The machine running a bottle line may be older than the engineer watching it. The controller opening a city water valve may speak a protocol designed when dial-up sounded futuristic. Both are now connected to networks, directly or indirectly, and neither welcomes a curious security scanner poking it to see what happens. In a normal office, a bad scan is annoying. On a factory floor, it can interrupt production. In a power plant, the consequences get serious fast.
Nozomi Networks built its business in that discomfort. Its software listens to industrial traffic, identifies assets and protocols, learns ordinary behavior, and flags vulnerabilities or unusual activity. Network sensors called Guardian sit close to operational technology. Arc adds detail from endpoints. Guardian Air watches the wireless spectrum. Vantage gathers the findings in a cloud console, while Vantage IQ uses machine learning and a private AI assistant to help teams decide which alarms deserve attention.
The customer is usually an organization where software failure can become a physical event: an electric utility, airport, hospital, refinery, manufacturer, railway, mine or water operator. Nozomi says it serves more than 1,000 customers. By March 2024, it reported 12,000-plus installations across six continents and more than 105 million monitored OT, IoT and IT devices. Its customer page now advertises 96 percent retention. These are enterprise contracts built for long stays.
The first thing that failed was the air gap
Andrea Carcano arrived at the problem from the wrong side of the lock. As a graduate student in Italy, he studied industrial control systems and created malware that exploited weak SCADA protocols. Later, working in Eni’s security operation center, he spent time at oil facilities and remote sites. Industrial engineers were skeptical of the IT team, and reasonably so: their job was to keep physical processes running. Carcano realized that defensive software developed during his doctorate could automate analysis those engineers were doing by hand.
There was one problem. Eni is an energy company, not a software shop. Carcano left in 2013 and recruited Moreno Carullo, the programmer and technologist he respected most. Their university prototype became the basis for SCADAguardian, Nozomi’s first product. The premise was practical: industrial networks were becoming connected, old assumptions about isolation were failing, and operators needed visibility without risking an outage.
“Eni is not a software development company, so it was not possible for me to develop the solution I envisioned internally.”Andrea Carcano, co-founder and CEO
The founders heard plenty of no. Carcano has since said they might have grown faster by focusing on vertical markets earlier and learning to decline large opportunities that were too distant from the company’s geography or DNA. Their break came when Enel, the Italian electricity giant, agreed to try the technology at a regional control center. That deployment expanded to other control centers and eventually connected into Enel’s central control room. The tiny company had found a demanding reference customer.
Sell the map before the alarm
Industrial cybersecurity vendors talk about detection, response and AI. Nozomi’s quiet advantage is more basic: it shows a customer what exists. Many operators still lack a reliable inventory of controllers, workstations, cameras, sensors and the conversations between them. Guardian inspects mirrored network traffic and builds that map passively. It can recognize hundreds of industrial and IT protocols, connect devices to known vulnerabilities, and learn the normal values and communication patterns of a physical process.
That makes a proof of concept unusually visual. One top-five global airport tested Nozomi against two rivals. Guardian produced results within hours, and the eventual deployment of roughly 20 sensors across three terminals cut time-to-visibility by 90 percent. A national gas distributor simulated 20 field stations, then bought more than 420 rugged Guardian sensors for wells, tie points and compressor stations. The product did not ask buyers to imagine future value. It drew the network in front of them.
The bars are conceptual, but the sequence matters. Guardian and Guardian Air collect network and wireless context. Arc contributes endpoint processes, USB activity and logged-in users. Threat Intelligence and Asset Intelligence enrich what the sensors see. Vantage centralizes many facilities, and Vantage IQ helps an understaffed security team sort the consequential from the merely noisy. Nozomi integrates the result into familiar systems such as SIEMs, ticketing tools and firewalls instead of demanding that the customer abandon its security operation center.
Customers changed their mind about the cloud
Nozomi’s original center of gravity was an appliance near the plant. By 2020, large customers were already buying SaaS elsewhere and asked for the same scalability, faster integration and lower management burden in OT security. The pandemic made remote operations urgent. The company introduced Vantage in limited availability in October 2020 and made it generally available in March 2021.
The smart decision was architectural. Vantage did not force Guardian customers into a dramatic migration. It extended their sensors into a cloud management layer. Plants could keep local views, choose which information synchronized, or remain fully on-premises when sovereignty, regulation, isolation or poor connectivity demanded it. This hybrid posture also widened the business model. Nozomi said its customer base more than doubled in 2020 while subscription revenue grew more than 110 percent. By 2024, annual recurring revenue had grown fivefold organically since the Vantage launch.
The ecosystem became the exit
Industrial selling rewards company. A plant operator may trust its automation vendor, integrator or managed-service provider long before it trusts a young security company. Nozomi leaned into that reality. IBM carried its technology into managed OT services. Honeywell, Schneider Electric, Fortinet, Keysight and others integrated, resold or operated it. Partners certified engineers and brought Nozomi through the gate.
Then the partners joined the cap table. A $100 million Series D in 2021 included Honeywell Ventures, Keysight, Telefónica Ventures and Porsche Ventures. Another $100 million Series E in 2024 brought in Mitsubishi Electric and Schneider Electric. Customers and distribution partners were now financing the roadmap they depended on. That is unusually strong diligence: an investor can inspect a deck, while a product partner watches the software behave inside a customer environment.
Mitsubishi Electric announced its acquisition in September 2025 and completed it on January 28, 2026. The Japanese industrial group already owned 7 percent. Its annual report records ¥130.471 billion in consideration for the remaining 93 percent; Nozomi calls the transaction a $1 billion acquisition. The purchase followed 2025 net revenue of $101.709 million, up from $74.695 million in 2024 and $62.560 million in 2023. Nozomi also says it reached sustained cash-flow break-even.
The acquirer did not discover Nozomi in a banker’s book. It had already invested, collaborated and watched the product meet mixed-vendor industrial reality.
Nozomi remains a branded, independently operated Mitsubishi subsidiary, with headquarters in San Francisco and R&D in Mendrisio, Switzerland. The promise is continued vendor neutrality. That matters because factories rarely run equipment from one manufacturer. Ownership by Mitsubishi creates a tension worth watching: its industrial reach can accelerate distribution, while customers still need proof that rival equipment will receive equal support.
What founders can copy
Nozomi treated industrial uptime as a product requirement. Passive observation made caution part of the wedge.
A map that appears within hours is easier to champion than a risk score promising value next quarter.
Network telemetry led naturally to endpoints, wireless, threat intelligence, SaaS management and AI analysis.
Vantage answered enterprise demand for SaaS while preserving the local deployment patterns customers trusted.
Partners delivered services, integrated the product, invested and eventually produced the acquirer.
The moat is accumulated protocol knowledge, field deployments and operator trust. An AI label alone cannot reproduce it.
The company’s culture matches the market’s temperament. Its public values emphasize frugality, transparency, persistence, autonomous decisions and customer obsession. Edgard Capdevielle, who became CEO in 2016, once said Nozomi resisted raising too much money before its product leadership was established. He scaled the go-to-market engine for a decade. In July 2026, after the acquisition and revenue milestone, Carcano returned as CEO and Capdevielle became an executive adviser. The next phase is explicitly founder-led and AI-focused.
Where the playbook stops working
- Passive discovery is only as complete as the traffic a sensor can see. Weak mirror-port configuration or poor sensor placement creates blind spots.
- Old serial networks and isolated assets may require polling or manual inventory work. Listening alone will not identify everything.
- Cloud centralization can be wrong for sites with data-residency rules, expensive links or strict isolation. Hybrid options are essential.
- Monitoring does not replace segmentation, backups, incident response or skilled operators. A good map is the beginning of a program.
- The enterprise proof-of-concept motion works when the product reveals value quickly and a buyer can expand across sites. It is a poor fit for small contracts with no land-and-expand path.
The market position
Nozomi sits in the cyber-physical systems protection market beside Claroty, Dragos, Armis, Forescout and Microsoft Defender for IoT. Buyers compare protocol coverage, asset identification, vulnerability quality, threat research, managed services and integrations. Nozomi’s pitch is breadth without abandoning industrial depth: network plus endpoint plus wireless telemetry, offered locally or through SaaS, across mixed-vendor estates.
Its latest moves push the product closer to the broader security stack. A 2026 Sophos Fusion integration connects OT findings with IT operations. Availability through Google Cloud Marketplace makes procurement easier. Vantage IQ now includes a private assistant designed to answer questions against a customer’s own OT and IoT data. The useful test will be whether AI reduces investigation time without inventing confidence around incomplete telemetry.
Thirteen years after two researchers revived a university prototype, the core idea remains refreshingly plain. Know what is connected. Learn how it normally behaves. Show operators the few changes that matter. Do it without becoming the outage everyone was hired to prevent. That formula turned industrial awkwardness into recurring software revenue - and eventually into Mitsubishi Electric’s largest strategic cybersecurity bet.