Dragos Inc. released June 23 its EmberAI, an OT-native AI built on the Dragos Intelligence Fabric OT cybersecurity data set. It gives analysts immediate access to Dragos’s OT-specific, historical and real-time intelligence gained from more than 10 years of OT actions, activity and knowledge.

This gives teams detailed visibility into assets, vulnerabilities and network activity across their OT environments. They can prioritize threats by operational impact, and act on findings specific to their setting. EmberAI lets every analyst, regardless of experience,  move from alert to informed action faster, and make defensible decisions grounded in real adversary data.

Power grids, manufacturing plants, water systems, pipelines, data centers and other users responsible for securing extended operational technology (xOT) environments require AI that’s built on the right intelligence and grounded in operational reality. EmberAI helps rookie and veteran analysts see, understand, and act with the confidence of an OT expert. They can prioritize what matters operationally, and act effectively on findings that threaten safe operations.

“We built EmberAI to harness Dragos’s decade-plus of experience in threat intelligence, incident response, adversary tracking, and frontline operations for OT environments,” says Robert Lee, CEO and cofounder, of Dragos. “It’s hard to reproduce this depth of OT-specific expertise, and build AI that understands and can act on OT-specific findings." 

Parts under EmberAI’s hood

Dragos Intelligence Fabric is founded on more than five petabytes of daily OT telemetry, 10-plus years of adversary tracking across named OT threat groups, proprietary OT vulnerability research as a CVE Numbering Authority, asset and protocol research spanning more than 600 OT protocols, and frontline incident response experience from critical infrastructure environments. Plus, it continuously learns as new intelligence surfaces, field insights accumulate, and threat groups adopt new behaviors.

This foundation enables EmberAI to operate on a principle that distinguishes it from generic AI—OT specific intelligence applied in context. It’s central to Dragos's xOT security strategy to secure the extended operations environment influencing operational processes. As Dragos’s xOT integrations expand its intelligence fabric with new data sources, EmberAI's intelligence and capabilities will grow with it.

EmberAI primary working parts include:

• Intelligence-driven query engine. Analysts ask questions in plain language and receive precise, OT-contextual answers grounded in the Dragos Intelligence Fabric. This eliminates the need to manually pivot across disconnected tools or correlate data from multiple sources.
• Contextual correlation across the environment. EmberAI connects assets, vulnerabilities, threat intelligence and network activity into a unified, real-time understanding. Decisions are based on full operational context, not isolated or irrelevant technical signals.
• Adversary-informed guidance. Detections and alerts are mapped to known OT threat groups, observed attack patterns, and real behaviors drawn from the Dragos Intelligence Fabric. Analysts understand not just what’s happening, but what it means for their environment and how to prioritize their response.
• Workflow acceleration and automation support. From alert triage to incident summaries and reporting, EmberAI reduces hours of friction-laden and often error-prone manual work. Analysts spend less time gathering data and more time making informed decisions.
• Expert-built OT skills. Dragos analysts are building and validating a library of guided, repeatable workflows that encode the same expertise they apply during proactive services, investigations, and incident response. This library will be available soon.
• Continuous learning through the intelligence fabric. As new intelligence and field insights surface, Dragos Intelligence Fabric evolves and EmberAI becomes more efficient and effective.

Consequently, Dragos reports that analysts remains in control at every step. Every recommendation that EmberAI surfaces is transparent and auditable, enabling defensible workflows. User data never leaves the customer's environment. EmberAI operates inside the Dragos Platform deployment the organization already controls. These design choices reflect a foundational, human-in-the-loop principle for OT—the person responsible for protecting an environment must own the final decision.