OT Asset Inventory in 2026: What Changed This Year

What counts as OT, and why is its inventory harder?

NIST's glossary, citing SP 800-82r3, defines operational technology as "a broad range of programmable systems and devices that interact with the physical environment or manage devices that interact with the physical environment." Industrial control systems, building automation and physical access control all fall inside that definition.

OT inventories are harder to build than IT inventories for practical reasons. Many OT devices cannot run an agent, some respond badly to active scanning, and they often sit on networks that IT tools never reach. That is why passive discovery, which identifies devices from the traffic they already send, is common in OT. runZero documents passive discovery for fragile OT networks alongside its active scanning. Armis describes agentless, passive discovery across IT, OT, IoT and medical devices. ServiceNow offers OT inventory through a separate Operational Technology Management product that brings OT assets into its CMDB.

What does the NIST SP 800-82r4 draft change?

On 21 September 2026 NIST published the initial public draft of SP 800-82 Revision 4, Guide to Operational Technology (OT) Security. Comments are open until 30 November 2026. Among the changes NIST lists:

• The document is restructured around the NIST Cybersecurity Framework (CSF) 2.0.
• The introduction expands to building automation and control systems, water and wastewater systems, food and agriculture, freight rail, maritime vessels, and Industrial Internet of Things and cloud convergence.
• It adds "expanded guidelines for implementing OT security controls, including asset management and network monitoring."

For inventory owners, the practical effect is alignment. An OT program that reports against CSF 2.0 can map its asset management work to the same framework its IT colleagues already use. A month earlier, on 25 August 2026, NIST finalized SP 1347, a quick-start guide to CSF 2.0 informative references, which explains how other standards and controls map to CSF outcomes. Teams that plan to comment on the draft have until the end of November.

What did the ServiceNow and Armis deal change?

On 20 April 2026 ServiceNow completed its acquisition of Armis. In the announcement, published on the Armis blog, ServiceNow said the Armis platform "remains available as part of the ServiceNow AI Platform and as a standalone solution." Earlier in the year, on 4 March 2026, Armis said it had been named a Leader in the 2026 Gartner Magic Quadrant for CPS Protection Platforms for the second consecutive year.

For buyers, the open questions are about packaging rather than features. Will Armis Centrix be sold separately from ServiceNow modules over the long term? How will its push of enriched data into the CMDB develop for customers who run a CMDB other than ServiceNow? Will pricing change? Armis did not publish prices before the deal, and the pages we reviewed in September 2026 do not publish them now. Our Armis review scores the product documentation as it stood in September 2026.

What did the Dragos and runZero deal change?

On 21 September 2026 Dragos announced that it had acquired runZero and NetRise to extend its xOT security platform. Dragos said runZero will extend asset visibility and exposure management by pulling in existing IT, OT and cloud asset data, and that runZero CEO HD Moore will lead integration work while continuing to serve existing customers. No deal terms were disclosed, and the release does not describe changes to runZero's standalone plans.

runZero's pricing page, reviewed in September 2026, still lists a free Community Edition for 100 or fewer assets and a Platform plan that starts at $5,000. runZero also shipped version 5.1 on 10 September 2026, adding AI-assisted custom integrations, eleven days before the announcement.

Which tools in our ranking document OT and IoT coverage?

In our coverage grid, four of the seven tools document OT and IoT coverage: Axonius, runZero, Lansweeper and Armis. JupiterOne, Oomnitza and Device42 do not document it on the pages we reviewed. Axonius lists OT and IoT among the asset types it covers and reaches them through adapters to the tools that already see those devices; the pages we reviewed do not describe a network scanner of its own.

The split matters when choosing an approach. A discovery tool finds OT devices that no other system knows about. An aggregation platform reconciles what the OT tool, the CMDB and the IT tools each report. Plants with a dedicated OT security tool often need both, and the OT tool becomes one more source for the aggregation layer.

What should OT buyers ask vendors this year?

• Which OT protocols do you identify passively, and which need active queries?
• Is the product sold standalone, and will that change after the acquisition?
• Which CMDBs can you write to, and is ServiceNow handled differently from others?
• How does your asset management guidance map to CSF 2.0 and to the SP 800-82r4 draft?
• What is the price for our device count, in writing?

Our buyer's guide has the full twelve-question checklist and a 30-day evaluation plan.