Dragos buys runZero: questions for teams that feed a CMDB with it

This note covers announcements from 10 and 21 September 2026, read for this site on 27 September 2026.

What was announced?

Dragos, an industrial and OT security company, announced that it acquired runZero and NetRise to extend its xOT security platform. The announcement says runZero's CEO, HD Moore, will lead integration work while continuing to serve existing customers. No deal terms were disclosed.

Why does it matter for a CMDB?

runZero is one of the three network discovery options on this site, and it has the strongest upkeep story of all nine: it needs "no agents, authentication, or appliances", combines active scanning with passive discovery for fragile OT networks, and runs as SaaS, on-premises or in air-gapped environments. It scores 86 on effort to maintain, the highest in the set, and ranks 3 of 9 overall at 69.3.

Its link to the CMDB is an integration that enriches ServiceNow with what it discovers. Teams that rely on that feed should know where the product is heading.

What do we know about the product today?

On the pages read on 27 September 2026:

• Coverage spans IT, OT, IoT, cloud, mobile and remote assets; SaaS apps are not covered.
• Each asset is profiled against nearly 1,000 attributes.
• Integrations include ServiceNow for CMDB enrichment, CrowdStrike, Intune, the three big clouds, Entra ID and several vulnerability and endpoint tools, plus a Custom Integration SDK.
• runZero 5.1, announced on 10 September 2026, lets users generate integration scripts in Starlark with an AI provider of their choice; the scripts run in a sandbox on runZero Explorers.
• Pricing is published: a free Community Edition for 100 or fewer assets with 30-day retention, the runZero Platform from $5,000, and a free 21-day trial.

What is not known?

The announcement does not describe pricing changes, packaging, roadmap or whether runZero will continue to be sold as a separate product in the long run. It says existing customers will continue to be served. Anything beyond that would be a guess, and we do not make one.

What should current customers ask?

• Will the ServiceNow integration be maintained, and on what release cadence?
• Will the published price and the free Community Edition stay?
• Will on-premises and air-gapped deployments stay supported?
• Will IT-focused features keep pace, given Dragos's OT focus?
• What notice period applies to any change in licensing terms?

Ask for the answers in writing before renewal.

Does it change the score?

No. Scores follow published facts, and none of the scored facts changed on the day of the announcement. If pricing, deployment options or the ServiceNow integration change, the profile and score will be updated with the new source.

What are the alternatives if you need to plan for change?

Within network discovery, Lansweeper is the closest match on upkeep and published pricing, at 69.8. If the reason you use runZero is OT, Armis covers OT, IoT and medical devices passively but shows only an AWS Marketplace minimum price. The replacing page lists all eight with the criteria where each beats runZero.

How should you plan a renewal?

Treat the next renewal as a small pilot. Re-run the baseline measures from lesson 9 on the asset classes runZero covers for you, check that the ServiceNow feed still enriches the records you expect, and note how much time the team spends keeping it running. If the numbers hold and the answers to the questions above are acceptable, there is no reason to change. If they slip, the measures give you a factual basis for a decision.

The short version

Nothing about runZero's documented product changed on 21 September. Its ownership did. That is a reason to ask questions, not a reason to move.