Nozomi Networks Reviews

We use Nozomi Networks as an intrusion detection system for OT deployments, automation systems, and IoT systems such as medical equipment to protect medical systems and smart meters. We detect any anomalies in the network, whether in operation networks, IoT networks, or IT networks, and it is the best intrusion detection solution with its intelligence.

We work with Nozomi Networks real-time visibility feature and deploy the solution for our customers.

The real-time visibility from Nozomi Networks helps with threat detection for our customers because almost all customers have integrated this IDS into their SOC, so they are getting full visibility on any anomalies in the network and immediate intelligence on that.

Integrating Nozomi Networks with third-party systems gives visibility in the network. We connect this with a SOC and SIEM solutions, and they have better visibility on the entire network.

Nozomi Networks brings the main benefits of visibility and control, asset tracking with full visibility of the assets in the network, and threat intelligence with anomaly detection, so they have peace of mind and the system is always on watch.

We are utilizing the machine learning in Nozomi Networks, which is part of the Nozomi Networks package. We are deploying it for the customers and they take care of the operation side. We do the implementation only.

Nozomi Networks has the best AI-based detection and intrusion detection solution. It is very robust, easy to deploy, and easy to use with a very user-friendly GUI and good support in terms of product and after-sales support. They have vendor support in our region, and they are the best when it comes to IDS solutions.

I would like to see improvements in Nozomi Networks, probably more AI-based integration and better native integration with SOC and SOAR platforms.

I would like to see specific features included in the next releases of Nozomi Networks, such as improvements in threat intelligence. They have competition from Dragos, which I believe is better in threat intelligence.

I do not have much of an answer about the key differences of Nozomi Networks in comparison to other cyber defense solutions because I only work with Nozomi Networks. However, I heard from the market that they might lack in threat intelligence compared to Dragos. Other than that, I see Nozomi Networks as the best platform for customers, easy to manage, deploy, and operate. The cons might be that they lack some threat intelligence features that Dragos offers.

We have been working with Nozomi Networks for four years.

We have faced downtimes, crashes, or performance issues with certain implementations. We had certain device card issues, but those were rectified immediately as an RMA was issued and addressed promptly. It is not that there are no issues at all, but they have been addressed, and that matters most.

Nozomi Networks is scalable. You can add more locations with more devices and integrate with the CMC, and that is not a problem at all. You can also have high availability if you want.

My experience with the technical support and customer service teams of Nozomi Networks is very good. That is one good part of Nozomi Networks.

We did not face many issues during the deployment process with Nozomi Networks. We did multiple implementations and it was all smooth.

For threat detection, we have an IPS solution for intrusion prevention. Nozomi Networks works as an intrusion detection system, and we have a prevention system with TXOne that can do virtual locking, along with many features. This is part of Trend Micro, so we sell it as an IPS and as a firewall with different technologies, including portable inspectors and their own threat intelligence platform.

I assess the impact of potential threats detected by Nozomi Networks as high because it is mostly deployed in critical infrastructure. It is a very critical technology that customers are using to be safe, ensuring business continuity, and that matters most for the industry.

Given my very rich experience with Nozomi Networks technologies, I would advise organizations considering it to look primarily into ICS system cybersecurity and IoT. They can also enhance their focus on enterprise IT security. I rate this product an eight out of ten.

On-premises

My main use case for Nozomi Networks is to detect devices in the environment, especially IoT devices, or any kind of devices that connect to the network, and we need to detect them. We normally check through our console for any kind of device. For example, if a user tries to connect any device to the network or any unrecognized device is available, we monitor it. Beyond that, we check vulnerabilities of our IoT devices, mainly. We monitor any kind of abnormal traffic or any kind of abnormality on those devices, and we get a report if we want to do any patching for devices.

The best features Nozomi Networks offers are device detection and vulnerability checking, including CVEs, and reports. In my scenario, for some of the devices, we cannot always know the location or whether we have missed any vulnerabilities. There is a large-scale variety of devices, so we cannot go through each device one-by-one and check if any CVEs were detected recently or are up to date. In that case, Nozomi Networks portal is good for us. For now, we use it for device detection and vulnerabilities only, and I am satisfied with the current functionality.

Nozomi Networks has impacted my organization positively because our technical staff changes. In those cases, we sometimes do not know about certain devices. For example, it can be difficult with some devices, and they operate in unknown locations, such as webcams or IoT devices located in different areas. In that case, we can get an idea about what devices are in our network and any abnormal traffic or any kind of abnormality on our network. Nozomi Networks could be a positive impact for the organization because if any staff, such as a network engineer or other technical engineers, changes, the next new engineer can still move forward with this portal.

Nozomi Networks has led to specific outcomes or measurable improvements for my team, including faster response times. We can say there is a faster response time because, for example, if any kind of IoT device failure occurs, we can detect it from here. Also, we can identify any kind of vulnerability impact or any incidents that happen on those devices because of vulnerabilities. We can do incident investigation through this portal as well, so it is good for the company's security posture.

I feel Nozomi Networks can be improved by integrating SIEM features on this portal. If we integrate both features, such as SIEM on top of Nozomi Networks, then the analysis part would be much easier for the users, and we can improve the company's security posture. In that case, sometimes we could avoid using so many tools, such as Nozomi Networks for device detection and a SIEM for different checks. If we use one tool for all of them, that would be beneficial for the company. I did not feel any kind of issue up to now, and I am not sure about the future.

I have been using Nozomi Networks for around one year.

I have not felt anything about Nozomi Networks' scalability in this scenario since it is already deployed.

The customer support was good as one time I contacted support, and I got a good reply from them. It was quite an effective response at that time.

I do not have any idea about a different solution used before Nozomi Networks. When I joined this company, it was already deployed.

My advice to others looking into using Nozomi Networks is that if any organization has large-scale OT devices or does not have a clear picture of their network diagrams or has a messy network, it is better to deploy a tool such as Nozomi Networks to keep track of the devices. Then the security posture can be improved with this portal. It is better to deploy this product. Even if a company changes their technical staff, the other team members can function well with this tool. I would rate this product an eight out of ten.

On-premises

My main use case for Nozomi Networks is to find possible vulnerabilities and threats and create a network map in operational technology networks (OT networks). I mainly accomplish this by showing customers the OT network map along with the possible threats and vulnerabilities within these networks.

For example, in an industrial company in Peru, a customer tried to find some vulnerabilities in the OT networks. They connected the Nozomi Networks appliance to the OT network to display a map of the devices within the network and highlight the possible vulnerabilities present.

In end customer use cases, the main use remains the same, but another use has been to try to integrate this solution with security devices, such as firewalls, to generate policies that either block or allow certain traffic, whether it is allowed traffic or potentially threatening traffic.

Nozomi Networks has positively impacted our organization as we can visualize the traffic within the OT networks and identify the potential threats or vulnerabilities. We can generate reports for analyzing possible countermeasures and determine what improvements are needed in the future to protect the traffic and the company from such vulnerabilities.

Concrete outcomes include generating reports on the types of traffic in the OT networks, improving our decision-making regarding security incident countermeasures, and reducing response times to incidents in the OT network because, prior to Nozomi Networks, we did not have another viable solution.

The best features Nozomi Networks offers include the capability to show the network map while operating in remote or sniffer mode, which is a good feature. Another feature is its ability to display vulnerabilities in OT networks, as very few solutions in the market can accurately operate within these networks to reveal potential vulnerabilities and threats. Additionally, it allows for integration with additional security devices and provides reports about this feature.

Integrating with other security devices is a little difficult because this process is not currently automated. I potentially need future integrations via APIs; however, at the moment there is limited integration with firewalls, such as Fortinet, but they require more development to properly integrate and generate policies in the correct order based on specific traffic, destinations, and services. Overall, while this could be a challenging integration with other security devices, it is a significant advancement compared to alternatives, but it does need further development in the future.

Improvements for Nozomi Networks should focus on integrating with other security devices. Since Nozomi Networks operates in OT networks, I need to connect this solution with others such as SIEM, XDR, and firewalls. Additionally, the reporting system currently displays in English, but I need to enhance these reports to be in native Spanish, not merely translated, and aim for those reports to be aligned with ISO, NIST, or other frameworks to generate a greater impact within the company.

I would also like to highlight the need for better support because when we attempt to deploy this solution with partners, the solution remains within the company but requires ongoing support for its deployment across OT networks.

I have been using Nozomi Networks for demos and proof of concepts to review the technology and the solution, and how this solution could provide insights into threats and vulnerabilities in the network. I have been engaging in tests with end customers for around six months to one year.

At the moment I believe the features are acceptable.

Nozomi Networks can handle growth in my organization easily. In the on-premise solution, there are various options to scale, such as considering hybrid or public cloud models, but at the moment, the company is not evaluating scaling.

I have had one experience with customer support at Nozomi Networks, and it was great.

I have not used a different solution before Nozomi Networks. This is my first experience with such a solution.

I evaluated other options before choosing Nozomi Networks, including options to create similar functions with firewalls using OT signatures and Nessus software. However, the final decision was to select Nozomi Networks.

My advice for others looking to use Nozomi Networks is that if you are searching for a solution that provides network visibility, AI capabilities, and easy integration and deployment, then Nozomi Networks is a viable option. I would rate this product a seven out of ten.

On-premises

Other

My main use case for Nozomi Networks is asset tracking. I use Nozomi Networks day-to-day primarily for threat detection.

For threat detection in my work, I track vulnerability based on CVE codes and easily manage the status of the required patch.

The best features Nozomi Networks offers include its querying capabilities.

The querying and searching capabilities are most valuable to me, which makes my job easier when monitoring network traffic.

Nozomi Networks has positively impacted my organization by ensuring my assets remain secure.

Since using Nozomi Networks, it immediately identifies application patches and CVE codes, leading to fewer incidents and improved response times.

I do not have any suggestions for how Nozomi Networks can be improved.

I have been using Nozomi Networks for two years.

In my experience, Nozomi Networks is stable.

I believe Nozomi Networks' scalability may be a concern.

The customer support is good.

I would rate the customer support a 10 on a scale of 1 to 10.

I have not used a different solution before Nozomi Networks; I have only used Nozomi Networks.

I mention fewer employees needed when discussing the return on investment.

My experience with pricing, setup cost, and licensing for Nozomi Networks is that I think it is a bit expensive, but it is reliable.

Before choosing Nozomi Networks, I did not evaluate other options.

I would definitely recommend Nozomi Networks for security to others looking into using it.

I would rate this product a 10 on a scale of 1 to 10.

Private Cloud

Other

We have created many use cases dedicated to OT when using Nozomi Networks. It might expand from IT to OT, specifically looking at assets and alarms, and critical OT assets that require the highest attention. There are a number of use cases that we have created with Nozomi Networks that are working very well. Sometimes it requires tuning, but beyond that, it is very effective.

Specifically, when discussing a particular example of a use case with Nozomi Networks, it involves addressing the false positives that we receive from many assets. We have created a baseline in Emirates Electricity and Water division. Nozomi Networks helped us create and provide better visibility. There are use cases regarding credentials and where we log into particular accounts, and specifically with USB blocking. Those are some OT-specific use cases that we created, tested, and checked across various sources such as logging into the system, enabling access from other systems, mapping it, or attempting to spoof it. Nozomi Networks easily identifies these threats and provides very good results.

Nozomi Networks' best features include asset management as the top offering. It provides a wide range of capabilities. We also have vulnerability management with a very large and regularly updated PV data bank that provides the right direction with tested patches. Beyond that, it provides financial calculations and reports that you can create based on NIST and other frameworks, which helps you easily generate results. The dashboard provides better visibility. These are features that set Nozomi Networks apart from others.

When discussing the asset management feature in Nozomi Networks, it provides better alignment with the Purdue Model and offers better direction regarding which IP has been communicating, which IP has lost its feature, which IP is pinging, and which IP is in ghost mode. Features such as these provide better visibility and updated asset management. If an asset is reaching its end of life date, it gives you an alarm one month before to notify you that the asset is about to reach EOL. These features provide better visibility of how your assets are behaving.

Nozomi Networks provides a good dashboard that helps us create visibility. It generates summarized reports, daily reports, and monthly reports according to our requirements. This makes operations easier.

It provides faster compliance because it delivers a very clear image and picture. If there is a change in the baseline, it provides before and after snapshots. Compliance-wise, if there is any change, it triggers the right alert point so you know that something has occurred. Compliance is very good because it has been accepted across the globe. The time saving is significant because the dashboard and image that Nozomi Networks creates provide the best direction and optimal outcomes to resolve issues, whether through quick wins or larger wins.

Currently, I do not see any improvements needed in Nozomi Networks because I have been working with Microsoft Defender for IoT and Claroty. I think they are mostly on a similar large scale, but Claroty has an X-Dome feature that helps provide remote secure access, which is one thing. Beyond that, I think everything falls under the same umbrella.

Nozomi Networks should work on a specific feature for USB blocking, because currently we are doing this from the boot level and USB is something that customers really want to have blocked before it is plugged in. It should not be scanned; it should be directly blocked.

I have been using Nozomi Networks for the last five years.

I chose eight out of ten because their customer services are something lacking. That is why I feel eight out of ten.

This interview is good. You ask very good questions that address the technical aspects as well as the features that Nozomi Networks carries. My overall review rating for this product is eight out of ten.

On-premises

Nozomi Networks is used to monitor the water counter for a water company in Rome.

Nozomi Networks offers excellent performance for OT monitoring. The technical team confirms that Nozomi Networks has very good performance. However, customers consistently report that Nozomi Networks pricing is very high.

I am not particularly technical, so I do not have detailed knowledge of how Nozomi Networks was installed and configured by the technical team. Nozomi Networks may be somewhat difficult to install and configure. At this time, I cannot provide specific suggestions for improvement because my organization does not use Nozomi Networks extensively, and we do not have many customers using Nozomi Networks.

I have been working in my current field for one year.

My organization does not use Nozomi Networks extensively because we are a service provider using several OT products including Nozomi Networks, Claroty, and Armis. Currently, my organization is not using Nozomi Networks, and we do not have many customers using Nozomi Networks. I participated in a tender where Nozomi Networks was chosen by the customer, but we decided not to participate in the tender because we have no people certified in Nozomi Networks. Our last customer using Nozomi Networks is very happy with it and appreciates the reports and all features, and they use Nozomi Networks in the SOC where the technical people monitor and see the performance of the OT product and are very satisfied. However, a new customer does not want to use Nozomi Networks because the cost is too high. If the price of Nozomi Networks decreases in the future, it will likely attract customers at a lower level. Currently, customers purchasing Nozomi Networks are at a top level, which means you will lose many customers who need or would like to use Nozomi Networks because the price is too high. I would advise others looking into Nozomi Networks that it represents the top level of this kind of product, and the customer must choose between quality and price. I gave this review a rating of 10.

Public Cloud

Amazon Web Services (AWS)

We use Nozomi Networks in our operational technology environment to manage the inventory of assets in our plants and conduct vulnerability assessments and risk quantification. It helps us identify communication that is not allowed between zones.

The most valuable features of Nozomi Networks are the visibility of OT protocols and the versatility in finding the details of the assets feeding the tool. It is helpful because we can see all the traffic coming from the plants. We can distinguish what kind of traffic is our baseline, what is different from normal operation, and what is traversing the OT zone to the IT zone.

Nozomi Networks currently offers add-ons, such as ARP agents, that can be installed on machines to expand the information we receive from sensors. However, these are part of a licensing structure, which can be costly. It would be very helpful if these agents were available free of charge. The solution itself has no major problems, but this is a feature request I would make for improvement.

I have had experience with Nozomi Networks for three years.

I would rate the stability of Nozomi Networks as a nine out of ten. It is very good.

Scalability is straightforward and tied to the license. We have a batch of 5,000 assets, but deploying the Guardian solution is unlimited. We can install the software image anywhere in any plant and still receive information.

I would rate their customer service at eight out of ten. While their support is good, we are looking for added value in a provider. I would like to see more proactive communication and campaigns from them to help us gain further benefits and visibility of the product features.

Positive

We previously used Tenable OT Security. We switched to Nozomi Networks due to price and architecture. Scalability is easier with Nozomi Networks, and the reporting part is integrated with the tools, unlike in Tenable, where it was separate.

The initial setup was very easy. We have a solution called Vantage licensed by assets. We manage 5,000 assets and deploy the tool with Nozomi Networks software. We only need to connect a span port or mirror port from the network to start receiving information.

Nozomi Networks is priced moderately. Its cost is not too expensive, but it is not low either.

Nozomi Networks scores a nine out of ten overall. There is no perfect solution, but it is a solid choice for managing OT security.

Public Cloud

Other

I have been involved in projects that used Nozomi Networks for Italian companies. At Advance, for example, we used it extensively, but in Italy, it is a brand that is quite expensive for many companies because the majority of the market is composed of small and medium companies, so a budget for Nozomi Networks is not very often available.

When I have used it, I implemented it for OT and IoT environments in public administration in Rome. We conducted a trial and were followed by a Nozomi Networks technician directly here in Italy. Guardian takes all the information that it receives from the appliance that you have deployed, and after you have all the data, you can put it into your SIEM and or SOAR, even if SOAR is not a good idea to have in use in OT and IoT.

In this particular customer, we had more or less 2,000 devices spread all over the city because they follow the traffic and also the parking and the IPTV cameras that are spread around the city in Rome. We deployed one Guardian and two remote devices that catch all the information that arrived from the devices spread all around the city. We conducted this kind of proof of concept in order to acquire and purchase Nozomi Networks instead of some other competitors.

Another case that I have seen was a really interesting demo with my previous company. We created it using Nozomi Networks and also Rapid7 as a SIEM. We managed a really small beer production facility. We simulated a threat actor that was introduced into the farm. After we deployed Nozomi Networks, we showed the people how it works and what the main features of the product are, how it can overview all the nodes using the probes. The probes can send data to one unique central console that is named Guardian. After that, Guardian can send data, raw data to your SIEM in order to process it and have SOC services that can guarantee the complete overview of your infrastructure.

Nozomi Networks is the easiest to use, with the capability to build really quickly an overview of your infrastructure. You can have an inventory of all your OT and IoT devices. It is based on a really solid code instead of many other competitors that were born recently. Today, it is recognized as the milestone to follow, the GOAT in this kind of environment.

Really often people do not know what they have put in place in their infrastructure. Especially in OT and IoT, you have to look into the complete environment in order to have a complete inventory. So, Shadow OT, which I have spoken about many times in terms of devices instead of Shadow IT in terms of applications, is a valuable feature.

Starting from scratch, they did not have any kind of tool that takes care of OT and IoT. Starting from scratch implementing Nozomi Networks, people were really happy because they have seen for the first time all their infrastructure. They have seen for the first time the complete inventory of all devices that were spread into their network. Today they are really happy to feel safe and to be sure to have it all under the control of our SOC services.

Nozomi Networks can be improved in many points. First of all, reduce the cost. That is really important because many companies are not so huge and many companies cannot acquire this kind of licensing. The second improvement would be to have a much more solid and robust IT solution, something that works like a network detection and response, even if Nozomi Networks was not born for this.

Nozomi Networks is absolutely scalable because you can introduce some other probes into your environment. You can also put some Guardians on-premise or have the SaaS solution that manages everything.

I have always tried to sell Nozomi Networks instead of other competitors from Israel, for example, because I trust in this kind of technology. Although Nozomi Networks is not so up-to-date for IT infrastructure, it is used in OT and IoT environments. It is a really good brand.

This kind of appliance is not so difficult to manage and not so specific. The customer is happy because today they have all things under control.

I am actually looking at another solution that is named LEX. It is another completely Italian solution and it is much cheaper than Nozomi Networks, but at this moment, it was born as a network detection and response. Now they are also working on OT/IoT protocols, CANbus, and all the other industrial protocols. For the moment, I think that if you have a really solid infrastructure and you are managing a more or less big customer, you have to choose Nozomi Networks.

Another customer was also evaluating another Iranian solution. At this moment, I cannot remember the name, but it is really famous.

Nozomi Networks works like a charm and works as expected. It is interesting to receive data from CTI and organize it in your infrastructure using the AI algorithms that can really save a lot of time for a SOC operator or SOC analyst. The capability is really good.

Nozomi Networks is not as expensive as some other players like Darktrace, even if they do another job, but it is not so cheap either. I think that Nozomi Networks needs to have some discounts, additional discounts for some environments.

SOC analysts are much happier because they already have good and clean data. In this way, they can reduce the mean time to acknowledge and the mean time to detect.

Be sure that the probes are installed in the right network points. That is the most important thing I can advise.

I would rate this product an eight out of ten.

On-premises

Other

There are different use cases, and it depends on the product and the customer. Usually, it is used for asset management and other features. Sometimes it serves as an IDS solution instead.

It has impacted security operations in a better way.

The network visualization feature of Nozomi impacts security operations positively. It is valuable for asset management, although there are probably better solutions for that.

I would like more customizable options for configurations. Creating custom queries is time-consuming. It would be beneficial if more options were added for easier configurations.

Personally, I have been familiar with Nozomi Networks for a couple of years.

I am not involved in daily operations. As far as I know, Nozomi Networks is considered to be of good quality. The product is stable and doesn’t usually require frequent technical support interaction.

I don't deal with technical support on a daily basis. However, the product itself is stable, so there is usually no need to contact support.

Neutral

The initial setup is straightforward for a basic configuration. However, custom configurations can be quite complex and time-consuming.

It is probably mid-range in pricing. It's not cheap, yet it is also not super expensive either.

I'd rate the solution seven out of ten.

Nozomi Networks is an easy-to-use and powerful tool. The solution's network visualization feature helps you monitor and manage all your OT assets. It also helps review vulnerabilities and any critical issues.

I used the solution for about one year in my last job.

The solution provides good stability.

It is easy to scale the solution.

The solution's technical support is very good. We worked a lot with the local support team here in Mexico, and it was awesome. They visited us every month and were always ready to help us with everything we needed.

Positive

The solution’s initial setup is easy. Nozomi staff helped us run a couple of demos. The first time, we just observed everything. Later, we could install everything and run it, which was not very difficult.

The solution's pricing is good and cheaper than that of Claroty. Nozomi Networks is worth the money.

I would recommend the solution to other users.

Overall, I rate the solution ten out of ten.