Nozomi Arc Endpoint Sensor — Host Context & OT Blind Spots Solved

① Why passive network sensing leaves host-level blind spots

Guardian, Nozomi's core network sensor, does its job by mirroring traffic from a SPAN port or TAP and running deep packet inspection. This means Guardian can discover assets, detect anomalous OT protocol traffic, and spot network-borne threats — all without touching any device. But that model has hard structural limits.

A passive network sensor only sees what crosses the network. Three categories of events are invisible to it. First, host-internal actions: a USB stick being inserted, a new process executing, a user logging in — none of these generate network traffic. Second, isolated or heavily segmented zones: if no SPAN or TAP covers a subnet, Guardian simply cannot see it. Third, local sessions: an RDP or VNC session that stays within the same subnet never leaves to a mirror port.

These are not theoretical risks. In OT environments, historians, engineering workstations and jump hosts are exactly the machines with human access — the machines most likely to see USB-based exfiltration, insider misuse, or a lateral-movement pivot. Missing that layer means a real threat category goes undetected.

② Nozomi Arc — the lightweight host sensor and what it collects

Nozomi Arc is a lightweight software agent that installs on the host operating system of an OT or IT asset — a Windows or Linux historian server, engineering workstation, DMZ jump host, or any endpoint where host-level visibility matters. It reports telemetry directly to Vantage (the cloud-native SaaS management platform) or the CMC (on-prem Central Management Console), appearing in the same asset inventory and alert views as Guardian data.

Four host-context categories Arc collects

• Users — who is currently logged in, new or unexpected accounts, privilege changes, and remote-session logins.
• Processes — what software is running, newly spawned processes, and executables that don't match the known-good baseline for that asset.
• USB / removable media — device attach and detach events, device identifiers, and timing — the key signal for physical exfiltration risk.
• Local sessions — RDP, VNC, local console, and other session types that may never appear on the network mirror.

These four streams feed the same hybrid detection engine that processes Guardian's network data. An anomalous process or an unexpected USB insert triggers an alert in Vantage or CMC just as an anomalous OT protocol sequence would.

③ Arc in action — filling the gaps Guardian cannot reach

The deployment story for Arc is deliberately simple: install a software agent, point it at Vantage or CMC, and you have host visibility immediately. There is no SPAN port to configure, no TAP to order, and no maintenance window needed for a network change. This matters enormously in OT environments where even a minor network change requires a formal change-control process and a maintenance window.

Three OT scenarios where Arc is the right answer: (1) Isolated or micro-segmented zones — where a Guardian sensor cannot be placed and no TAP is available. Arc installs on each host in the zone and phones home. (2) Historian and SCADA servers — these machines aggregate data from many PLCs and are high-value targets; Arc gives you process, user, and USB telemetry from the most sensitive boxes in the plant. (3) DMZ and jump hosts — the crossing point between IT and OT networks, exactly where lateral movement from an IT compromise would pivot into OT; Arc's session and process visibility catches that pivot.

USB-based attacks are a special case. A threat actor — or an unknowing contractor — inserting a USB drive into a historian produces no network traffic. Guardian is silent. Arc logs the event instantly and Vantage raises an alert, giving the analyst a chance to intervene before any malware executes or data copies complete.

④ Arc + Guardian together — unified visibility in Vantage

Arc and Guardian are complementary, not competing. Guardian owns the network layer: passive DPI, OT protocol analysis, network-based asset discovery, and network anomaly detection. Arc owns the host layer: users, processes, USB, and sessions on individual machines. Together, they close the visibility gap in both dimensions.

Both streams flow into the same Vantage or CMC console — no separate tool, no data silo. An asset discovered by Guardian over the network is enriched by Arc's process and user telemetry in the same inventory record. An analyst sees one asset card with both network-behaviour data and host-context data side by side.

The decision rule is straightforward: deploy Arc wherever host context matters and a SPAN/TAP is impractical. For most OT estates that means historian servers, engineering workstations, DMZ hosts, and any host in a segment without a network tap. Guardian covers the network at aggregation points; Arc covers the hosts that matter most. The combination, managed from Vantage or CMC, gives the complete OT security picture that either sensor alone cannot.