AI

New Dragos AI assistant EmberAI targets the OT security skills gap

Industrial control system cybersecurity company Dragos Inc. today launched EmberAI, an artificial intelligence assistant built specifically for operational technology environments that aims to put the company’s threat intelligence in the hands of analysts at any experience level.

EmberAI runs on the Dragos Intelligence Fabric, which the company calls the world’s largest OT cybersecurity data set built from more than a decade of adversary tracking and incident response work. Analysts can query their assets, vulnerabilities and network activity in plain language and rank threats by operational impact.

Dragos is selling the tool into a staffing squeeze. Attacks on critical infrastructure keep climbing and there are not enough OT security specialists to work on them. The company’s argument is that general-purpose AI cannot tell a critical exposure from routine noise because it does not understand the plant and in OT a bad call can hit safety and physical systems, not just data.

The company positions EmberAI for the full range of people now working in OT security, from information technology practitioners and plant engineers to veteran OT specialists. Organizations securing power grids, manufacturing plants, water systems, pipelines and data centers are the target market.

The Dragos Intelligence Fabric is built on more than 5 petabytes of daily OT telemetry and more than 10 years of tracking named OT threat groups. It also uses proprietary vulnerability research conducted under the company’s status as a Common Vulnerabilities and Exposures Numbering Authority, as well as research spanning more than 600 OT protocols. Dragos says the data set keeps learning as new intelligence surfaces and threat groups change their behavior.

The product centers on a few core functions. An intelligence-driven query engine returns OT-contextual answers without requiring analysts to pivot across separate tools. A correlation layer connects assets, vulnerabilities, threat intelligence and network activity into a single real-time view. Detections are mapped to known OT threat groups and observed attack patterns and the tool supports alert triage, incident summaries and reporting to cut down on manual work.

Dragos also says customer data never leaves the customer environment, with EmberAI operating inside the Dragos Platform deployment an organization already controls. Every recommendation the tool surfaces is meant to be transparent and auditable and the company stresses that the analyst retains the final decision.

“We built EmberAI to harness Dragos’s decade-plus of experience in threat intelligence, incident response, adversary tracking and frontline operations for OT environments,” said co-founder and Chief Executive Robert M. Lee. “It is hard to reproduce this depth of OT-specific expertise and build AI that understands and can action OT specific findings.”

EmberAI is generally available today inside the Dragos Platform. A library of guided, repeatable workflows built by Dragos analysts is set to follow.

Image: Dragos