Coverage area

OT/ICS Security Monitoring

Armis Managed Threat Service

Threat hunting, suspicious-activity review, alert enrichment, risk-based policy tuning, weekly findings, trend reviews and investigation support around Armis Centrix.

EndpointsNetworkOT/ICS

What they do Investigate and advise MSSP
Market Mid-MarketEnterprise
Price G-Cloud examples from £134,400 per asset block*

You still own Approving or executing containment actions in NAC, firewall, endpoint, identity or ITSM tools

24/7 monitoring of Forescout TDR detections, suspicious-entity triage, incident case investigation, impact classification, customer escalation, proactive threat hunting, log-source monitoring and containment or remediation guidance.

EndpointsNetworkOT/ICS

What they do Investigate and advise MDR
Market EnterpriseMid-Market
Price Public reseller signal: CDW lists a one-year Forescout Assist F/XDR subscription SKU at $11,771.99; final Assist scope is quote-based.

You still own Buying and operating the qualifying Forescout TDR subscription and sensors

Critical Start

24x7 MDR monitoring, investigation, false-positive reduction, alert resolution workflow, scoped response actions, coverage-gap visibility and SOC collaboration through CORR and MOBILESOC.

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market Mid-MarketEnterprise
Price Quote-based tiered MDR with AWS Marketplace private-offer procurement

You still own Licensing, deploying and maintaining the EDR, SIEM, identity, cloud and other tools in scope

Mandiant Managed Defense

24/7 Mandiant MDR with alert triage, investigation, threat hunting, curated detections, investigation reports, supported technology integrations and scoped response actions through Google SecOps and partner tools.

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market Mid-MarketEnterprise
Price CDW reseller listing shows $53.99 for one Managed Defense subscription license SKU

You still own Licensing and operating the Google Security Operations environment and required partner technologies

24/7 managed detection, triage, investigation and contracted response through Orange Cyberdefense CyberSOCs, Core Fusion and supported EDR, NDR, SIEM, cloud and OT telemetry

EndpointsNetworkCloud Workloads

What they do Contain threats MDR
Market Mid-MarketEnterprise
Price Quote-based, private-offer signals

You still own Connecting and maintaining agreed endpoint, network, cloud, identity, SIEM and OT telemetry sources

24/7 SOC monitoring of the buyer's Darktrace environment, alert triage, investigations, containment-action escalation, analyst questions, monthly service reports, service-ready checks and optimization reviews.

NetworkCloud WorkloadsOT/ICS

What they do Co-manage the SOC MDR
Market Mid-MarketEnterprise
Price Quote-based; AWS Marketplace supports private offers but does not expose a reliable public service rate.

You still own Deploying and tuning the relevant Darktrace modules and sensors across the environment

ReliaQuest GreyMatter

GreyMatter connects to enterprise security tools, normalizes alerts, supports investigation and hunting, runs approved response playbooks and gives the buyer a shared operating surface with ReliaQuest analysts and engineers.

EndpointsCloud WorkloadsIdentity & Access

What they do Co-manage the SOC Co-managed SOC
Market EnterpriseMid-Market
Price AWS Marketplace lists a 12-month GreyMatter SIEM Integration Plus package at $226,000*

You still own Licensing and administering the SIEM, EDR, cloud, identity, email and network controls in scope

Hybrid or fully outsourced SOC operation with 24/7 monitoring, alert investigation, threat hunting, threat intelligence, SIEM and SOAR enhancement, incident response leadership and detection improvement across agreed environments.

EndpointsCloud WorkloadsIdentity & Access

What they do Run the SOC SOCaaS
Market Mid-MarketEnterprise
Price Public G-Cloud references by user, server and scope

You still own Defining whether the engagement is hybrid, fully outsourced or limited to a specific SOC function

How to use this list

Use it when

  • Use this list when one part of your environment needs managed monitoring or response coverage.

Do not assume

  • Coverage does not always mean action. Some providers monitor a source but cannot contain threats there.

Ask before shortlisting

  1. Confirm which telemetry sources are included by default.
  2. Ask whether response actions work on this surface or only alerting is included.
  3. Check whether reporting and detection tuning are part of the managed service.
Category background

These SOC providers monitor operational technology (OT) and industrial control systems (ICS) for cybersecurity threats — including SCADA, PLCs, and industrial network traffic. As IT and OT networks converge, protecting critical infrastructure from cyber threats is an urgent priority for manufacturing, energy, utilities, and government organizations.

Why OT/ICS Monitoring Matters

Industrial control systems were designed for reliability, not security. Many run legacy protocols and operating systems that cannot be easily patched or updated. The convergence of IT and OT networks has exposed these systems to threats they were never designed to withstand — including ransomware, nation-state attacks, and supply chain compromises. High-profile incidents like the Colonial Pipeline attack have demonstrated the real-world consequences of OT security failures.

What to Look For

Evaluate providers on their ability to discover and inventory OT assets, parse industrial protocols, detect anomalies without disrupting operations, and coordinate response actions with plant engineers and operational staff. Specialized OT SOC providers maintain separate monitoring environments for OT networks and employ analysts with industrial security certifications (GICSP, GRID) and experience in ICS-specific threat landscapes.

Questions

What does OT/ICS security monitoring cover?
OT/ICS security monitoring covers supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs), distributed control systems (DCS), human-machine interfaces (HMIs), and the industrial networks connecting them. SOC providers monitor for unauthorized access, protocol anomalies, firmware changes, and lateral movement between IT and OT networks.
Why is OT security different from IT security?
OT environments run specialized industrial protocols (Modbus, DNP3, OPC-UA, BACnet) that traditional IT security tools cannot parse. Equipment often runs legacy operating systems that cannot be patched, availability takes priority over confidentiality, and a misconfigured response action could disrupt physical processes or endanger safety. OT-capable SOC providers understand these constraints and tailor their monitoring and response accordingly.
Can a single SOC provider cover both IT and OT?
Some providers offer converged IT/OT monitoring, which is increasingly valuable as IT-OT network boundaries blur. However, OT monitoring requires specialized protocol analysis, asset discovery capabilities, and response playbooks that respect operational constraints. Look for providers with dedicated OT expertise, not just IT monitoring extended to industrial networks.