Dragos, the industrial cybersecurity company, said on September 21, 2026 that it had closed its acquisition of runZero, an Austin, Texas startup that maps and assesses every device on an organisation's networks. It completed the purchase of firmware security startup NetRise at the same time.
The deals closed alongside Accenture's majority investment in Dragos, which was first announced in June. Dragos did not disclose what it paid for runZero, NetRise or Phosphorus, a third company it bought earlier in the year.
runZero co-founder and chief executive HD Moore and his full team have joined Dragos. Moore will help lead the integration of runZero into the Dragos Platform while continuing to support runZero's existing customers, and the runZero website now describes it as a Dragos company.
What runZero built
Moore, best known as the creator of the Metasploit penetration testing framework, founded the company in 2018 as Rumble Network Discovery. The idea was an active discovery tool that could find and identify everything on a network without needing credentials or software agents installed on each device.
The company rebranded as runZero in August 2022 and broadened into what the industry calls exposure management. Its platform fingerprints IT, operational technology (OT), internet of things, cloud, mobile and remote assets, pulls in data from tools an organisation already uses, and highlights unmanaged devices, end-of-life systems and control gaps. runZero offers a free version for home use and networks with fewer than 100 assets.
Its most recent release, runZero 5.1, added AI workflows such as natural language search and autonomous discovery, as well as a native Dragos integration.
“The world’s largest companies have invested heavily in enterprise IT security, yet it’s their cyber-physical systems that generate revenue and carry national and local security impact.”
Why Dragos is buying
Dragos protects the systems that run physical processes in electricity, oil and gas, manufacturing and data centres. It is now marketing a broader category it calls xOT, or extended operational technology, covering connected devices, networks, cloud infrastructure, the software supply chain and core operational systems.
runZero adds asset visibility across all of those environments, while NetRise looks inside device firmware. Both will feed the Dragos Intelligence Fabric, its decade-long store of OT telemetry and incident response data, which powers an AI assistant called EmberAI.
"The world's largest companies have invested heavily in enterprise IT security, yet it's their cyber-physical systems that generate revenue and carry national and local security impact," said Robert M. Lee, Dragos's co-founder, who has added the role of chairman to that of chief executive. Lee said Dragos, NetRise and runZero together defend that extended environment.
Lee has argued that the industry drew its boundaries in the wrong place, sorting systems by their position in the Purdue model or by operating system. He listed examples he says belong in the same scope: a cloud-connected analytics platform running a manufacturing process, the cooling and power systems that keep a data centre online, and cloud-connected SCADA servers running electrical substations. runZero's discovery across IT, OT and cloud is meant to cover all of them.
The founders and the funding
runZero raised about $20 million in two venture rounds. As Rumble, it raised $5 million led by Jon Sakoda and Dan Nguyen-Huu at Decibel Partners, a firm backed by Cisco. Decibel then led a $15 million Series A in 2022, shortly before the rebrand. Well-known security founders also invested in the first round.
The runZero team is due to discuss its plans as part of Dragos at a live session on October 21.
What changes at Dragos
Accenture's investment brings three Accenture executives onto the Dragos board: Harpreet Sidhu, its global cybersecurity lead; Luis Luque, its global OT cybersecurity lead; and John Coltsmann from corporate development. CrowdStrike co-founder Dmitri Alperovitch is returning to the board.
Dragos said it will keep operating independently under its existing leadership, which it presents as important for vendor neutrality in critical infrastructure. Lee wrote that the company has more than 100 open positions, mostly in research and development, and that details of how the runZero and NetRise products will be integrated will follow in the coming months.
