The OT detection market is crowded with good engineering and better slideware. Passive sensors, protocol dissectors for Modbus and DNP3 and IEC-104, machine-learning baselines that learn what normal looks like on your process and raise a hand when it drifts. The technology is real. The failures we see are almost never about detection quality; they are about everything around it.
A detection platform nobody logs into is a subscription, not a control.
The metric that matters
Time-to-value: the calendar days between purchase order and the first alert a human acted on. For some deployments that number is three weeks; for others it is measured in fiscal years, while the console collects dust behind a login nobody owns. The difference is rarely the vendor’s algorithms. It is whether anomaly detection was tuned to your process instead of a demo reel, whether someone owned the baseline period, and above all, where the alerts land.
Integration is the feature
The deciding question for any OT detection buy: does it feed the processes you already run? Alerts that arrive in the SOC’s existing queue, enriched and correlated with the identity and session context from your privileged front door, get acted on. Alerts that live in yet another standalone console, with its own login and its own dialect, get discovered during the post-incident review. AI-assisted anomaly detection earns its keep precisely here: cutting the noise floor so the alerts that do cross into your SOC are worth the interruption.
How to buy it
- Pilot on your ugliest segment, not the vendor’s cleanest, and score time-to-first-actioned-alert.
- Weigh the integration surface: native paths into your SIEM, your SOC workflow and your access records beat any feature the datasheet leads with.
- Budget the tuning, not just the license: the baseline is a project with an owner and an end date.
- Insist on identity context: an anomaly plus who was on the asset is a lead; an anomaly alone is homework.
We run these pilots and score them for operators who do not have a spare quarter to lose. If your detection shortlist is longer than your tuning budget, ask us what we would test first.
We score detection pilots honestly, on your ugliest segment. The results tend to settle long debates.