Most security teams guarding power plants and water systems have a dirty secret: they can see alerts, but they can’t always see the network those alerts are coming from. Operational technology environments grew up in an era when “air gap” was the assumed defense, and visibility was whatever the control engineer happened to notice on a terminal. That gap has become one of the more uncomfortable truths in critical infrastructure security, and it’s exactly where a new partnership between Nozomi Networks and Schweitzer Engineering Laboratories is aiming.
The two companies announced an integration that pairs Nozomi’s AI-driven threat detection with the software-defined networking visibility that SEL brings from the substation and industrial control side of the world. The pitch is straightforward: pull richer telemetry out of OT networks that normally resist it, then let machine learning sort the noise from the genuinely dangerous.
On paper that sounds like a natural fit. In practice, it addresses a problem that has quietly frustrated asset owners for years. Traditional IT security tools were never built for the strange protocols, legacy equipment, and odd traffic patterns of industrial environments. Deploy a standard intrusion detection system on a substation network and you’ll drown in false positives or, worse, miss the slow, deliberate moves of an attacker who understands the process as well as the operators do.
What makes the SEL angle interesting is the networking layer. SEL has deep roots in utility communications, and software-defined networking in OT gives defenders something closer to a programmable view of how traffic actually flows between devices, rather than a best-guess reconstruction from logs. Combine that with Nozomi’s behavioral models, which have been trained on industrial traffic patterns, and you get a system that can potentially spot anomalies with more context about the physical process underneath.
The timing matters. Critical infrastructure has become a favored target for both state-linked actors and criminal groups, and regulators in several regions have started tightening expectations around monitoring and incident reporting. Utilities that once treated OT security as a compliance checkbox are now being asked to demonstrate real detection capability. Vendors are racing to offer something that looks like a unified answer rather than a stack of disconnected point tools.
Still, it’s worth tempering the enthusiasm that always accompanies an integration announcement. Partnerships like this live or die on deployment reality. Industrial environments are notoriously slow to change, and many operators are understandably wary of anything that touches live control networks. The value of AI-assisted detection depends heavily on the quality of the underlying data, and getting that data often requires sensor placement and network reconfiguration that take time, budget, and a lot of coordination with operations staff who don’t love surprises.
There’s also the matter of how much autonomy the AI is given. Detection is one thing; automated response in an OT environment is another entirely. Nobody wants an algorithm making decisions that could trip a breaker or disrupt a process because it misread a legitimate maintenance event as an attack. The safer framing, and the one most vendors in this space lean toward, is that AI narrows the haystack and hands a human a shorter list of things worth investigating. Whether these systems stay in that advisory lane or creep toward automation will be one of the more consequential questions for the sector over the next few years.
The broader pattern here is hard to miss. Industrial cybersecurity is consolidating around the idea that visibility and intelligence have to arrive together. Standalone monitoring without analytics overwhelms operators; analytics without reliable telemetry produce confident nonsense. Bringing a networking specialist and a detection specialist into the same tent is a reasonable bet that the combination beats either alone.
For the utilities and industrial operators weighing their options, the practical takeaway is less about this specific announcement and more about the direction of travel. The era of treating OT networks as opaque and hoping for the best is ending, pushed along by regulators, insurers, and the simple fact that attackers have already done the homework on industrial protocols. Tools that make those networks legible to defenders, and then help those defenders make sense of what they’re seeing, are moving from nice-to-have to table stakes. Whether Nozomi and SEL execute on that promise is a question only a few real deployments will answer.