Armis Device Security Platform

The primary use case for Armis is asset discovery, specifically for the industrial plant floor devices and the enterprise devices.

In terms of asset discovery with Armis for our industrial plant floor and enterprise devices, it operates in a zero operational risk mode, as it doesn't stop or crash any devices or machines. It employs completely passive asset discovery and understands protocols from both the OT (operational technology) side and IT protocols, providing a unified view that reduces visibility gaps by monitoring all standard IT systems, OT networks, and IoT devices on a single platform.

While our use of Armis isn't unique, we are trying to address the IT-OT gap and visibility gap, aiming to bridge the divide between the industrial floor and enterprise, thus offering complete visibility of the assets we operate. This visibility enables informed decision-making at the leadership level.

Asset discovery provides a complete picture of the entire organization, eliminating the visibility gap and revealing 3x to 4x more managed assets, addressing approximately 20% to 35% of unmanaged OT assets previously overlooked due to legacy issues or spreadsheet inventories.

Armis helps reduce false positives by providing context. Before implementing it, our log context was scattered and led to chasing critical alerts that were often unexploitable, wasting hundreds of hours. Now, we can filter 70% to 85% of non-security operational noise, and audit preparation time has been reduced by around 80% due to automated passive asset inventory and pre-mapped regulatory frameworks.

The best features Armis offers include passive asset discovery, protocol parsing, continuous threat detection, and anomaly monitoring, along with vulnerability and risk prioritization, which presents a risk score exposure based on asset criticality, network reachability, and potential threat exploitation instead of just listing thousands of unpatchable OT vulnerabilities.

Continuous asset discovery is the biggest difference for my team, while vulnerability and risk prioritization, which adds great value, helps my team and leadership make informed decisions and removes shadow IT or blind spots, thus achieving zero-risk safety compliance.

The automated workflow that updates asset discovery cards is key, as it saves manual tracking effort when devices are added or reflect any new changes. The deeper model verification for enforcing IT and OT segmentation runs queries to identify violations within the Purdue model.

Armis could improve secure remote access solutions for vendors requiring remote entry into the OT plant environment, and a lightweight native integration option would be beneficial due to the challenges posed by unmanaged switches on the plant floor.

There is an evident need for a robust BI-grade nested search engine and customizable trend reporting in the reporting and analytics space, and easier deployment for collector infrastructure in deep internet support would also enhance the user experience.

I rate Armis eight out of ten primarily due to its heavy reliance on SPAN and TAP networks, which creates deployment friction in legacy plants, custom parsing for niche protocols requiring vendor dependency, and the need for improvement in deep reporting and integrations.

I have been using Armis for seven years.

In my experience, Armis has been stable with no downtime or reliability issues.

Armis handles scalability well, particularly during mergers and acquisitions, ensuring instant visibility as it scales.

Customer support has been challenging for Armis, particularly in the APAC region, where their presence is minimal, requiring reliance on limited resources based in Australia.

I rate customer support a six out of ten.

Previously, we used multiple solutions including Claroty, Nozomi, Tenable, and CyberX.

Implementing Armis reduces labor and man-hours spent on manual audits by up to 80% and significantly decreases non-exploitable vulnerability alerts by roughly the same percentage, leading to lower mean times for incident resolution and facilitating consolidation against legacy infrastructure.

The licensing for Armis is straightforward, though there are setup costs associated with deploying engineers, and the pricing starts at around $39k per year or $3,250 per month, which occasionally poses challenges in customer negotiations.

We evaluated Claroty, Nozomi, and Tenable.one before choosing Armis.

I would rate Armis an eight out of ten, considering the improvements needed.

As a SaaS platform, Armis employs an asset intelligence engine that maintains security by locally processing network traffic and stripping any sensitive data, ensuring secure governance practices, compliance with GDPR, and maintaining strict data residency requirements.

From a user experience perspective, Armis delivers reliability, achieving a score of over 90% in device identification and accuracy, though some operational variance exists in behavioral anomaly baselining that could use improvement.

If you are looking for pure asset discovery solutions, Armis stands out as one of the best options available.