# Nozomi Networks OT/IoT Security — Guardian, Vantage, CMC & Arc Platform Overview Source: https://ai.techclick.in/blog_nozomi_networks_ot_security_overview Markdown: https://ai.techclick.in/blog_nozomi_networks_ot_security_overview.md Publisher: Techclick Infosec Pvt Ltd Complete 2026 guide to Nozomi Networks OT/IoT/ICS security: Guardian passive sensor, Vantage SaaS, CMC on-prem console, and Arc endpoint — what each component delivers and how the platform provides visibility, detection, and risk management. Nozomi Networks OT/IoT Security — Guardian, Vantage, CMC & Arc Platform Overview student learning map A visual study map for Nozomi Networks OT/IoT Security — Guardian, Vantage, CMC & Arc Platform Overview showing learning path, evidence, traps, and practice sequence. TECHCLICK STUDY MAP Nozomi Networks OT/IoT Security — Guardian, Vantage,... Nozomi · learn the flow, prove with evidence, avoid unsafe shortcuts 1. Start 🎯 By the end you will be able to 2. Understand Pick where you want to start 3. Prove ① What Nozomi Networks is —... 4. Practice ② The four platform components —... How to use this page First build the mental model, then connect the concept to a realistic production decision. Finish by testing yourself. Techclick Infosec Pvt Ltd | ai.techclick.in | Training Contact: WhatsApp +91 92772 29456 Content-specific feature visual for this lesson: use it as the 60-second map before reading the full detail. Most engineers think… Most people assume OT security means putting an agent on every PLC or running active vulnerability scans across the plant floor. In OT, that thinking gets processes killed. Nozomi Networks is built on a passive-first principle : Guardian listens to a SPAN/mirror port or TAP and does full deep packet inspection without sending a single packet to any OT device. Fragile PLCs, RTUs, and HMIs never know it's there. Vantage or CMC then aggregates data from many Guardian sensors into a single pane of glass, and Arc fills the blind spots by adding host-level context on endpoints. Understanding these four components — and what each one uniquely owns — is what separates a confident OT security answer from a vague one. ## ① What Nozomi Networks is — passive-first OT/IoT/ICS security Nozomi Networks is a pure-play OT, IoT, and ICS security platform that delivers continuous asset visibility, threat detection, and risk management across industrial and operational environments. The core philosophy is passive-first : the platform's primary sensor, Guardian , watches network traffic through a SPAN port, mirror port, or TAP — it never injects packets, never touches a PLC, and never causes process disruption. This matters because OT devices (PLCs, RTUs, HMIs, DCS controllers) are often running 24/7 industrial processes on firmware that cannot tolerate unexpected traffic. Nozomi's passive approach gives full visibility — asset inventory, network maps, protocol analysis, anomaly detection — with zero operational impact . The platform spans four components : Guardian (the sensor), Vantage (cloud SaaS management), CMC (on-prem management), and Arc (endpoint/host sensor). Together they cover the full OT/IoT estate from network to host. Who uses it: OT engineers and plant security teams who need to see what is on their industrial network, SOC analysts bridging IT and OT, and critical infrastructure operators in energy, manufacturing, water, and transport. Legend Guardian sensor / Nozomi component (royal) pipeline stage (DPI, detect, enrich) diagram heading diagram background panel supporting label / OT detail Figure 1 — The Nozomi passive monitoring loop Every site runs the same passive-first loop — Guardian captures without touching, then escalates findings up to management. - The Nozomi passive monitoring loop Capture SPAN/TAP, no packets sent Inspect DPI on OT protocols Discover assets + network map Detect anomaly + signature Report Vantage or CMC Every site runs the same passive-first loop — Guardian captures without touching, then escalates findings up to management. Figure 2 — Four platform components — layered view Arc and Guardian feed data up through CMC or Vantage to give analysts a unified view. Four platform components — layered view Vantage / CMC Multi-site aggregation and single pane of glass Guardian sensors Passive DPI — network visibility per site or zone Arc endpoints Host context — users, processes, USB per device Arc and Guardian feed data up through CMC or Vantage to give analysts a unified view. Quick check · Q1 of 10 · Understand Why does Nozomi Guardian use a passive SPAN/TAP approach rather than installing agents on OT devices? a) It is cheaper than agents b) Passive monitoring gives full visibility with zero operational impact on fragile PLCs and RTUs c) Active probing is blocked by firewalls d) Guardian only supports SPAN — agents are not technically possible Correct: b. OT devices like PLCs and RTUs run 24/7 industrial processes on fragile firmware; active probes or agents risk crashing devices or disrupting processes. Passive SPAN/TAP monitoring gives full network visibility without touching those devices. 👉 So far: Nozomi Networks = passive-first OT/IoT/ICS security: Guardian listens via SPAN/TAP (zero impact on OT devices), feeds Vantage or CMC for management, Arc fills host blind spots. ## ② The four platform components — Guardian, Vantage, CMC and Arc Guardian is the heart of the platform — the passive network sensor. It deploys as a physical appliance, a virtual machine, or a container, and performs deep packet inspection (DPI) on a SPAN/mirror/TAP copy of network traffic. Guardian auto-discovers assets (vendor, model, firmware, IP, MAC, protocols, Purdue level), visualises the network, detects anomalies and known threats, and assesses vulnerabilities against CVEs. Guardian Air is the wireless variant, covering Wi-Fi, Bluetooth, cellular, and drone spectrum. ### Aggregation: Vantage vs CMC Vantage is the cloud-native SaaS management layer. It pulls data from many Guardian sensors and Arc agents across multiple sites, provides a single pane of glass, dashboards, alert management, and cross-site queries. Vantage IQ is the AI/analytics add-on for faster triage and root-cause analysis. CMC (Central Management Console) is the on-premises or virtual alternative to Vantage — chosen for air-gapped or data-sovereignty environments where OT data cannot leave the site. Arc is a lightweight host-based endpoint sensor. It adds host context that network monitoring alone cannot see: logged-in users, running processes, USB device connections, and local sessions. Arc deploys rapidly without network changes and reaches isolated segments where placing a SPAN tap would be impractical. Figure 3 — Vantage (SaaS) vs CMC (on-prem) — choosing your aggregation tier Both aggregate many Guardians but suit different environments — pick by cloud readiness and data-sovereignty needs. Vantage (SaaS) vs CMC (on-prem) — choosing your aggregation tier Vantage (SaaS) Cloud-native, Nozomi-managed Scales across unlimited sites Vantage IQ AI analytics built in Best for cloud-ready, multi-site CMC (On-prem) Deployed on your servers or VM Fully air-gapped operation You manage updates and HA Best for sovereign or air-gapped Both aggregate many Guardians but suit different environments — pick by cloud readiness and data-sovereignty needs. 📡 Guardian tap to flip The core passive network sensor — DPI via SPAN/TAP, auto asset discovery, network map, anomaly + threat detection, CVE matching. Deploys as appliance, VM, or container. ☁️ Vantage tap to flip Cloud-native SaaS management — aggregates many Guardians and Arc agents, single pane of glass across sites, dashboards, alerts, queries. Vantage IQ adds AI analytics. 🖥️ CMC tap to flip Central Management Console — on-prem or virtual aggregation for air-gapped or data-sovereign sites; the on-prem alternative to Vantage for multi-Guardian estates. 🔍 Arc tap to flip Lightweight host-based endpoint sensor that adds user, process, and USB context and covers segments a passive network tap cannot reach. Name the four pieces clearly In an interview, separate the sensor (Guardian — passive DPI on the network), the cloud management layer (Vantage — SaaS aggregation), the on-prem management layer (CMC — air-gapped aggregation), and the endpoint sensor (Arc — host context). Never conflate Guardian with Vantage — one is the sensor, the other is the management platform. Quick check · Q2 of 10 · Remember Which Nozomi component is designed for air-gapped or data-sovereign environments that cannot send OT data to a cloud service? a) Vantage b) Guardian Air c) Arc d) CMC (Central Management Console) Correct: d. CMC is the on-premises or virtual aggregation console — the alternative to Vantage for environments that are air-gapped or governed by data-residency requirements that prevent cloud connectivity. 👉 So far: Four components: Guardian (passive sensor), Vantage (SaaS management + Vantage IQ AI), CMC (on-prem for air-gapped sites), Arc (endpoint/host sensor for user and process context). ## ③ What the platform delivers — visibility, hybrid detection and risk The three pillars Nozomi delivers are asset visibility , threat detection , and risk management . On visibility: Guardian builds a continuously updated asset inventory — capturing vendor, model, firmware version, IP/MAC, open protocols, and Purdue model level — and renders an interactive network map showing how devices communicate. Smart Polling (an optional add-on) sends selective active queries to enrich passive data with details like firmware version that cannot be read passively. On detection: Nozomi uses a hybrid model . During a learning period, Guardian baselines normal OT communications; after that, anomaly detection flags any deviation (new device, unexpected protocol, unusual timing). Simultaneously, signature-based detection matches IOCs and rules updated by the Nozomi Networks Labs Threat Intelligence feed. Asset Intelligence (the second Labs feed) delivers curated device profiles that improve classification and reduce false positives. On risk: Guardian matches discovered assets to known CVEs , produces risk scores, and prioritises remediation under OT patching constraints. Time Machine snapshots full network and asset state over time so teams can rewind to any point for forensics or recovery planning. Figure 4 — Nozomi platform — one pane, many inputs Vantage or CMC aggregates Guardian and Arc data from every site, integrating out to SIEM, ticketing, and firewall platforms. Nozomi platform — one pane, many inputs Vantage/CMC single pane of glass Guardian (OT LAN) Guardian Air (WiFi) Arc (endpoints) Splunk/Sentinel ServiceNow Palo Alto NGFW Vantage or CMC aggregates Guardian and Arc data from every site, integrating out to SIEM, ticketing, and firewall platforms. 'Nozomi is just a network scanner' under-sell Guardian is passive, not a scanner — it never injects packets. It also does more than asset discovery: hybrid anomaly + signature detection, CVE vulnerability matching, Labs threat intelligence, and Time Machine forensics. Answering 'it just discovers devices' misses most of the platform's value. ### ▶ Watch an unauthorized OT device get detected and alerted How Guardian detects a rogue device on the plant network end-to-end. Press Play for the healthy detection path, then Break it to see the classic blind spot. ① Traffic copy A contractor's laptop connects to the OT LAN. A managed switch mirrors all traffic on that VLAN to Guardian via a SPAN port. ▼ ② DPI + discover Guardian performs passive DPI on the mirrored traffic. It identifies a new IP and MAC it has never seen, communicating via Modbus TCP to a PLC. ▼ ③ Anomaly flag The new node is outside the learned baseline. Guardian raises an anomaly alert: unknown device communicating on an OT protocol — high priority. ▼ ④ Alert in Vantage The alert surfaces in Vantage with the device's IP, MAC, Purdue level, and all Modbus sessions. A ServiceNow ticket is auto-created for the OT security team. Press Play to step through how Guardian catches a rogue OT device. Then press Break it . ▶ Play Next ▶ ⚠ Break it ↺ Reset Quick check · Q3 of 10 · Apply An OT engineer finds a new unregistered device communicating with PLCs via Modbus TCP. Which Nozomi capability first flagged it? a) Anomaly detection alerting on a new node outside the learned baseline b) Smart Polling querying the device directly c) Time Machine forensic snapshot d) CMC configuration policy Correct: a. Guardian's anomaly detection builds a self-learned baseline of normal OT communications. A new device communicating via Modbus TCP is a deviation from that baseline, so it triggers an anomaly alert — this is the first automatic flag before any manual investigation. 👉 So far: Three pillars: visibility (asset inventory + network map + Smart Polling), hybrid detection (anomaly baseline + signatures + Labs threat intel), and risk (CVE matching + Time Machine forensics). ## ④ Where Nozomi fits — Purdue model, deployment and integrations Nozomi deploys across the Purdue reference model (Levels 0–5). Guardian sensors sit at aggregation switch points per zone or level — typically at Level 2 (HMI/SCADA) and Level 1 (control) boundaries — capturing all inter-level traffic without touching devices on the process floor. Sensors at the IT/OT DMZ (Level 3.5) catch cross-boundary traffic. Placement via SPAN or TAP is non-intrusive. For multi-site estates the choice is: Vantage (SaaS) if the organisation is cloud-ready and wants Nozomi to manage scale and updates, or CMC if any site is air-gapped or governed by data-residency regulations. Arc agents extend coverage to host segments without additional network tap points. Nozomi integrates broadly: SIEM/SOAR (Splunk, Microsoft Sentinel), ticketing (ServiceNow), firewalls (Palo Alto, Fortinet), and other OT platforms. Alerts and asset data flow into the IT SOC's existing tools, bridging the OT-SOC gap. Core sectors served: energy & utilities, oil & gas, manufacturing, water treatment, transportation, and critical national infrastructure. Figure 5 — How an OT anomaly becomes a managed alert From a Guardian detection to a managed incident in Vantage and a ticket in ServiceNow — end-to-end alert lifecycle. How an OT anomaly becomes a managed alert Baseline Guardian learns normal OT comms Deviate new device or unusual traffic Alert anomaly flag + asset context Aggregate Vantage/CMC correlates Ticket ServiceNow / SIEM From a Guardian detection to a managed incident in Vantage and a ticket in ServiceNow — end-to-end alert lifecycle. Priya at Vidyut Power Generation in Nagpur faces this An unregistered Windows workstation appears at Level 2 of the plant network and communicates with multiple PLCs using Modbus TCP at unusual hours — nobody in the OT team recognises the IP. Likely cause A contractor connected an unauthorized laptop during a maintenance window and never decommissioned it; the machine was never added to any asset register. Diagnosis In Vantage > Asset Inventory, filter by 'Newly discovered' — the unregistered IP appears. The Network Map shows Modbus sessions from that node to several PLCs. Guardian raised an anomaly alert: a new node outside the learned baseline on an OT protocol. Vantage ▸ Asset Inventory ▸ Newly Discovered + Network Map ▸ Anomaly Alerts Fix Isolate the workstation at the managed switch, raise a CISO ticket via the ServiceNow integration, and update the asset whitelist policy so any new node triggers an immediate high-priority alert. Verify After isolation, Vantage shows the anomaly alert auto-resolves, the unauthorized Modbus sessions disappear from the Network Map, and no further alerts fire from that IP. Prove it from asset inventory + network map When investigating an OT incident, go to Vantage or CMC Asset Inventory first — the platform shows every discovered device with protocols, Purdue level, and CVE matches. The Network Map shows all active communications. Combining both answers most OT security questions before you touch a single device. Quick check · Q4 of 10 · Analyze A site has strict data-residency laws preventing any OT telemetry from leaving the country. Which management tier should they choose and why? a) Vantage, because it scales more easily b) Guardian Air, because it covers all wireless protocols c) Arc, because it is lightweight and fast to deploy d) CMC, because it runs entirely on-premises and keeps all data within the site Correct: d. CMC is the on-prem console designed exactly for this scenario — it aggregates Guardian data locally without sending anything to a cloud service, satisfying air-gapped and data-sovereignty constraints. Vantage would violate the residency requirement. 👉 So far: Deploy Guardian at Purdue aggregation points (SPAN/TAP), choose Vantage for cloud-ready multi-site or CMC for air-gapped, extend with Arc, and integrate into Splunk/Sentinel/ServiceNow. ### 🤖 Ask the AI Tutor Tap any question — instant, scoped to this lesson. No login, no waiting. What is Nozomi Networks and what problem does it solve? What are the four Nozomi platform components? How does Nozomi's hybrid detection work? When would you choose CMC instead of Vantage? What does Time Machine do and why does it matter in OT? What is Smart Polling and how does it fit the passive-first philosophy? Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in. ## 📝 Wrap-up assessment — six more You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end. Q5 · Remember Which Nozomi component performs passive DPI via a SPAN or TAP port? a) Arc b) Guardian c) CMC d) Vantage IQ Correct: b. Guardian is the core passive network sensor. It connects to a SPAN/mirror port or TAP, performs DPI on mirrored traffic, and auto-discovers assets — without injecting any packets onto the OT network. Q6 · Understand What is the primary reason Nozomi does NOT install agents directly on PLCs or RTUs? a) PLCs run proprietary operating systems that block agents b) Active agents could disrupt fragile OT devices running real-time industrial processes c) Agents are too expensive to license for every device d) Guardian can only run on Windows hosts Correct: a. OT devices like PLCs and RTUs often run real-time firmware with no capacity for additional software and can crash or misbehave if unexpected traffic or processes are introduced. Passive monitoring avoids all risk to the industrial process. Q7 · Apply Your OT network spans three air-gapped sites in different states with strict data-residency laws. Which Nozomi management layer fits? a) Vantage SaaS, because it scales across many sites b) Guardian Air, because it covers all wireless protocols c) CMC, because it runs on-prem and keeps data within the site d) Arc, because it requires no network changes Correct: c. CMC is the on-prem/virtual Central Management Console designed for air-gapped and data-sovereign environments. It aggregates Guardian data locally without sending anything to a cloud service — exactly what strict data-residency laws require. Q8 · Analyze Guardian detects a new device on the OT network at 2 AM communicating via Modbus TCP with multiple PLCs. What detection layer fired first? a) Signature matching a known Modbus exploit CVE b) Threat Intelligence feed update from Nozomi Labs c) Anomaly detection — the new node is outside the learned baseline d) Smart Polling query returning unexpected firmware version Correct: c. Guardian's anomaly-based detection baselines all normal OT communications during a learning period. A brand-new, unregistered device is by definition outside that baseline, so anomaly detection fires immediately — before any signature match, and regardless of whether a known CVE or IOC exists for the device. Q9 · Evaluate An interviewer asks: what does Arc add to a Nozomi deployment that Guardian alone cannot provide? Best answer? a) Arc replaces Guardian for network DPI b) Arc provides cloud-native SaaS aggregation c) Arc adds host context — users, processes, and USB — and reaches isolated segments passive SPAN taps cannot cover d) Arc performs CVE vulnerability matching against asset inventory Correct: c. Guardian covers the network layer via passive SPAN/TAP. Arc is the endpoint/host sensor that adds what network monitoring cannot see: who is logged in, what processes are running, what USB devices are connected, and traffic in segments where placing a SPAN port would require network changes. Q10 · Evaluate What is the strongest reason to deploy both Threat Intelligence AND Asset Intelligence from Nozomi Labs? a) They are bundled together and cannot be separated b) Threat Intelligence detects known attacks; Asset Intelligence improves device classification and cuts false positives caused by misidentified assets c) Asset Intelligence replaces CVE matching for vulnerability management d) They are both required for Guardian Air to function Correct: b. Threat Intelligence (IOCs, YARA rules, signatures) keeps detection current against known threats. Asset Intelligence (curated device profiles and behaviors) improves how Guardian classifies discovered assets — fewer misidentifications means fewer false-positive alerts. Together they raise both detection accuracy and classification accuracy. Submit all answers Try again Lesson complete — saved to your profile. Almost! You need 70% (7 of 10) — re-read the path that tripped you up and tap "Try again". ### 🧠 In your own words Type one line: why is Nozomi called 'passive-first' and what does that mean for a production OT environment? Then compare with the expert version. Compare with expert answer Expert version: Passive-first means Guardian connects to a SPAN/mirror port or TAP and captures a copy of network traffic — it never sends any packet to a PLC, RTU, or HMI. In a production OT environment this is critical because those devices run real-time industrial processes on fragile firmware; any unexpected traffic or software agent risks process disruption, downtime, or safety incidents. Passive monitoring gives complete asset visibility, threat detection, and vulnerability assessment with literally zero operational impact on the devices that run the plant. ### 🗣 Teach a friend Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary. Generate my one-liner 📩 Quiz me on this in 7 days. Opt in and we'll email 3 micro-questions on Nozomi Networks at Day 1, Day 7 and Day 30 — spaced repetition is how this sticks. Un-tick any time. ### 📖 Glossary Guardian Nozomi's core passive network sensor — performs DPI via SPAN/mirror/TAP, auto-discovers assets, detects anomalies and threats, assesses CVE risk. Deploys as appliance, VM, or container. Vantage Nozomi's cloud-native SaaS management platform — aggregates data from many Guardian sensors and Arc agents, provides a single pane of glass, dashboards, and alerts. Vantage IQ adds AI analytics. CMC (Central Management Console) On-premises or virtual aggregation console for multi-Guardian estates — the air-gapped, data-sovereign alternative to Vantage. Arc Lightweight Nozomi host-based endpoint sensor that adds user, process, and USB context and covers network segments passive SPAN taps cannot reach. Passive monitoring Capturing network traffic via a SPAN/mirror port or TAP without injecting packets — gives full visibility with zero operational impact on OT devices. Purdue Model A hierarchical reference architecture (Levels 0–5) for industrial control systems; Nozomi maps discovered assets to Purdue levels and detects cross-level anomalies. Time Machine Nozomi feature that snapshots full network and asset state over time for forensic rewind and post-incident recovery. Smart Polling Optional Nozomi add-on for selective active queries to enrich passive asset data — used carefully against devices confirmed safe for active probing. Vantage IQ AI/analytics add-on for Vantage providing faster alert triage, cross-site correlation, and root-cause analysis. Guardian Air Wireless variant of the Guardian sensor covering Wi-Fi, Bluetooth, cellular, and drone spectrum for full wireless OT/IoT visibility. #### 📚 Sources Nozomi Networks — Guardian: OT & IoT Network Security Sensor . nozominetworks.com/products/guardian - Nozomi Networks — Vantage: Cloud-Native OT/IoT Security Management . nozominetworks.com/products/vantage - Nozomi Networks — Arc: OT/IoT Endpoint Sensor . nozominetworks.com/products/arc - Nozomi Networks — Central Management Console (CMC) . nozominetworks.com/products/central-management-console - Nozomi Networks — Threat Intelligence & Asset Intelligence Subscriptions (Nozomi Networks Labs) . nozominetworks.com/products/threat-intelligence - Nozomi Networks — OT/IoT Security Platform Overview . nozominetworks.com/solutions/ot-iot-security ### What's next? Got the platform overview? Next, go deep on Guardian internals — how passive DPI works, how the anomaly baseline is built, and how Guardian Air extends coverage to wireless and drone spectrum. Next · All interview lessons → Practice on exam.techclick.in → --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt