| Controller, logic & configuration change monitoring | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Guardian includes explicit configuration-change alerts when changed configurations are uploaded to OT devices. |
| Industrial network topology & communication mapping | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Guardian and Vantage provide network visualization, asset/connection views and zone-aware visibility across OT/IoT environments. |
| OT vulnerability & exposure prioritization | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | The platform identifies vulnerabilities and asset risk, while Vantage provides customizable asset-risk scoring; Asset Intelligence can further enrich classification and vulnerability context as an add-on. |
| Passive OT/ICS asset discovery & fingerprinting | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Guardian passively observes mirrored OT/IoT traffic and continuously builds detailed asset inventory without generating additional control-network traffic. |
| Safe active querying & asset enrichment | Partially Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Smart Polling adds low-volume active asset enrichment, but it is an add-on capability rather than assumed in every Nozomi platform deployment. |
| Behavioral anomaly & OT threat detection | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Guardian continuously monitors industrial communications and baselines behavior to detect suspicious communications, malware, unwanted operations and operational anomalies. |
| Multi-site, hybrid & air-gapped OT operations | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | The platform offers Vantage cloud management and an on-premises Central Management Console, with remote collectors and multi-site sensor hierarchies; exact air-gapped design depends on selected components. |
| OT threat intelligence & ATT&CK context | Partially Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Nozomi OT/IoT Threat Intelligence enriches the platform with signatures, IOCs, TTPs and zero-day detections, but it is a distinct subscription/add-on. |
| Segmentation, zones & policy-violation monitoring | Partially Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Nozomi provides zones, network/communication visibility and segmentation analysis, but actual enforcement depends on external firewalls/NAC and related integrations. |
| SIEM, SOAR, firewall & SOC integration | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Nozomi documents SIEM, SOAR, firewall, NAC, ticketing, cloud and OpenAPI integrations across the platform. |
