Indegy

Indegy was an industrial cybersecurity company founded in 2014 around a difficult operational problem: security teams cannot protect industrial control systems if they do not know which PLCs, RTUs, HMIs, engineering workstations, network devices, and other assets are present, how those assets depend on one another, and what constitutes a dangerous change. Its product approach combined passive network monitoring with OT-aware asset identification and safe active interrogation. This is materially different from simply importing an IT vulnerability scanner into a plant, because industrial protocols, vendor-specific device behavior, firmware, backplane components, and process sensitivity all affect what can be queried safely. Tenable described Indegy as bringing asset inventory, configuration management, threat detection, vulnerability assessment, and a patented non-intrusive active-analysis approach into its platform.

The customer problem is shared by manufacturers, energy operators, water utilities, pharmaceutical plants, transportation operators, and other organizations with cyber-physical production environments. OT networks are often heterogeneous, contain long-lived equipment, and have uptime and safety constraints that make intrusive scanning or rapid patching unacceptable. Current Tenable positioning emphasizes visibility into dormant PLCs, shadow IT, unmanaged IoT, firmware, lifecycle data, known vulnerabilities, configuration changes, anomalies, communication paths, and IT/OT exposure. That product framing indicates a shift from a standalone Indegy suite toward a broader exposure-management workflow in which plant data is correlated with enterprise vulnerability intelligence and remediation prioritization. The commercial value is therefore less about a single detection feature than about reducing uncertainty and helping security, operations, and executive teams agree on which exposures threaten uptime or physical safety.

The competitive field remains strong. Claroty, Nozomi Networks, Dragos, Armis, Microsoft Defender for IoT, and Forescout all offer overlapping combinations of asset discovery, network monitoring, vulnerability context, anomaly detection, and integrations. Indegy's defensible contribution was its OT-specific device semantics and the combination of passive visibility with safe active analysis, while Tenable supplied an established vulnerability-management channel, risk-prioritization layer, and enterprise platform. That combination can shorten the path from discovery to a ranked remediation queue, but it does not eliminate the need for protocol coverage, site-specific tuning, systems-integrator expertise, and careful validation before deployment. Buyers may also prefer a specialist platform with deeper incident-response or threat-intelligence features, or a broader security vendor that already owns adjacent IT, cloud, and identity workflows.

The strongest commercialization signal is the acquisition itself. Tenable announced on December 2, 2019 that it acquired Indegy for $78 million in cash and stated that Indegy's financial results were immaterial to Tenable's fourth-quarter 2019 results. Tenable's contemporaneous materials called the product Tenable.ot, powered by Indegy, and described integration with Tenable.sc, Tenable.io, and Tenable Lumin. The current product surface is Tenable One OT Exposure, which presents the acquired capabilities as part of a mature, maintained OT/IT exposure platform. This supports a conclusion of product validation and strategic fit, but it does not provide current standalone revenue, headcount, retention, or roadmap evidence for Indegy as a separate company.

The national-security relevance is credible but should be stated narrowly. Asset inventory, controller integrity monitoring, segmentation visibility, vulnerability prioritization, and anomaly detection are foundational to resilience in electricity, water, fuel, transportation, communications, and defense-manufacturing environments. They can support both civilian critical infrastructure and defense industrial operations because the underlying problem is protection of cyber-physical processes, not a military-specific mission system. However, no public evidence in the reviewed sources establishes a particular defense contract, deployment, accreditation, or operational use by a government customer. The strategic case therefore rests on dual-use applicability and the importance of OT resilience, while diligence should separately confirm deployment constraints, product support, data-handling requirements, and the extent to which Tenable continues to invest in the acquired technology.