Dragos buys runZero: what should current and prospective users ask?

What is confirmed?

Dragos's press release of 21 September 2026 says it acquired runZero and NetRise to extend its xOT security platform. runZero CEO HD Moore will lead integration work while continuing to serve existing customers. No deal terms were disclosed. That is the whole of what our sources confirm.

What does runZero offer today?

On the pages we read on 27 September 2026, six days after the announcement:

• Collection. Active scanning plus passive discovery for fragile OT, across IT, OT, IoT, cloud, mobile and remote assets, with no agents, authentication or appliances required.
• Deployment. SaaS or on-premises, including air-gapped environments.
• Integrations. ServiceNow (CMDB enrichment), CrowdStrike, Intune, AWS, Azure, Google Cloud, Entra ID, Tenable, Rapid7, Qualys, VMware, Wiz, SentinelOne, Tanium and Splunk, plus a custom integration SDK. runZero 5.1, released on 10 September, added AI-assisted integration scripts in Starlark running in a sandbox.
• Profiling. Each asset profiled against nearly 1,000 attributes.
• Price. Community Edition free for 100 or fewer assets with 30-day retention; runZero Platform starting at $5,000 with 3-year retention; a free, full-featured 21-day trial.

runZero describes itself as CAASM, and in the finder it counts as describing CAASM aggregation, with agent-based collection and CMDB support described with a condition (it scans rather than installing agents, and it enriches a CMDB rather than being one).

Why might the deal make sense?

We can only describe the fit, not the strategy. Dragos works in OT security, and runZero's passive OT discovery and active IT scanning cover both sides of an industrial estate. The press release frames the deal as extending Dragos's xOT platform.

What should current runZero users ask?

• Do the Community Edition, Platform pricing and the self-hosted and air-gapped options continue on the same terms at renewal?
• Do integrations with vendors that compete with Dragos continue to be maintained?
• Where will the product be sold, and through which channels, after integration?
• What is the support path during the integration period?

What should prospective users ask?

The same questions, plus one: whether the published price and trial still apply on the day you buy. Our facts are dated 27 September 2026, and the pricing page is the place to check.

What about NetRise?

Dragos acquired NetRise in the same announcement. NetRise is not covered on this site, because our sources do not include its pages, and we have not described what it does. If it matters to your evaluation, ask Dragos how the two products will relate. If you already run Dragos, also ask whether runZero data will feed it, and on what terms.

What would make us update this post?

A change on runZero's pricing, platform or integrations pages, or a dated announcement from Dragos or runZero about product plans. We will add a new log entry rather than rewrite this one, so the record of what was known on which date stays intact.

Does this change the finder?

No. The finder matches your answers to what runZero's pages describe today. In our example profiles, runZero is first for the mixed estate example and second for several others, because it describes agentless collection, a published price and a long integration list. The finder will change if runZero's pages change, and we will log it here.

What else should you weigh?

runZero's limits on the pages we read are the same as before the deal: SaaS applications are not covered, and no workflow or enforcement actions of its own are described, so action happens in ServiceNow or other tools. If SaaS and identities matter to you, pair it with an aggregation approach, or compare it with one in Axonius vs runZero.

What next?

Read the runZero platform notes, then run the finder with your own answers.