Nozomi Networks and Sophos have announced an integration that feeds operational technology (OT) telemetry from Nozomi’s Vantage platform into Sophos Fusion, allowing security teams to view OT asset data, alerts and threat detections alongside existing endpoint and identity signals in a single console.
What the integration does
The connection brings Nozomi’s cloud-hosted OT monitoring into Sophos’s AI-native defence system, Fusion, which the company launched in July. Under the arrangement, analysts can investigate OT and IT events without switching tools, and security orchestration and automation playbooks will be able to act on the combined telemetry.
“The intersection of IT and OT environments has long been misunderstood by the cybersecurity industry, leading to inefficiencies and potential danger for critical infrastructure,” said Matt Cowell, vice-president of strategic alliances at Nozomi Networks.
Chris Bell, senior vice-president of global channel and alliances at Sophos, said the integration puts OT and IT vulnerabilities in front of defenders in a single place.
Why it matters
The move addresses a persistent challenge for organisations that run industrial control systems, manufacturing equipment or other plant-floor devices: security teams often have stronger visibility into corporate IT networks than into OT environments. Nozomi’s Vantage handles asset discovery and vulnerability management in those thinly seen environments. Routing OT signals into Fusion lets the teams already watching enterprise systems see risks that originate on the plant floor or in industrial networks.
Vendors making IT–OT integrations argue that many industrial outages begin with compromises on the IT side. Giving SOC analysts OT context aims to reduce investigation time and prevent escalation.
Numbers that frame the risk
The companies and related reporting highlight several figures that explain the urgency:
- 500+ — the number of third-party integrations Sophos says Fusion supports.
- 98% — proportion of examined industrial wireless networks that still used pre-shared keys, according to a Nozomi research report cited by the companies.
- Transportation — identified by Nozomi’s February research as the sector that absorbed more ransomware incidents than any other last year.
| Metric | Source |
|---|---|
| Third-party integrations supported | Sophos (company statement) |
| Industrial networks using pre-shared keys | Nozomi research |
| Sector most affected by ransomware | Nozomi research (Transportation) |
Operational impact and limitations
For Canadian organisations with critical infrastructure or industrial operations, the integration could shorten detection-to-response timelines by ensuring OT alerts aren’t siloed. It also enables automated incident response playbooks to incorporate OT-specific actions or mitigations together with IT steps.
Still, integration is not a silver bullet. Effective defence requires asset inventory hygiene, robust network segmentation, up-to-date authentication methods and human expertise to interpret OT behaviour. The Nozomi research detail about widespread use of pre-shared keys illustrates how longstanding operational practices can expose networks even after telemetry is available in an IT console.
Industry context
Sophos’s Fusion is relatively new and the Nozomi connection is among the first significant third-party integrations disclosed since the product launched. Vendors are racing to make cross-domain visibility a standard part of security operations as attackers increasingly target the junction between IT and OT.
For defenders, the key test will be whether the combined view reduces false positives, speeds triage and meaningfully reduces downtime in real-world incidents. The integration gives analysts the data; organisations must still invest in policies, training and network improvements to turn that data into resilience.
As hybrid threats evolve, expect more partnerships that push OT telemetry into mainstream security tooling — but also increased scrutiny on whether those integrations translate to measurable improvements in incident prevention and recovery.
