WASHINGTON — For more than a decade, Dragos Inc. has been quietly building what it calls the world’s largest dataset for operational technology cybersecurity. Five petabytes of daily OT telemetry. Research on over 600 industrial protocols.
Years of incident response work tracking adversaries who target power grids, pipelines, and water systems. That data now has a new purpose.
On Monday, the company released EmberAI, an artificial intelligence assistant designed specifically for the people who defend industrial control systems. Not for Silicon Valley coders. For plant engineers.
For IT practitioners who suddenly find themselves responsible for factory floors. For veteran OT specialists who are stretched thin.
The timing is no accident. Attacks on critical infrastructure are climbing. The pool of security experts who understand operational technology — the specialized computers that run turbines, open valves, and manage electrical substations — is not growing fast enough to keep pace.
Dragos is betting that general-purpose AI cannot fix that gap. The company argues that off-the-shelf language models lack the context to make sense of an industrial environment. A vulnerability in a corporate laptop is one thing.
A vulnerability in a programmable logic controller that controls a natural gas pipeline is something else entirely. Generic AI, Dragos says, cannot tell the difference between a critical exposure and routine noise because it does not understand the plant and its systems.
EmberAI runs on the Dragos Intelligence Fabric. That fabric is built from data the company has collected since it began tracking adversaries more than ten years ago. The company also holds status as a Common Vulnerabilities and Exposures Numbering Authority, which gives it early access to vulnerability research.
All of that feeds into the AI. Analysts can ask EmberAI questions in plain language.
They can query their own assets, their vulnerabilities, their network activity. The AI ranks threats by operational impact — not by some generic severity score, but by what actually matters to a specific facility. That is a feature designed for a world where a single misprioritized alert can shut down a factory or leave a water treatment plant exposed.
The tool is meant to be usable by people who are not cybersecurity specialists. That includes plant engineers who know the machinery but not the threat landscape. It includes IT people who know networks but not industrial protocols.
And it includes seasoned OT analysts who need to move faster than a manual search allows. The industries in the crosshairs are the ones that keep modern life running.
Power grids. Manufacturing plants. Water systems.
Pipelines. Data centers.
All of them rely on operational technology that was designed for reliability, not security. All of them face a shortage of people who can defend that technology. EmberAI does not solve the shortage.
It tries to make the people who are available more effective. Whether that works at scale — whether a plant engineer with no security background can trust an AI’s judgment on a live industrial network — is a question that will be answered in the field, not in a press release. For now, Dragos is pushing the product into a market that is hungry for any advantage.
The threat is real. The talent gap is real.
The data is enormous. The AI is new.
