Most engineers think…
Most people assume OT security means putting an agent on every PLC or running active vulnerability scans across the plant floor. In OT, that thinking gets processes killed.
Nozomi Networks is built on a passive-first principle: Guardian listens to a SPAN/mirror port or TAP and does full deep packet inspection without sending a single packet to any OT device. Fragile PLCs, RTUs, and HMIs never know it's there. Vantage or CMC then aggregates data from many Guardian sensors into a single pane of glass, and Arc fills the blind spots by adding host-level context on endpoints. Understanding these four components — and what each one uniquely owns — is what separates a confident OT security answer from a vague one.
① What Nozomi Networks is — passive-first OT/IoT/ICS security
Nozomi Networks is a pure-play OT, IoT, and ICS security platform that delivers continuous asset visibility, threat detection, and risk management across industrial and operational environments. The core philosophy is passive-first: the platform's primary sensor, Guardian, watches network traffic through a SPAN port, mirror port, or TAP — it never injects packets, never touches a PLC, and never causes process disruption.
This matters because OT devices (PLCs, RTUs, HMIs, DCS controllers) are often running 24/7 industrial processes on firmware that cannot tolerate unexpected traffic. Nozomi's passive approach gives full visibility — asset inventory, network maps, protocol analysis, anomaly detection — with zero operational impact. The platform spans four components: Guardian (the sensor), Vantage (cloud SaaS management), CMC (on-prem management), and Arc (endpoint/host sensor). Together they cover the full OT/IoT estate from network to host.
Who uses it: OT engineers and plant security teams who need to see what is on their industrial network, SOC analysts bridging IT and OT, and critical infrastructure operators in energy, manufacturing, water, and transport.
Why does Nozomi Guardian use a passive SPAN/TAP approach rather than installing agents on OT devices?
② The four platform components — Guardian, Vantage, CMC and Arc
Guardian is the heart of the platform — the passive network sensor. It deploys as a physical appliance, a virtual machine, or a container, and performs deep packet inspection (DPI) on a SPAN/mirror/TAP copy of network traffic. Guardian auto-discovers assets (vendor, model, firmware, IP, MAC, protocols, Purdue level), visualises the network, detects anomalies and known threats, and assesses vulnerabilities against CVEs. Guardian Air is the wireless variant, covering Wi-Fi, Bluetooth, cellular, and drone spectrum.
Aggregation: Vantage vs CMC
Vantage is the cloud-native SaaS management layer. It pulls data from many Guardian sensors and Arc agents across multiple sites, provides a single pane of glass, dashboards, alert management, and cross-site queries. Vantage IQ is the AI/analytics add-on for faster triage and root-cause analysis. CMC (Central Management Console) is the on-premises or virtual alternative to Vantage — chosen for air-gapped or data-sovereignty environments where OT data cannot leave the site.
Arc is a lightweight host-based endpoint sensor. It adds host context that network monitoring alone cannot see: logged-in users, running processes, USB device connections, and local sessions. Arc deploys rapidly without network changes and reaches isolated segments where placing a SPAN tap would be impractical.
The core passive network sensor — DPI via SPAN/TAP, auto asset discovery, network map, anomaly + threat detection, CVE matching. Deploys as appliance, VM, or container.
Cloud-native SaaS management — aggregates many Guardians and Arc agents, single pane of glass across sites, dashboards, alerts, queries. Vantage IQ adds AI analytics.
Central Management Console — on-prem or virtual aggregation for air-gapped or data-sovereign sites; the on-prem alternative to Vantage for multi-Guardian estates.
Lightweight host-based endpoint sensor that adds user, process, and USB context and covers segments a passive network tap cannot reach.
In an interview, separate the sensor (Guardian — passive DPI on the network), the cloud management layer (Vantage — SaaS aggregation), the on-prem management layer (CMC — air-gapped aggregation), and the endpoint sensor (Arc — host context). Never conflate Guardian with Vantage — one is the sensor, the other is the management platform.
Which Nozomi component is designed for air-gapped or data-sovereign environments that cannot send OT data to a cloud service?
③ What the platform delivers — visibility, hybrid detection and risk
The three pillars Nozomi delivers are asset visibility, threat detection, and risk management. On visibility: Guardian builds a continuously updated asset inventory — capturing vendor, model, firmware version, IP/MAC, open protocols, and Purdue model level — and renders an interactive network map showing how devices communicate. Smart Polling (an optional add-on) sends selective active queries to enrich passive data with details like firmware version that cannot be read passively.
On detection: Nozomi uses a hybrid model. During a learning period, Guardian baselines normal OT communications; after that, anomaly detection flags any deviation (new device, unexpected protocol, unusual timing). Simultaneously, signature-based detection matches IOCs and rules updated by the Nozomi Networks Labs Threat Intelligence feed. Asset Intelligence (the second Labs feed) delivers curated device profiles that improve classification and reduce false positives.
On risk: Guardian matches discovered assets to known CVEs, produces risk scores, and prioritises remediation under OT patching constraints. Time Machine snapshots full network and asset state over time so teams can rewind to any point for forensics or recovery planning.
Guardian is passive, not a scanner — it never injects packets. It also does more than asset discovery: hybrid anomaly + signature detection, CVE vulnerability matching, Labs threat intelligence, and Time Machine forensics. Answering 'it just discovers devices' misses most of the platform's value.
▶ Watch an unauthorized OT device get detected and alerted
How Guardian detects a rogue device on the plant network end-to-end. Press Play for the healthy detection path, then Break it to see the classic blind spot.
An OT engineer finds a new unregistered device communicating with PLCs via Modbus TCP. Which Nozomi capability first flagged it?
④ Where Nozomi fits — Purdue model, deployment and integrations
Nozomi deploys across the Purdue reference model (Levels 0–5). Guardian sensors sit at aggregation switch points per zone or level — typically at Level 2 (HMI/SCADA) and Level 1 (control) boundaries — capturing all inter-level traffic without touching devices on the process floor. Sensors at the IT/OT DMZ (Level 3.5) catch cross-boundary traffic. Placement via SPAN or TAP is non-intrusive.
For multi-site estates the choice is: Vantage (SaaS) if the organisation is cloud-ready and wants Nozomi to manage scale and updates, or CMC if any site is air-gapped or governed by data-residency regulations. Arc agents extend coverage to host segments without additional network tap points.
Nozomi integrates broadly: SIEM/SOAR (Splunk, Microsoft Sentinel), ticketing (ServiceNow), firewalls (Palo Alto, Fortinet), and other OT platforms. Alerts and asset data flow into the IT SOC's existing tools, bridging the OT-SOC gap. Core sectors served: energy & utilities, oil & gas, manufacturing, water treatment, transportation, and critical national infrastructure.
Priya at Vidyut Power Generation in Nagpur faces this
An unregistered Windows workstation appears at Level 2 of the plant network and communicates with multiple PLCs using Modbus TCP at unusual hours — nobody in the OT team recognises the IP.
A contractor connected an unauthorized laptop during a maintenance window and never decommissioned it; the machine was never added to any asset register.
In Vantage > Asset Inventory, filter by 'Newly discovered' — the unregistered IP appears. The Network Map shows Modbus sessions from that node to several PLCs. Guardian raised an anomaly alert: a new node outside the learned baseline on an OT protocol.
Vantage ▸ Asset Inventory ▸ Newly Discovered + Network Map ▸ Anomaly AlertsIsolate the workstation at the managed switch, raise a CISO ticket via the ServiceNow integration, and update the asset whitelist policy so any new node triggers an immediate high-priority alert.
After isolation, Vantage shows the anomaly alert auto-resolves, the unauthorized Modbus sessions disappear from the Network Map, and no further alerts fire from that IP.
When investigating an OT incident, go to Vantage or CMC Asset Inventory first — the platform shows every discovered device with protocols, Purdue level, and CVE matches. The Network Map shows all active communications. Combining both answers most OT security questions before you touch a single device.
A site has strict data-residency laws preventing any OT telemetry from leaving the country. Which management tier should they choose and why?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is Nozomi called 'passive-first' and what does that mean for a production OT environment? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Guardian
- Nozomi's core passive network sensor — performs DPI via SPAN/mirror/TAP, auto-discovers assets, detects anomalies and threats, assesses CVE risk. Deploys as appliance, VM, or container.
- Vantage
- Nozomi's cloud-native SaaS management platform — aggregates data from many Guardian sensors and Arc agents, provides a single pane of glass, dashboards, and alerts. Vantage IQ adds AI analytics.
- CMC (Central Management Console)
- On-premises or virtual aggregation console for multi-Guardian estates — the air-gapped, data-sovereign alternative to Vantage.
- Arc
- Lightweight Nozomi host-based endpoint sensor that adds user, process, and USB context and covers network segments passive SPAN taps cannot reach.
- Passive monitoring
- Capturing network traffic via a SPAN/mirror port or TAP without injecting packets — gives full visibility with zero operational impact on OT devices.
- Purdue Model
- A hierarchical reference architecture (Levels 0–5) for industrial control systems; Nozomi maps discovered assets to Purdue levels and detects cross-level anomalies.
- Time Machine
- Nozomi feature that snapshots full network and asset state over time for forensic rewind and post-incident recovery.
- Smart Polling
- Optional Nozomi add-on for selective active queries to enrich passive asset data — used carefully against devices confirmed safe for active probing.
- Vantage IQ
- AI/analytics add-on for Vantage providing faster alert triage, cross-site correlation, and root-cause analysis.
- Guardian Air
- Wireless variant of the Guardian sensor covering Wi-Fi, Bluetooth, cellular, and drone spectrum for full wireless OT/IoT visibility.
📚 Sources
- Nozomi Networks — Guardian: OT & IoT Network Security Sensor. nozominetworks.com/products/guardian
- Nozomi Networks — Vantage: Cloud-Native OT/IoT Security Management. nozominetworks.com/products/vantage
- Nozomi Networks — Arc: OT/IoT Endpoint Sensor. nozominetworks.com/products/arc
- Nozomi Networks — Central Management Console (CMC). nozominetworks.com/products/central-management-console
- Nozomi Networks — Threat Intelligence & Asset Intelligence Subscriptions (Nozomi Networks Labs). nozominetworks.com/products/threat-intelligence
- Nozomi Networks — OT/IoT Security Platform Overview. nozominetworks.com/solutions/ot-iot-security
What's next?
Got the platform overview? Next, go deep on Guardian internals — how passive DPI works, how the anomaly baseline is built, and how Guardian Air extends coverage to wireless and drone spectrum.