Nozomi Networks Reviews

The main use case for Nozomi Networks for me was to bring up the asset inventory. My client opted for Nozomi Networks for the first time to help them know their assets better. They had many new integrations in their environment, and they were really concerned about what is present, what is removed, and what has been existent in their environment for a while that they didn't know about.

Their main use case was for asset inventory and mapping.

The feature that really impressed me along with the asset inventory mapping was that Nozomi Networks identified the protocol being used, the version of the devices and systems, and the version of the firmware were also mapped. It also gave us when the end of life or end of support occurs. This feature was really impressive with Nozomi Networks product.

The firmware version visibility from Nozomi Networks really helped us to check the interoperability of the device with other devices. The end-of-life notification or the end-of-life flagging helped us to plan our next purchase of the device or next upgrade and start negotiating with the vendors. In that way, we can strengthen the cybersecurity posture of our client.

I would suggest that Nozomi Networks could bring up a feature to link the risk rating of the client's assets to the business importance. For example, a building automation system is more important to a building than a traffic counter. An access management system is more important than a lighting control because when access management is lost, the building's security is at question, so that becomes a digital crown jewel for them.

It would be great if Nozomi Networks could do some learning about the business critical functions and assign risk scores to assets based on these critical functionality scores and risk scores.

I have used Nozomi Networks products for around a year.

The main challenge with mapping Nozomi Networks for asset inventory was the new integrations. New controllers were added, and new workstations were also added for the new controllers. It was a bit challenging to integrate it with Nozomi Networks, but with trial and error, we were able to easily do it. Nozomi Networks did provide good support for this challenge, and we overcame it.

The scalability was good with Nozomi Networks. Devices set up across the site enhanced the visibility and communication. The scalability was very good.

As I mentioned earlier, the customer support from Nozomi Networks was really helpful. With their help only we could resolve some issues we faced during our project execution.

I did not have previous experience with other solutions. It was my first experience with Nozomi Networks Guardian.

My advice would be to start early with an OT monitoring tool, an OT traffic monitoring tool such as Nozomi Networks. The integration becomes very difficult when customers try to implement such solutions in the later stages. I would recommend the customers to go for an early installation and onboarding of Nozomi Networks.

The clients were really impressed with Nozomi Networks mapping and asset inventory listing. I believe it helped them greatly to know about what they have. I would rate this review an 8.

On-premises

We use Nozomi Networks as an intrusion detection system for OT deployments, automation systems, and IoT systems such as medical equipment to protect medical systems and smart meters. We detect any anomalies in the network, whether in operation networks, IoT networks, or IT networks, and it is the best intrusion detection solution with its intelligence.

We work with Nozomi Networks real-time visibility feature and deploy the solution for our customers.

The real-time visibility from Nozomi Networks helps with threat detection for our customers because almost all customers have integrated this IDS into their SOC, so they are getting full visibility on any anomalies in the network and immediate intelligence on that.

Integrating Nozomi Networks with third-party systems gives visibility in the network. We connect this with a SOC and SIEM solutions, and they have better visibility on the entire network.

Nozomi Networks brings the main benefits of visibility and control, asset tracking with full visibility of the assets in the network, and threat intelligence with anomaly detection, so they have peace of mind and the system is always on watch.

We are utilizing the machine learning in Nozomi Networks, which is part of the Nozomi Networks package. We are deploying it for the customers and they take care of the operation side. We do the implementation only.

Nozomi Networks has the best AI-based detection and intrusion detection solution. It is very robust, easy to deploy, and easy to use with a very user-friendly GUI and good support in terms of product and after-sales support. They have vendor support in our region, and they are the best when it comes to IDS solutions.

I would like to see improvements in Nozomi Networks, probably more AI-based integration and better native integration with SOC and SOAR platforms.

I would like to see specific features included in the next releases of Nozomi Networks, such as improvements in threat intelligence. They have competition from Dragos, which I believe is better in threat intelligence.

I do not have much of an answer about the key differences of Nozomi Networks in comparison to other cyber defense solutions because I only work with Nozomi Networks. However, I heard from the market that they might lack in threat intelligence compared to Dragos. Other than that, I see Nozomi Networks as the best platform for customers, easy to manage, deploy, and operate. The cons might be that they lack some threat intelligence features that Dragos offers.

We have been working with Nozomi Networks for four years.

We have faced downtimes, crashes, or performance issues with certain implementations. We had certain device card issues, but those were rectified immediately as an RMA was issued and addressed promptly. It is not that there are no issues at all, but they have been addressed, and that matters most.

Nozomi Networks is scalable. You can add more locations with more devices and integrate with the CMC, and that is not a problem at all. You can also have high availability if you want.

My experience with the technical support and customer service teams of Nozomi Networks is very good. That is one good part of Nozomi Networks.

Positive

We did not face many issues during the deployment process with Nozomi Networks. We did multiple implementations and it was all smooth.

For threat detection, we have an IPS solution for intrusion prevention. Nozomi Networks works as an intrusion detection system, and we have a prevention system with TXOne that can do virtual locking, along with many features. This is part of Trend Micro, so we sell it as an IPS and as a firewall with different technologies, including portable inspectors and their own threat intelligence platform.

I assess the impact of potential threats detected by Nozomi Networks as high because it is mostly deployed in critical infrastructure. It is a very critical technology that customers are using to be safe, ensuring business continuity, and that matters most for the industry.

Given my very rich experience with Nozomi Networks technologies, I would advise organizations considering it to look primarily into ICS system cybersecurity and IoT. They can also enhance their focus on enterprise IT security. I rate this product an eight out of ten.

On-premises

My main use case for Nozomi Networks is to detect devices in the environment, especially IoT devices, or any kind of devices that connect to the network, and we need to detect them. We normally check through our console for any kind of device. For example, if a user tries to connect any device to the network or any unrecognized device is available, we monitor it. Beyond that, we check vulnerabilities of our IoT devices, mainly. We monitor any kind of abnormal traffic or any kind of abnormality on those devices, and we get a report if we want to do any patching for devices.

The best features Nozomi Networks offers are device detection and vulnerability checking, including CVEs, and reports. In my scenario, for some of the devices, we cannot always know the location or whether we have missed any vulnerabilities. There is a large-scale variety of devices, so we cannot go through each device one-by-one and check if any CVEs were detected recently or are up to date. In that case, Nozomi Networks portal is good for us. For now, we use it for device detection and vulnerabilities only, and I am satisfied with the current functionality.

Nozomi Networks has impacted my organization positively because our technical staff changes. In those cases, we sometimes do not know about certain devices. For example, it can be difficult with some devices, and they operate in unknown locations, such as webcams or IoT devices located in different areas. In that case, we can get an idea about what devices are in our network and any abnormal traffic or any kind of abnormality on our network. Nozomi Networks could be a positive impact for the organization because if any staff, such as a network engineer or other technical engineers, changes, the next new engineer can still move forward with this portal.

Nozomi Networks has led to specific outcomes or measurable improvements for my team, including faster response times. We can say there is a faster response time because, for example, if any kind of IoT device failure occurs, we can detect it from here. Also, we can identify any kind of vulnerability impact or any incidents that happen on those devices because of vulnerabilities. We can do incident investigation through this portal as well, so it is good for the company's security posture.

I feel Nozomi Networks can be improved by integrating SIEM features on this portal. If we integrate both features, such as SIEM on top of Nozomi Networks, then the analysis part would be much easier for the users, and we can improve the company's security posture. In that case, sometimes we could avoid using so many tools, such as Nozomi Networks for device detection and a SIEM for different checks. If we use one tool for all of them, that would be beneficial for the company. I did not feel any kind of issue up to now, and I am not sure about the future.

I have been using Nozomi Networks for around one year.

I have not felt anything about Nozomi Networks' scalability in this scenario since it is already deployed.

The customer support was good as one time I contacted support, and I got a good reply from them. It was quite an effective response at that time.

I do not have any idea about a different solution used before Nozomi Networks. When I joined this company, it was already deployed.

My advice to others looking into using Nozomi Networks is that if any organization has large-scale OT devices or does not have a clear picture of their network diagrams or has a messy network, it is better to deploy a tool such as Nozomi Networks to keep track of the devices. Then the security posture can be improved with this portal. It is better to deploy this product. Even if a company changes their technical staff, the other team members can function well with this tool. I would rate this product an eight out of ten.

On-premises

My main use case for Nozomi Networks is to find possible vulnerabilities and threats and create a network map in operational technology networks (OT networks). I mainly accomplish this by showing customers the OT network map along with the possible threats and vulnerabilities within these networks.

For example, in an industrial company in Peru, a customer tried to find some vulnerabilities in the OT networks. They connected the Nozomi Networks appliance to the OT network to display a map of the devices within the network and highlight the possible vulnerabilities present.

In end customer use cases, the main use remains the same, but another use has been to try to integrate this solution with security devices, such as firewalls, to generate policies that either block or allow certain traffic, whether it is allowed traffic or potentially threatening traffic.

Nozomi Networks has positively impacted our organization as we can visualize the traffic within the OT networks and identify the potential threats or vulnerabilities. We can generate reports for analyzing possible countermeasures and determine what improvements are needed in the future to protect the traffic and the company from such vulnerabilities.

Concrete outcomes include generating reports on the types of traffic in the OT networks, improving our decision-making regarding security incident countermeasures, and reducing response times to incidents in the OT network because, prior to Nozomi Networks, we did not have another viable solution.

The best features Nozomi Networks offers include the capability to show the network map while operating in remote or sniffer mode, which is a good feature. Another feature is its ability to display vulnerabilities in OT networks, as very few solutions in the market can accurately operate within these networks to reveal potential vulnerabilities and threats. Additionally, it allows for integration with additional security devices and provides reports about this feature.

Integrating with other security devices is a little difficult because this process is not currently automated. I potentially need future integrations via APIs; however, at the moment there is limited integration with firewalls, such as Fortinet, but they require more development to properly integrate and generate policies in the correct order based on specific traffic, destinations, and services. Overall, while this could be a challenging integration with other security devices, it is a significant advancement compared to alternatives, but it does need further development in the future.

Improvements for Nozomi Networks should focus on integrating with other security devices. Since Nozomi Networks operates in OT networks, I need to connect this solution with others such as SIEM, XDR, and firewalls. Additionally, the reporting system currently displays in English, but I need to enhance these reports to be in native Spanish, not merely translated, and aim for those reports to be aligned with ISO, NIST, or other frameworks to generate a greater impact within the company.

I would also like to highlight the need for better support because when we attempt to deploy this solution with partners, the solution remains within the company but requires ongoing support for its deployment across OT networks.

I have been using Nozomi Networks for demos and proof of concepts to review the technology and the solution, and how this solution could provide insights into threats and vulnerabilities in the network. I have been engaging in tests with end customers for around six months to one year.

At the moment I believe the features are acceptable.

Nozomi Networks can handle growth in my organization easily. In the on-premise solution, there are various options to scale, such as considering hybrid or public cloud models, but at the moment, the company is not evaluating scaling.

I have had one experience with customer support at Nozomi Networks, and it was great.

I have not used a different solution before Nozomi Networks. This is my first experience with such a solution.

I evaluated other options before choosing Nozomi Networks, including options to create similar functions with firewalls using OT signatures and Nessus software. However, the final decision was to select Nozomi Networks.

My advice for others looking to use Nozomi Networks is that if you are searching for a solution that provides network visibility, AI capabilities, and easy integration and deployment, then Nozomi Networks is a viable option. I would rate this product a seven out of ten.

On-premises

Other

My main use case for Nozomi Networks is threat detection.

I mentioned briefly about the second use case, which is asset discovery, because OT people oftentimes do not know what assets they have in their networks. Nozomi Networks is quite a useful tool to create an asset inventory, at least for starters. With Smart Polling, which is an active polling method not necessarily always allowed, but if a certain company permits it, Smart Polling is quite good in enriching data about assets. The second very strong and probably the second most important use case is asset discovery. Obviously, the third one is vulnerability management if you combine everything with ServiceNow.

I think the best features Nozomi Networks offers include the number of industrial protocols that it can monitor, which is outstanding and no other tool is equally capable as Nozomi Networks. Secondly, the user interface is quite good and clear, especially for someone using it quite heavily as I do. Thirdly, Nozomi Networks has their own threat intelligence team that enriches the global vulnerable databases with their own work. This is quite important. Quite recently, they added a lot of machine learning AI features to the Vantage.

Nozomi Networks has impacted my organization positively because, keeping in mind that I am an implementer and I implement this to many other organizations. In terms of how this improved, if implemented correctly, which means that fine-tuning is also done and the number of false positives is low, then not only threat monitoring and asset discovery are there, but some organizations whose maturity is high enough are using Nozomi Networks tools, meaning Guardians and sensors, as an OT tool, not only an OT security tool. For example, they can troubleshoot the networks through capabilities that this tool offers. Sometimes it is more than an OT security tool; it is also an OT tool.

I think Nozomi Networks should still work on the graphical user interface because it can be more friendly in terms of user experience, especially regarding the flows, the workflows, the intuitiveness of certain things and positions of certain buttons or even creating a dashboard for yourself in a way easier manner. This is something that they can work on. Apart from that, I believe that continuing to incorporate AI features, which they already did, is important, especially in terms of alerts and incidents and how they can be flagged. I am not saying AI should decide whether this is an alert or false positive, but it can certainly advise or recommend something such as, "This seems like a false positive, but perhaps you should troubleshoot," or "This seems serious, so you had better watch this."

I have been working in my current field for almost four years.

I have been using Nozomi Networks ever since I started my career in OT security, so also almost four years, let us say three and a half.

Nozomi Networks is very stable.

The scalability of Nozomi Networks is super easy to scale up as long as you have a Vantage solution, meaning the private cloud connected to on-premises or on-premises Guardians connected to the private Nozomi Networks cloud. This is super easy to scale. The other type of solution, which is fully on-premises, is also scalable, but not that easy.

The customer support from Nozomi Networks is very helpful. There are dedicated teams for clients, and the response times are quite fast. My experience so far with them is excellent.

The majority of our clients are using either Nozomi Networks or, in some cases, Claroty, because Claroty and Nozomi Networks are the best in class, with Nozomi Networks being a little ahead. In our client environments, we sometimes encounter Armis and also sometimes Microsoft Defender for IoT, which is very subpar in terms of the features and capabilities. In some cases, companies are trying to apply more IT-oriented IDSs to their industrial environments, which is also not the best possible way of doing things. For example, Dragos.

My experience with pricing, setup cost, and licensing is that it is pretty straightforward for Nozomi Networks. The whole license model is based on how many assets you need to protect. Previously, it was on-premises versus cloud. So there are two tiers or perhaps more tiers, but two ways of structuring the pricing, and it is quite clear and transparent. I do not think that anyone can be confused by the way they are structuring it. The one caveat is that they recently increased their prices by approximately 30 percent from July 1st, so that is something worth considering.

We have a business relationship with Nozomi Networks as a partner. We are not reselling their offerings, but we are implementing their solutions to our client environments.

To be honest, I do not have anything specific regarding a return on investment. Our clients usually focus more on one metric that is always there: adherence to the regulations. This is quite important because some regulations are enforcing network monitoring for industrial networks, and this is what Nozomi Networks is capable of. In terms of reducing the workforce needed to do this work, it is more creating a field of OT security, and an IDS is also always or quite often the first step to create a separate OT security practice that is separated from IT security.

My experience with pricing, setup cost, and licensing is that it is pretty straightforward for Nozomi Networks. The whole license model is based on how many assets you need to protect. Previously, it was on-premises versus cloud. So there are two tiers or perhaps more tiers, but two ways of structuring the pricing, and it is quite clear and transparent. I do not think that anyone can be confused by the way they are structuring it. The one caveat is that they recently increased their prices by approximately 30 percent from July 1st, so that is something worth considering.

We evaluated and our clients are evaluating many different options for costs and also for the features. So apart from Nozomi Networks, we also consider Claroty, Armis, Dragos, CrowdStrike, and Microsoft Defender for IoT, and one more that I forgot.

I find myself relying on the ability to monitor so many industrial networks, which is the most important part when it comes to my day-to-day workflow. Usually, I do not have to bother about other tools because Nozomi Networks is quite capable on layers zero to three of the Purdue Model. That is something that is usually a selling point when it comes to Nozomi Networks implementations to many different clients that we have.

I would say that the AI features and the machine learning in terms of the alerts and capability of especially lowering the number of false positives is promising, and I am expecting that this will evolve in the nearest future because this is what they are telling us and what we see in the product development on a day-to-day basis in our clients.

I think that the accuracy and reliability of output from Nozomi Networks is adequate. Every tool and every LLM has to be supervised by a human. The last step should always be taking an assessment of the results. In terms of how this is applied and to what it is applied, I do not think that the danger is too high. It is just helping you with the queries. The worst thing that can happen is that this query will show you a different type of things, such as assets or alerts, than you expected, but nothing major will happen.

The level at which AI is implemented now is not raising any red flags because it is usually an easier way to create queries, for example, inside the graphical user interface, the dashboard, or the management tool in order to show only a certain number of alerts that are very precisely described. This was not the case before. The rest of the so-called AI is the machine learning applied to the analysis of packets. So there are no real security flaws in my opinion at this point of the implementation of AI.

My advice for others looking into using Nozomi Networks is to make sure that you really understand your network topology before trying to implement. The best possible solution first is to have an asset inventory, but even if you do not have an asset inventory, you should make sure that you understand what kind of VLANs you have and how your network is segmented. That will make it easier to know how many and what type of devices you need so you do not overspend this way. I rate this product a 9 out of 10.

My main use case for Nozomi Networks is asset tracking. I use Nozomi Networks day-to-day primarily for threat detection.

For threat detection in my work, I track vulnerability based on CVE codes and easily manage the status of the required patch.

The best features Nozomi Networks offers include its querying capabilities.

The querying and searching capabilities are most valuable to me, which makes my job easier when monitoring network traffic.

Nozomi Networks has positively impacted my organization by ensuring my assets remain secure.

Since using Nozomi Networks, it immediately identifies application patches and CVE codes, leading to fewer incidents and improved response times.

I do not have any suggestions for how Nozomi Networks can be improved.

I have been using Nozomi Networks for two years.

In my experience, Nozomi Networks is stable.

I believe Nozomi Networks' scalability may be a concern.

The customer support is good.

I would rate the customer support a 10 on a scale of 1 to 10.

I have not used a different solution before Nozomi Networks; I have only used Nozomi Networks.

I mention fewer employees needed when discussing the return on investment.

My experience with pricing, setup cost, and licensing for Nozomi Networks is that I think it is a bit expensive, but it is reliable.

Before choosing Nozomi Networks, I did not evaluate other options.

I would definitely recommend Nozomi Networks for security to others looking into using it.

I would rate this product a 10 on a scale of 1 to 10.

Private Cloud

Other

We have created many use cases dedicated to OT when using Nozomi Networks. It might expand from IT to OT, specifically looking at assets and alarms, and critical OT assets that require the highest attention. There are a number of use cases that we have created with Nozomi Networks that are working very well. Sometimes it requires tuning, but beyond that, it is very effective.

Specifically, when discussing a particular example of a use case with Nozomi Networks, it involves addressing the false positives that we receive from many assets. We have created a baseline in Emirates Electricity and Water division. Nozomi Networks helped us create and provide better visibility. There are use cases regarding credentials and where we log into particular accounts, and specifically with USB blocking. Those are some OT-specific use cases that we created, tested, and checked across various sources such as logging into the system, enabling access from other systems, mapping it, or attempting to spoof it. Nozomi Networks easily identifies these threats and provides very good results.

Nozomi Networks' best features include asset management as the top offering. It provides a wide range of capabilities. We also have vulnerability management with a very large and regularly updated PV data bank that provides the right direction with tested patches. Beyond that, it provides financial calculations and reports that you can create based on NIST and other frameworks, which helps you easily generate results. The dashboard provides better visibility. These are features that set Nozomi Networks apart from others.

When discussing the asset management feature in Nozomi Networks, it provides better alignment with the Purdue Model and offers better direction regarding which IP has been communicating, which IP has lost its feature, which IP is pinging, and which IP is in ghost mode. Features such as these provide better visibility and updated asset management. If an asset is reaching its end of life date, it gives you an alarm one month before to notify you that the asset is about to reach EOL. These features provide better visibility of how your assets are behaving.

Nozomi Networks provides a good dashboard that helps us create visibility. It generates summarized reports, daily reports, and monthly reports according to our requirements. This makes operations easier.

It provides faster compliance because it delivers a very clear image and picture. If there is a change in the baseline, it provides before and after snapshots. Compliance-wise, if there is any change, it triggers the right alert point so you know that something has occurred. Compliance is very good because it has been accepted across the globe. The time saving is significant because the dashboard and image that Nozomi Networks creates provide the best direction and optimal outcomes to resolve issues, whether through quick wins or larger wins.

Currently, I do not see any improvements needed in Nozomi Networks because I have been working with Microsoft Defender for IoT and Claroty. I think they are mostly on a similar large scale, but Claroty has an X-Dome feature that helps provide remote secure access, which is one thing. Beyond that, I think everything falls under the same umbrella.

Nozomi Networks should work on a specific feature for USB blocking, because currently we are doing this from the boot level and USB is something that customers really want to have blocked before it is plugged in. It should not be scanned; it should be directly blocked.

I have been using Nozomi Networks for the last five years.

I chose eight out of ten because their customer services are something lacking. That is why I feel eight out of ten.

This interview is good. You ask very good questions that address the technical aspects as well as the features that Nozomi Networks carries. My overall review rating for this product is eight out of ten.

On-premises

Nozomi Networks is used to monitor the water counter for a water company in Rome.

Nozomi Networks offers excellent performance for OT monitoring. The technical team confirms that Nozomi Networks has very good performance. However, customers consistently report that Nozomi Networks pricing is very high.

I am not particularly technical, so I do not have detailed knowledge of how Nozomi Networks was installed and configured by the technical team. Nozomi Networks may be somewhat difficult to install and configure. At this time, I cannot provide specific suggestions for improvement because my organization does not use Nozomi Networks extensively, and we do not have many customers using Nozomi Networks.

I have been working in my current field for one year.

My organization does not use Nozomi Networks extensively because we are a service provider using several OT products including Nozomi Networks, Claroty, and Armis. Currently, my organization is not using Nozomi Networks, and we do not have many customers using Nozomi Networks. I participated in a tender where Nozomi Networks was chosen by the customer, but we decided not to participate in the tender because we have no people certified in Nozomi Networks. Our last customer using Nozomi Networks is very happy with it and appreciates the reports and all features, and they use Nozomi Networks in the SOC where the technical people monitor and see the performance of the OT product and are very satisfied. However, a new customer does not want to use Nozomi Networks because the cost is too high. If the price of Nozomi Networks decreases in the future, it will likely attract customers at a lower level. Currently, customers purchasing Nozomi Networks are at a top level, which means you will lose many customers who need or would like to use Nozomi Networks because the price is too high. I would advise others looking into Nozomi Networks that it represents the top level of this kind of product, and the customer must choose between quality and price. I gave this review a rating of 10.

Public Cloud

Amazon Web Services (AWS)

We use Nozomi Networks in our operational technology environment to manage the inventory of assets in our plants and conduct vulnerability assessments and risk quantification. It helps us identify communication that is not allowed between zones.

The most valuable features of Nozomi Networks are the visibility of OT protocols and the versatility in finding the details of the assets feeding the tool. It is helpful because we can see all the traffic coming from the plants. We can distinguish what kind of traffic is our baseline, what is different from normal operation, and what is traversing the OT zone to the IT zone.

Nozomi Networks currently offers add-ons, such as ARP agents, that can be installed on machines to expand the information we receive from sensors. However, these are part of a licensing structure, which can be costly. It would be very helpful if these agents were available free of charge. The solution itself has no major problems, but this is a feature request I would make for improvement.

I have had experience with Nozomi Networks for three years.

I would rate the stability of Nozomi Networks as a nine out of ten. It is very good.

Scalability is straightforward and tied to the license. We have a batch of 5,000 assets, but deploying the Guardian solution is unlimited. We can install the software image anywhere in any plant and still receive information.

I would rate their customer service at eight out of ten. While their support is good, we are looking for added value in a provider. I would like to see more proactive communication and campaigns from them to help us gain further benefits and visibility of the product features.

Positive

We previously used Tenable OT Security. We switched to Nozomi Networks due to price and architecture. Scalability is easier with Nozomi Networks, and the reporting part is integrated with the tools, unlike in Tenable, where it was separate.

The initial setup was very easy. We have a solution called Vantage licensed by assets. We manage 5,000 assets and deploy the tool with Nozomi Networks software. We only need to connect a span port or mirror port from the network to start receiving information.

Nozomi Networks is priced moderately. Its cost is not too expensive, but it is not low either.

Nozomi Networks scores a nine out of ten overall. There is no perfect solution, but it is a solid choice for managing OT security.

Public Cloud

Other

I have been involved in projects that used Nozomi Networks for Italian companies. At Advance, for example, we used it extensively, but in Italy, it is a brand that is quite expensive for many companies because the majority of the market is composed of small and medium companies, so a budget for Nozomi Networks is not very often available.

When I have used it, I implemented it for OT and IoT environments in public administration in Rome. We conducted a trial and were followed by a Nozomi Networks technician directly here in Italy. Guardian takes all the information that it receives from the appliance that you have deployed, and after you have all the data, you can put it into your SIEM and or SOAR, even if SOAR is not a good idea to have in use in OT and IoT.

In this particular customer, we had more or less 2,000 devices spread all over the city because they follow the traffic and also the parking and the IPTV cameras that are spread around the city in Rome. We deployed one Guardian and two remote devices that catch all the information that arrived from the devices spread all around the city. We conducted this kind of proof of concept in order to acquire and purchase Nozomi Networks instead of some other competitors.

Another case that I have seen was a really interesting demo with my previous company. We created it using Nozomi Networks and also Rapid7 as a SIEM. We managed a really small beer production facility. We simulated a threat actor that was introduced into the farm. After we deployed Nozomi Networks, we showed the people how it works and what the main features of the product are, how it can overview all the nodes using the probes. The probes can send data to one unique central console that is named Guardian. After that, Guardian can send data, raw data to your SIEM in order to process it and have SOC services that can guarantee the complete overview of your infrastructure.

Nozomi Networks is the easiest to use, with the capability to build really quickly an overview of your infrastructure. You can have an inventory of all your OT and IoT devices. It is based on a really solid code instead of many other competitors that were born recently. Today, it is recognized as the milestone to follow, the GOAT in this kind of environment.

Really often people do not know what they have put in place in their infrastructure. Especially in OT and IoT, you have to look into the complete environment in order to have a complete inventory. So, Shadow OT, which I have spoken about many times in terms of devices instead of Shadow IT in terms of applications, is a valuable feature.

Starting from scratch, they did not have any kind of tool that takes care of OT and IoT. Starting from scratch implementing Nozomi Networks, people were really happy because they have seen for the first time all their infrastructure. They have seen for the first time the complete inventory of all devices that were spread into their network. Today they are really happy to feel safe and to be sure to have it all under the control of our SOC services.

Nozomi Networks can be improved in many points. First of all, reduce the cost. That is really important because many companies are not so huge and many companies cannot acquire this kind of licensing. The second improvement would be to have a much more solid and robust IT solution, something that works like a network detection and response, even if Nozomi Networks was not born for this.

Nozomi Networks is absolutely scalable because you can introduce some other probes into your environment. You can also put some Guardians on-premise or have the SaaS solution that manages everything.

I have always tried to sell Nozomi Networks instead of other competitors from Israel, for example, because I trust in this kind of technology. Although Nozomi Networks is not so up-to-date for IT infrastructure, it is used in OT and IoT environments. It is a really good brand.

This kind of appliance is not so difficult to manage and not so specific. The customer is happy because today they have all things under control.

I am actually looking at another solution that is named LEX. It is another completely Italian solution and it is much cheaper than Nozomi Networks, but at this moment, it was born as a network detection and response. Now they are also working on OT/IoT protocols, CANbus, and all the other industrial protocols. For the moment, I think that if you have a really solid infrastructure and you are managing a more or less big customer, you have to choose Nozomi Networks.

Another customer was also evaluating another Iranian solution. At this moment, I cannot remember the name, but it is really famous.

Nozomi Networks works like a charm and works as expected. It is interesting to receive data from CTI and organize it in your infrastructure using the AI algorithms that can really save a lot of time for a SOC operator or SOC analyst. The capability is really good.

Nozomi Networks is not as expensive as some other players like Darktrace, even if they do another job, but it is not so cheap either. I think that Nozomi Networks needs to have some discounts, additional discounts for some environments.

SOC analysts are much happier because they already have good and clean data. In this way, they can reduce the mean time to acknowledge and the mean time to detect.

Be sure that the probes are installed in the right network points. That is the most important thing I can advise.

I would rate this product an eight out of ten.

On-premises

Other