life easier for our customers.

I believe the asset inventory feature brings the most value to my clients because having a clear understanding of what systems are out there is crucial for protection. If I do not know what I have, it is impossible to secure it. Understanding protocols, system versions, and manufacturers all hinge on having a strong asset inventory. When clients possess this inventory, they can build various solutions or use cases on top of it, making it foundational, so I would highlight asset inventory as the answer.

While many features are valuable, every customer's use case is different. Some customers focus on anomaly detection, while others may prioritize vulnerability management. Feedback from clients has consistently been positive regarding the technology and solution overall.

Nozomi Networks positively impacts my organization and my clients by addressing essential foundations necessary for any cybersecurity journey. Clients need to start from the basics, as progress cannot happen if a solid ground is not established. Nozomi Networks addresses significant pain points for my customers and allows them to build various solutions or use cases on top of its capabilities, integrating technologies to achieve a defense-in-depth strategy in line with best practices like IEC 62443 or NIST recommendations. Oregon Systems has even benefited by upselling technologies integrated with Nozomi Networks stack because customers with Nozomi Networks as their IDS often seek to enhance their prevention capabilities.

Nozomi Networks can improve by extending support for the Internet of Medical Things (IoMT) and providing more granular support for IoT devices. While Nozomi Networks excels in operational technology and does well in IoT, a dedicated focus on these areas would be beneficial, especially given the healthcare industry's rapid growth in Saudi Arabia and the Middle East. Many healthcare devices require various protocols that Nozomi Networks may need to accommodate.

The current experience is good, but there is always room for improvement in any technology. An adage in cybersecurity states what is up-to-date today could be outdated tomorrow. Thus, it is crucial for me to keep pace with the latest trends and updates.

Regarding the governance and security of Nozomi Networks' AI capabilities, I find them to be adequate. Guardian solution is basic, while Vantage offers more advanced capabilities. Many customers prefer on-premises solutions, so it would be beneficial if Nozomi Networks could incorporate some of Vantage's features into Guardian.

My experience with Nozomi Networks' AI capabilities indicates that while I have tested it multiple times, it is not completely accurate. However, it provides useful information.

I have been working with Nozomi Networks for seven or more years.

I have not used any solution prior to Nozomi Networks, although I have evaluated other options including Dragos and Industrial Defender. I chose to partner with and promote Nozomi Networks in the region due to its simplicity and robust feature set, alongside proven references within my area.

There is definitely a notable return on investment from Nozomi Networks, including financial savings and time efficiency. Clients have shifted from manual inventory tasks to Nozomi Networks managing those processes, allowing employees to focus on more productive efforts. The ROI in terms of money saved and time saved is significant.

My experience with pricing, setup costs, and licensing of Nozomi Networks is that they are reasonable and acceptable. I would not categorize them as high.

My advice for others considering Nozomi Networks is to give it a try and experience how the solution addresses pain points and how it can simplify operations. I would rate this review an eight point five out of ten.

The main use case for Nozomi Networks for me was to bring up the asset inventory. My client opted for Nozomi Networks for the first time to help them know their assets better. They had many new integrations in their environment, and they were really concerned about what is present, what is removed, and what has been existent in their environment for a while that they didn't know about.

Their main use case was for asset inventory and mapping.

The feature that really impressed me along with the asset inventory mapping was that Nozomi Networks identified the protocol being used, the version of the devices and systems, and the version of the firmware were also mapped. It also gave us when the end of life or end of support occurs. This feature was really impressive with Nozomi Networks product.

The firmware version visibility from Nozomi Networks really helped us to check the interoperability of the device with other devices. The end-of-life notification or the end-of-life flagging helped us to plan our next purchase of the device or next upgrade and start negotiating with the vendors. In that way, we can strengthen the cybersecurity posture of our client.

I would suggest that Nozomi Networks could bring up a feature to link the risk rating of the client's assets to the business importance. For example, a building automation system is more important to a building than a traffic counter. An access management system is more important than a lighting control because when access management is lost, the building's security is at question, so that becomes a digital crown jewel for them.

It would be great if Nozomi Networks could do some learning about the business critical functions and assign risk scores to assets based on these critical functionality scores and risk scores.

I have used Nozomi Networks products for around a year.

The main challenge with mapping Nozomi Networks for asset inventory was the new integrations. New controllers were added, and new workstations were also added for the new controllers. It was a bit challenging to integrate it with Nozomi Networks, but with trial and error, we were able to easily do it. Nozomi Networks did provide good support for this challenge, and we overcame it.

The scalability was good with Nozomi Networks. Devices set up across the site enhanced the visibility and communication. The scalability was very good.

As I mentioned earlier, the customer support from Nozomi Networks was really helpful. With their help only we could resolve some issues we faced during our project execution.

I did not have previous experience with other solutions. It was my first experience with Nozomi Networks Guardian.

My advice would be to start early with an OT monitoring tool, an OT traffic monitoring tool such as Nozomi Networks. The integration becomes very difficult when customers try to implement such solutions in the later stages. I would recommend the customers to go for an early installation and onboarding of Nozomi Networks.

The clients were really impressed with Nozomi Networks mapping and asset inventory listing. I believe it helped them greatly to know about what they have. I would rate this review an 8.

My main use case for Nozomi Networks is threat detection.

I mentioned briefly about the second use case, which is asset discovery, because OT people oftentimes do not know what assets they have in their networks. Nozomi Networks is quite a useful tool to create an asset inventory, at least for starters. With Smart Polling, which is an active polling method not necessarily always allowed, but if a certain company permits it, Smart Polling is quite good in enriching data about assets. The second very strong and probably the second most important use case is asset discovery. Obviously, the third one is vulnerability management if you combine everything with ServiceNow.

I think the best features Nozomi Networks offers include the number of industrial protocols that it can monitor, which is outstanding and no other tool is equally capable as Nozomi Networks. Secondly, the user interface is quite good and clear, especially for someone using it quite heavily as I do. Thirdly, Nozomi Networks has their own threat intelligence team that enriches the global vulnerable databases with their own work. This is quite important. Quite recently, they added a lot of machine learning AI features to the Vantage.

Nozomi Networks has impacted my organization positively because, keeping in mind that I am an implementer and I implement this to many other organizations. In terms of how this improved, if implemented correctly, which means that fine-tuning is also done and the number of false positives is low, then not only threat monitoring and asset discovery are there, but some organizations whose maturity is high enough are using Nozomi Networks tools, meaning Guardians and sensors, as an OT tool, not only an OT security tool. For example, they can troubleshoot the networks through capabilities that this tool offers. Sometimes it is more than an OT security tool; it is also an OT tool.

I think Nozomi Networks should still work on the graphical user interface because it can be more friendly in terms of user experience, especially regarding the flows, the workflows, the intuitiveness of certain things and positions of certain buttons or even creating a dashboard for yourself in a way easier manner. This is something that they can work on. Apart from that, I believe that continuing to incorporate AI features, which they already did, is important, especially in terms of alerts and incidents and how they can be flagged. I am not saying AI should decide whether this is an alert or false positive, but it can certainly advise or recommend something such as, "This seems like a false positive, but perhaps you should troubleshoot," or "This seems serious, so you had better watch this."

I have been working in my current field for almost four years.

I have been using Nozomi Networks ever since I started my career in OT security, so also almost four years, let us say three and a half.

Nozomi Networks is very stable.

The scalability of Nozomi Networks is super easy to scale up as long as you have a Vantage solution, meaning the private cloud connected to on-premises or on-premises Guardians connected to the private Nozomi Networks cloud. This is super easy to scale. The other type of solution, which is fully on-premises, is also scalable, but not that easy.

The customer support from Nozomi Networks is very helpful. There are dedicated teams for clients, and the response times are quite fast. My experience so far with them is excellent.

The majority of our clients are using either Nozomi Networks or, in some cases, Claroty, because Claroty and Nozomi Networks are the best in class, with Nozomi Networks being a little ahead. In our client environments, we sometimes encounter Armis and also sometimes Microsoft Defender for IoT, which is very subpar in terms of the features and capabilities. In some cases, companies are trying to apply more IT-oriented IDSs to their industrial environments, which is also not the best possible way of doing things. For example, Dragos.

My experience with pricing, setup cost, and licensing is that it is pretty straightforward for Nozomi Networks. The whole license model is based on how many assets you need to protect. Previously, it was on-premises versus cloud. So there are two tiers or perhaps more tiers, but two ways of structuring the pricing, and it is quite clear and transparent. I do not think that anyone can be confused by the way they are structuring it. The one caveat is that they recently increased their prices by approximately 30 percent from July 1st, so that is something worth considering.

We have a business relationship with Nozomi Networks as a partner. We are not reselling their offerings, but we are implementing their solutions to our client environments.

To be honest, I do not have anything specific regarding a return on investment. Our clients usually focus more on one metric that is always there: adherence to the regulations. This is quite important because some regulations are enforcing network monitoring for industrial networks, and this is what Nozomi Networks is capable of. In terms of reducing the workforce needed to do this work, it is more creating a field of OT security, and an IDS is also always or quite often the first step to create a separate OT security practice that is separated from IT security.

My experience with pricing, setup cost, and licensing is that it is pretty straightforward for Nozomi Networks. The whole license model is based on how many assets you need to protect. Previously, it was on-premises versus cloud. So there are two tiers or perhaps more tiers, but two ways of structuring the pricing, and it is quite clear and transparent. I do not think that anyone can be confused by the way they are structuring it. The one caveat is that they recently increased their prices by approximately 30 percent from July 1st, so that is something worth considering.

We evaluated and our clients are evaluating many different options for costs and also for the features. So apart from Nozomi Networks, we also consider Claroty, Armis, Dragos, CrowdStrike, and Microsoft Defender for IoT, and one more that I forgot.

I find myself relying on the ability to monitor so many industrial networks, which is the most important part when it comes to my day-to-day workflow. Usually, I do not have to bother about other tools because Nozomi Networks is quite capable on layers zero to three of the Purdue Model. That is something that is usually a selling point when it comes to Nozomi Networks implementations to many different clients that we have.

I would say that the AI features and the machine learning in terms of the alerts and capability of especially lowering the number of false positives is promising, and I am expecting that this will evolve in the nearest future because this is what they are telling us and what we see in the product development on a day-to-day basis in our clients.

I think that the accuracy and reliability of output from Nozomi Networks is adequate. Every tool and every LLM has to be supervised by a human. The last step should always be taking an assessment of the results. In terms of how this is applied and to what it is applied, I do not think that the danger is too high. It is just helping you with the queries. The worst thing that can happen is that this query will show you a different type of things, such as assets or alerts, than you expected, but nothing major will happen.

The level at which AI is implemented now is not raising any red flags because it is usually an easier way to create queries, for example, inside the graphical user interface, the dashboard, or the management tool in order to show only a certain number of alerts that are very precisely described. This was not the case before. The rest of the so-called AI is the machine learning applied to the analysis of packets. So there are no real security flaws in my opinion at this point of the implementation of AI.

My advice for others looking into using Nozomi Networks is to make sure that you really understand your network topology before trying to implement. The best possible solution first is to have an asset inventory, but even if you do not have an asset inventory, you should make sure that you understand what kind of VLANs you have and how your network is segmented. That will make it easier to know how many and what type of devices you need so you do not overspend this way. I rate this product a 9 out of 10.

My main use case for Nozomi Networks is monitoring OT assets at Volkswagen's factories.

The specific example of how I use Nozomi Networks for monitoring OT assets is that the monitoring occurs in the factories at Volkswagen. We have the collectors acting at the switches, the access switches, and then we have a CMC collector, a VM positioned in the data center that collects the logs. With the logs and the metrics, we act by creating playbooks for addressing the alerts. That is the case for monitoring with Nozomi Networks appliances.

It has a simple interface, so it is easy to use and configure, but the network needs to be very well structured to receive the logs and capture all Nozomi Networks assets for the shop floor.

Nozomi Networks has positively impacted my organization by providing observability of the environment and the assets in the OT environment of the shop floor. Prior to this, we did not have observability over the legacy devices. Receiving these logs allows us to address threats occurring in real time in the environment, enabling us to fortify the network and equipment.

I can share that since implementing Nozomi Networks, we have seen an improvement in response times. Alerts coming to Nozomi Networks dashboards have led us to automate by sending alerts to email and generating weekly reports for analysts. This means the analyst reads and verifies a set of alerts and then handles the incident in a very fast and efficient manner.

The best features Nozomi Networks offers include polling for shop floor assets, alerts based on CVSS, which is a great feature, and BPF filters at Nozomi Networks interfaces that filter the traffic we do not want to see.

The CVSS-based alerts help my team by allowing us to determine if an alert is critical or a false positive based on the CVSS score. CVSS is a market standard for classifying vulnerabilities, so it is great that we have alerts based on it.

I think Nozomi Networks can be improved by enhancing the size of the boxes and the performance for collecting logs, and of course, the price. The most efficient way to implement Nozomi Networks is by positioning small boxes at the access switches, which enables them to capture more details, such as MAC addresses and all the packets transmitting across the network. When there are few boxes positioned above the network, the data and packets can be broken, limiting our ability to capture packets, which is not an issue with the switches but rather a capacity limitation for Nozomi box. Improving the ability to capture packets with smaller boxes would be great.

Regarding Nozomi Networks's AI capabilities, I think its governance and security are currently lacking as we do not have AI capabilities at Nozomi at this moment. However, I believe AI analysis, particularly regarding the high volume of logs, would help analysts make decisions and classify alerts more effectively. AI is a very good trend in the market, and I think Nozomi Networks should incorporate this feature soon.

I believe that AI capabilities help improve the accuracy and reliability of the alerts and the classification for the assets. This feature enhances efficient reporting, and I think it would not introduce any negative aspects to the analysis. Having AI analyze and foster accuracy with Nozomi Networks collectors would be great.

I have been using Nozomi Networks for about two years.

The customer support is very great. The few times I had to open tickets for customer support, I was attended to very quickly and efficiently by good professionals and specialists.

I did not previously use a different solution before Nozomi Networks.

Before choosing Nozomi Networks, we evaluated the Claroty solution.

Nozomi Networks's scalability is enhanced by the strategy I mentioned; the best way to implement Nozomi Networks boxes is to distribute small Nozomi Networks boxes across the access switches and network, which allows us to capture more details about the packets being transmitted between the assets. The main feature to scale this is to implement more boxes that have the performance necessary to capture and send logs to the CMC, the centralized Nozomi Networks.

My advice to others looking into using Nozomi Networks would be to place more small boxes at the access switches, especially if their company has a larger network. More boxes positioned near the shop floor assets allow for greater detail capture about packets and richer information regarding threats.

I am giving this review a rating of nine because it is a great tool, and although it has some areas for improvement, nine is a very high score.

I think Nozomi Networks is a good tool, and we will continue using it.

Nozomi Networks serves a critical function for water systems here in South Africa. For example, a government utility called Rand Water uses IoT sensors to detect leaks on water supply systems. However, two divisions in their IT department had been operating in silos: the networking side and the IoT side. The IoT side lacked comprehensive security measures and only ran a firewall, which is not true IoT security. Their approach was reactive rather than proactive when solving problems. Nozomi Networks came into the picture and provided them with visualization of their IoT network, which they had never had before.

This solution helped them become aware of where everything is located, where all the sensors are, how they are interconnected, which ones are working properly, and which ones are not. Initially, they had to log into each device individually just to find out if it was still working or if it had detected any issues. They were not proactive at all; they were reactive when it came to managing their infrastructure.

The best features Nozomi Networks offers include the ability to drill into every IoT device and get detailed information on make, model, performance, and what type of errors the sensor has picked up. This provides useful information on the entire IoT network versus individual sensors scattered throughout the network that they had to manually check to try and find problems. Now they receive real-time alerts on any issues.

Getting real-time alerts and detailed information impacts my team and clients because they can respond quickly and are more organized now. They are no longer chasing their tails. Now they can plan properly for the day and plan ahead on what needs to be resolved. This made them aware of where everything is, where all the sensors are, and how they are interconnected, which ones are working properly, and which ones are not.

Initially, they could not do any reporting or planning because they did not have real-time data. Now they do. Now they can do all those things because they have gained visibility and information on their inventory. They are also able to do capacity planning, which is something they could not do before.

Nozomi Networks can be improved by integrating with other technologies so that teams look at a single dashboard when it comes to security issues. Instead of looking at two different dashboards, integration would create a single dashboard that shows where the IoT meets the network. This way, if they need to isolate any threats, those threats can be isolated on the networking side as well.

I would give Nozomi Networks an eight because there is still room for improvement. The key issues involve reporting that needs to be integrated with networking reporting, and real-time alerts that need to be integrated into a single dashboard with other technologies. Integration is the most important part for future development.

I have been using Nozomi Networks since five years ago, around 2021.

Nozomi Networks is very stable.

Nozomi Networks's scalability is very impressive. I can support a huge number of IoT devices. One of the key benefits is that we do not have to use multiple tools. Nozomi Networks covers the entire infrastructure when it comes to IoT.

Customer support in terms of sales and technical assistance is very good.

Previously, there was no solution. That is why they relied on the network and network security to protect IoT, which was not really ideal.

Deployment is quick and very easy to hand over to the customer team because it is not complicated. It works from day one.

Our relationship with this vendor is structured as a reseller relationship.

I would say the ROI is significant in terms of time saved and resources. The IT team and the IoT team managed to combine into a single team that can handle both IoT and networking troubleshooting because of the information they receive from Nozomi Networks.

My experience with pricing, setup cost, and licensing has been very seamless. The Nozomi Networks team was very helpful throughout the process.

We looked at various other technologies that were primarily open source, but nothing was examined in terms of doing a proof of concept with those technologies. We primarily focused on what information we could get from our chosen tool and what other functionality it provides.

The features are great and very easy to use. The ability to navigate the platform and get useful information and reporting is much easier now. Before, it was a manual exercise where they had to try to put everything into spreadsheets and create diagrams manually to report.

Nozomi Networks has impacted our organization positively as we have gained trust from customers in terms of the technology results and everything that the technology brings. We presented and managed to demonstrate the value for money.

Solving incidents has improved drastically. The team is now able to plan properly. They do not spend over budget or under budget because they know exactly what needs to be resolved due to the information and visibility they have. The IoT team and the network team managed to integrate into a single team because they no longer operate as silos but as a single team that can resolve both IoT and networking security issues together.

The security of Nozomi Networks is great. The governance complies with government security laws.

Nozomi Networks is a very good tool, which is why we recommend it before any other product. I would give this product a rating of eight out of ten.