Nozomi Networks Vantage OT & IoT Security Solution

My main use case for Nozomi Networks  is monitoring OT assets at Volkswagen's factories.

The specific example of how I use Nozomi Networks  for monitoring OT assets is that the monitoring occurs in the factories at Volkswagen. We have the collectors acting at the switches, the access switches, and then we have a CMC collector, a VM positioned in the data center that collects the logs. With the logs and the metrics, we act by creating playbooks for addressing the alerts. That is the case for monitoring with Nozomi Networks appliances.

It has a simple interface, so it is easy to use and configure, but the network needs to be very well structured to receive the logs and capture all Nozomi Networks assets for the shop floor.

Nozomi Networks has positively impacted my organization by providing observability of the environment and the assets in the OT environment of the shop floor. Prior to this, we did not have observability over the legacy devices. Receiving these logs allows us to address threats occurring in real time in the environment, enabling us to fortify the network and equipment.

I can share that since implementing Nozomi Networks, we have seen an improvement in response times. Alerts coming to Nozomi Networks dashboards have led us to automate by sending alerts to email and generating weekly reports for analysts. This means the analyst reads and verifies a set of alerts and then handles the incident in a very fast and efficient manner.

The best features Nozomi Networks offers include polling for shop floor assets, alerts based on CVSS, which is a great feature, and BPF filters at Nozomi Networks interfaces that filter the traffic we do not want to see.

The CVSS-based alerts help my team by allowing us to determine if an alert is critical or a false positive based on the CVSS score. CVSS is a market standard for classifying vulnerabilities, so it is great that we have alerts based on it.

I think Nozomi Networks can be improved by enhancing the size of the boxes and the performance for collecting logs, and of course, the price. The most efficient way to implement Nozomi Networks is by positioning small boxes at the access switches, which enables them to capture more details, such as MAC addresses and all the packets transmitting across the network. When there are few boxes positioned above the network, the data and packets can be broken, limiting our ability to capture packets, which is not an issue with the switches but rather a capacity limitation for Nozomi box. Improving the ability to capture packets with smaller boxes would be great.

Regarding Nozomi Networks's AI capabilities, I think its governance and security are currently lacking as we do not have AI capabilities at Nozomi at this moment. However, I believe AI analysis, particularly regarding the high volume of logs, would help analysts make decisions and classify alerts more effectively. AI is a very good trend in the market, and I think Nozomi Networks should incorporate this feature soon.

I believe that AI capabilities help improve the accuracy and reliability of the alerts and the classification for the assets. This feature enhances efficient reporting, and I think it would not introduce any negative aspects to the analysis. Having AI analyze and foster accuracy with Nozomi Networks collectors would be great.

I have been using Nozomi Networks for about two years.

The customer support is very great. The few times I had to open tickets for customer support, I was attended to very quickly and efficiently by good professionals and specialists.

I did not previously use a different solution before Nozomi Networks.

Before choosing Nozomi Networks, we evaluated the Claroty solution.

Nozomi Networks's scalability is enhanced by the strategy I mentioned; the best way to implement Nozomi Networks boxes is to distribute small Nozomi Networks boxes across the access switches and network, which allows us to capture more details about the packets being transmitted between the assets. The main feature to scale this is to implement more boxes that have the performance necessary to capture and send logs to the CMC, the centralized Nozomi Networks.

My advice to others looking into using Nozomi Networks would be to place more small boxes at the access switches, especially if their company has a larger network. More boxes positioned near the shop floor assets allow for greater detail capture about packets and richer information regarding threats.

I am giving this review a rating of nine because it is a great tool, and although it has some areas for improvement, nine is a very high score.

I think Nozomi Networks is a good tool, and we will continue using it.

Nozomi Networks  serves a critical function for water systems here in South Africa. For example, a government utility called Rand Water uses IoT sensors to detect leaks on water supply systems. However, two divisions in their IT department had been operating in silos: the networking side and the IoT side. The IoT side lacked comprehensive security measures and only ran a firewall, which is not true IoT security. Their approach was reactive rather than proactive when solving problems. Nozomi Networks  came into the picture and provided them with visualization of their IoT network, which they had never had before.

This solution helped them become aware of where everything is located, where all the sensors are, how they are interconnected, which ones are working properly, and which ones are not. Initially, they had to log into each device individually just to find out if it was still working or if it had detected any issues. They were not proactive at all; they were reactive when it came to managing their infrastructure.

The best features Nozomi Networks offers include the ability to drill into every IoT device and get detailed information on make, model, performance, and what type of errors the sensor has picked up. This provides useful information on the entire IoT network versus individual sensors scattered throughout the network that they had to manually check to try and find problems. Now they receive real-time alerts on any issues.

Getting real-time alerts and detailed information impacts my team and clients because they can respond quickly and are more organized now. They are no longer chasing their tails. Now they can plan properly for the day and plan ahead on what needs to be resolved. This made them aware of where everything is, where all the sensors are, and how they are interconnected, which ones are working properly, and which ones are not.

Initially, they could not do any reporting or planning because they did not have real-time data. Now they do. Now they can do all those things because they have gained visibility and information on their inventory. They are also able to do capacity planning, which is something they could not do before.

Nozomi Networks can be improved by integrating with other technologies so that teams look at a single dashboard when it comes to security issues. Instead of looking at two different dashboards, integration would create a single dashboard that shows where the IoT meets the network. This way, if they need to isolate any threats, those threats can be isolated on the networking side as well.

I would give Nozomi Networks an eight because there is still room for improvement. The key issues involve reporting that needs to be integrated with networking reporting, and real-time alerts that need to be integrated into a single dashboard with other technologies. Integration is the most important part for future development.

I have been using Nozomi Networks since five years ago, around 2021.

Nozomi Networks is very stable.

Nozomi Networks's scalability is very impressive. I can support a huge number of IoT devices. One of the key benefits is that we do not have to use multiple tools. Nozomi Networks covers the entire infrastructure when it comes to IoT.

Customer support in terms of sales and technical assistance is very good.

Previously, there was no solution. That is why they relied on the network and network security to protect IoT, which was not really ideal.

Deployment is quick and very easy to hand over to the customer team because it is not complicated. It works from day one.

Our relationship with this vendor is structured as a reseller relationship.

I would say the ROI is significant in terms of time saved and resources. The IT team and the IoT team managed to combine into a single team that can handle both IoT and networking troubleshooting because of the information they receive from Nozomi Networks.

My experience with pricing, setup cost, and licensing has been very seamless. The Nozomi Networks team was very helpful throughout the process.

We looked at various other technologies that were primarily open source, but nothing was examined in terms of doing a proof of concept with those technologies. We primarily focused on what information we could get from our chosen tool and what other functionality it provides.

The features are great and very easy to use. The ability to navigate the platform and get useful information and reporting is much easier now. Before, it was a manual exercise where they had to try to put everything into spreadsheets and create diagrams manually to report.

Nozomi Networks has impacted our organization positively as we have gained trust from customers in terms of the technology results and everything that the technology brings. We presented and managed to demonstrate the value for money.

Solving incidents has improved drastically. The team is now able to plan properly. They do not spend over budget or under budget because they know exactly what needs to be resolved due to the information and visibility they have. The IoT team and the network team managed to integrate into a single team because they no longer operate as silos but as a single team that can resolve both IoT and networking security issues together.

The security of Nozomi Networks is great. The governance complies with government security laws.

Nozomi Networks is a very good tool, which is why we recommend it before any other product. I would give this product a rating of eight out of ten.

My main use case for Nozomi Networks  is as an IDS, so we are selling our cybersecurity services and SOC that is primarily based on Nozomi Networks  portfolio. We place them at the user's location and send the logs to the SOC, and then we do the triage, escalations, and related tasks.

In my day-to-day work, I use Nozomi Networks for monitoring and cybersecurity. Since OT networks are very fragile, you cannot install regular SIEM  agents. You have to do passive network traffic analysis instead.

Nozomi Networks has impacted my organization positively because we have experience with a few other vendors, and their configuration, reliability, and even threat identification are significantly lower than Nozomi Networks capabilities.

I can tell you about specific outcomes I've seen with Nozomi Networks. For example, it definitely improved visibility because most of the clients don't know what they have in their networks. That is the first benefit. The second benefit is the fact that even though you make site visits, site surveys, and acquire asset information, there are still some remote devices that you cannot see or the customer doesn't know about. You only discover them in Nozomi Networks. The alerting options are also definitely a benefit because even though there are false positives and a required learning time, we haven't had any real incidents, but the mere fact that you are alerted for strange or unusual behaviors in the network is more than enough for us. As far as the client goes, they are also happy because we noticed the addition of new nodes to their network. They are always surprised when we alert them to these discoveries.

The best features Nozomi Networks offers include reliability and ease of implementation because the platform is excellently made. Many other competitors use Docker  instances. The configuration of the devices itself is straightforward. The documentation could be better, but overall, it is a great platform and we are satisfied with it.

What makes the implementation process of Nozomi Networks stand out for me is that you only need to place network parameters such as IP address. You can use DHCP for acquiring those. There is no extra configuration step regarding SPAN ports. You just need to make mirror ports on the switches that you want to sniff traffic from, and the connectivity to either central management or Vantage  is almost 100 percent.

Regarding improvements for Nozomi Networks, it is hard to provide recommendations because they are already among the best vendors in the market. They are a Swiss firm that was acquired by Mitsubishi. They have grown their portfolio from an NIDS over VMs to even embedded solutions that you can put on switches, routers, or PLCs themselves. I do not see much room for improvement beyond what they currently offer. They also have wireless solutions. In the few years after I started working with them, they introduced Arcs, which are host-based sensors similar to SIEM  agents. I believe they have covered everything.

I would add that the documentation is lacking some information, so you need to ask customer support for it, but you cannot have everything. Their customer support is excellent. They are answering tickets in an hour or two, with a maximum of a day.

I have been working in OT cybersecurity for four years.

Nozomi Networks is stable in my experience.

The scalability of Nozomi Networks is excellent. They have many different options so you can choose the one based on requirements and tailor it to the needs of the customer. We are primarily using Guardian , which I believe is the 100 series. It is more than enough for most of our clients. We also use Remote  Collectors in some places and Arc sensors. We also have one Guardian  Air which is currently unused because the customer doesn't know their OT networks and since it is gathering all the Wi-Fi, there are a lot of noise from IT, so we turned that off.

Customer support is excellent. They give concise answers in a short time, around one or two hours. We have never waited more than a day for customer support.

We have started with Nozomi Networks and we are still using it. I doubt that we will stop using it in the near future because of its reliability.

We contacted Nozomi Networks directly. We are a big company and we are not using smaller distributors.

I am not familiar with the pricing, setup cost, and licensing since I am in an engineering department. I just received the device and went to the customer location. I am not involved in billing and administrative matters.

Before choosing Nozomi Networks, I believe that Dragos  was one of the options, but since we started using Nozomi Networks during the Corona pandemic and customs and tax import output were favored on the side of Nozomi Networks, we proceeded with that solution.

Regarding Nozomi Networks AI capabilities, IQ is a nice add-on feature because it can give you guidance and direction without reading the documentation because it works for you. It can also give you many ideas regarding playbook creation, alert triage, query generation, and assertions. I believe it is pretty useful, but it is entirely dedicated to Nozomi Networks. It doesn't know anything beyond that.

Regarding Nozomi Networks accuracy and reliability of output, I would rate it about 70-30 because every once in a while I catch it in some inaccuracies, and then when I ask it again, it corrects itself. I believe it is a good starting place and as with any AI, you need to know about the subject matter that you are asking about. You cannot entirely rely on it blindly.

My advice to others looking into using Nozomi Networks is that they should definitely start by making a proof of concept. The people responsible for Nozomi Networks should at least have their Nozomi certified engineer and troubleshooting certification, and the people working with the security side should have their security analyst certifications. I would rate this product a 10 out of 10.

My main use case for Nozomi Networks  is to find possible vulnerabilities and threats and create a network map in operational technology networks (OT networks). I mainly accomplish this by showing customers the OT network map along with the possible threats and vulnerabilities within these networks.

For example, in an industrial company in Peru, a customer tried to find some vulnerabilities in the OT networks. They connected the Nozomi Networks  appliance to the OT network to display a map of the devices within the network and highlight the possible vulnerabilities present.

In end customer use cases, the main use remains the same, but another use has been to try to integrate this solution with security devices, such as firewalls, to generate policies that either block or allow certain traffic, whether it is allowed traffic or potentially threatening traffic.

Nozomi Networks has positively impacted our organization as we can visualize the traffic within the OT networks and identify the potential threats or vulnerabilities. We can generate reports for analyzing possible countermeasures and determine what improvements are needed in the future to protect the traffic and the company from such vulnerabilities.

Concrete outcomes include generating reports on the types of traffic in the OT networks, improving our decision-making regarding security incident countermeasures, and reducing response times to incidents in the OT network because, prior to Nozomi Networks, we did not have another viable solution.

The best features Nozomi Networks offers include the capability to show the network map while operating in remote or sniffer mode, which is a good feature. Another feature is its ability to display vulnerabilities in OT networks, as very few solutions in the market can accurately operate within these networks to reveal potential vulnerabilities and threats. Additionally, it allows for integration with additional security devices and provides reports about this feature.

Integrating with other security devices is a little difficult because this process is not currently automated. I potentially need future integrations via APIs; however, at the moment there is limited integration with firewalls, such as Fortinet, but they require more development to properly integrate and generate policies in the correct order based on specific traffic, destinations, and services. Overall, while this could be a challenging integration with other security devices, it is a significant advancement compared to alternatives, but it does need further development in the future.

Improvements for Nozomi Networks should focus on integrating with other security devices. Since Nozomi Networks operates in OT networks, I need to connect this solution with others such as SIEM , XDR , and firewalls. Additionally, the reporting system currently displays in English, but I need to enhance these reports to be in native Spanish, not merely translated, and aim for those reports to be aligned with ISO, NIST, or other frameworks to generate a greater impact within the company.

I would also like to highlight the need for better support because when we attempt to deploy this solution with partners, the solution remains within the company but requires ongoing support for its deployment across OT networks.

I have been using Nozomi Networks for demos and proof of concepts to review the technology and the solution, and how this solution could provide insights into threats and vulnerabilities in the network. I have been engaging in tests with end customers for around six months to one year.

At the moment I believe the features are acceptable.

Nozomi Networks can handle growth in my organization easily. In the on-premise solution, there are various options to scale, such as considering hybrid or public cloud models, but at the moment, the company is not evaluating scaling.

I have had one experience with customer support at Nozomi Networks, and it was great.

I have not used a different solution before Nozomi Networks. This is my first experience with such a solution.

I evaluated other options before choosing Nozomi Networks, including options to create similar functions with firewalls using OT signatures and Nessus software. However, the final decision was to select Nozomi Networks.

My advice for others looking to use Nozomi Networks is that if you are searching for a solution that provides network visibility, AI capabilities, and easy integration and deployment, then Nozomi Networks is a viable option. I would rate this product a seven out of ten.

My main use case for Nozomi Networks  is to detect devices in the environment, especially IoT devices, or any kind of devices that connect to the network, and we need to detect them. We normally check through our console for any kind of device. For example, if a user tries to connect any device to the network or any unrecognized device is available, we monitor it. Beyond that, we check vulnerabilities of our IoT devices, mainly. We monitor any kind of abnormal traffic or any kind of abnormality on those devices, and we get a report if we want to do any patching for devices.

The best features Nozomi Networks  offers are device detection and vulnerability checking, including CVEs, and reports. In my scenario, for some of the devices, we cannot always know the location or whether we have missed any vulnerabilities. There is a large-scale variety of devices, so we cannot go through each device one-by-one and check if any CVEs were detected recently or are up to date. In that case, Nozomi Networks portal is good for us. For now, we use it for device detection and vulnerabilities only, and I am satisfied with the current functionality.

Nozomi Networks has impacted my organization positively because our technical staff changes. In those cases, we sometimes do not know about certain devices. For example, it can be difficult with some devices, and they operate in unknown locations, such as webcams or IoT devices located in different areas. In that case, we can get an idea about what devices are in our network and any abnormal traffic or any kind of abnormality on our network. Nozomi Networks could be a positive impact for the organization because if any staff, such as a network engineer or other technical engineers, changes, the next new engineer can still move forward with this portal.

Nozomi Networks has led to specific outcomes or measurable improvements for my team, including faster response times. We can say there is a faster response time because, for example, if any kind of IoT device failure occurs, we can detect it from here. Also, we can identify any kind of vulnerability impact or any incidents that happen on those devices because of vulnerabilities. We can do incident investigation through this portal as well, so it is good for the company's security posture.

I feel Nozomi Networks can be improved by integrating SIEM  features on this portal. If we integrate both features, such as SIEM  on top of Nozomi Networks, then the analysis part would be much easier for the users, and we can improve the company's security posture. In that case, sometimes we could avoid using so many tools, such as Nozomi Networks for device detection and a SIEM for different checks. If we use one tool for all of them, that would be beneficial for the company. I did not feel any kind of issue up to now, and I am not sure about the future.

I have been using Nozomi Networks for around one year.

I have not felt anything about Nozomi Networks' scalability in this scenario since it is already deployed.

The customer support was good as one time I contacted support, and I got a good reply from them. It was quite an effective response at that time.

I do not have any idea about a different solution used before Nozomi Networks. When I joined this company, it was already deployed.

My advice to others looking into using Nozomi Networks is that if any organization has large-scale OT devices or does not have a clear picture of their network diagrams or has a messy network, it is better to deploy a tool such as Nozomi Networks to keep track of the devices. Then the security posture can be improved with this portal. It is better to deploy this product. Even if a company changes their technical staff, the other team members can function well with this tool. I would rate this product an eight out of ten.