CyberX

CyberX was founded in 2013 in Herzliya, Israel, as a pioneering developer of agentless security monitoring platforms for operational technology (OT), industrial control systems (ICS), SCADA networks, and IoT devices. The company solved a critical problem: traditional endpoint security assumes agent deployment, which is infeasible or unsafe in industrial environments where control systems run legacy software, cannot be restarted, and operate 24/7. CyberX's core innovation was network-based, protocol-aware threat detection using deep packet inspection, behavioral analytics, and machine learning to identify anomalies, vulnerabilities, and attacks without requiring software installation on critical equipment. This capability filled a market gap in the enterprise industrial cybersecurity space, where visibility and threat detection are essential but agent-based solutions are operationally impractical.

The company raised approximately $48M in venture capital from investors including Norwest Venture Partners, Qualcomm Ventures, Maverick Ventures, and others, reflecting strong market confidence in the OT/ICS security opportunity. CyberX's solution targeted manufacturing, utilities, energy, water treatment, transportation, and other critical infrastructure operators facing increasing cyber threats from both commodity attackers and nation-state adversaries. The platform's ability to detect zero-day attacks and insider threats without operational disruption made it particularly valuable for risk-averse enterprises managing legacy infrastructure that could not tolerate downtime for security updates.

In 2020, Microsoft acquired CyberX to accelerate its cybersecurity platform in the fast-growing OT/ICS market segment. The acquisition validated both the technology and the market need: Microsoft recognized that Defender for Endpoint's strength in IT security could be complemented by purpose-built OT/ICS capabilities. CyberX's technology now forms the foundation of Microsoft Defender for IoT, which provides integrated threat detection, vulnerability management, and analytics for OT/ICS/IoT environments across Microsoft's enterprise security ecosystem. This integration gives CyberX's innovation access to Microsoft's global distribution, enterprise sales channels, government relationships, and cloud infrastructure, dramatically amplifying its reach.

For defense and national-security applications, CyberX's agentless OT/ICS monitoring is strategically significant. Military installations, weapons systems support infrastructure, critical infrastructure facilities, and defense logistics networks rely on legacy industrial control systems for power generation, water treatment, HVAC, physical security, communications, and manufacturing. These systems are frequent targets of cyber attacks because their compromise threatens operational continuity and force protection. CyberX's behavioral analytics and protocol-aware detection provide visibility and threat response without disrupting military operations. NATO allies, U.S. Department of Defense, and other government customers can deploy the technology (now within Microsoft's trusted infrastructure) to protect critical OT/ICS assets against both external adversaries and insider threats.

The OT/ICS security market remains fragmented and specialized, with dedicated vendors (Claroty, Dragos, Nozomi Networks) maintaining strong competitive positions in government and critical infrastructure verticals. However, CyberX's position within Microsoft Defender for IoT provides strategic advantages: integration with Microsoft's cloud security platform, compatibility with Defender for Endpoint, and enterprise contractual relationships that create switching costs. Microsoft's commitment to OT security is reinforced by Government Cloud deployments and regulatory requirements for federal agencies to migrate to modern security platforms. CyberX's core technology—agentless network-based detection—remains defensible and difficult to replicate at scale.