Evidence before conclusion.
NightOwl is being positioned as a Continuous OT Evidence & Assurance Platform — the control layer between what industrial systems observe and what an operator can responsibly conclude.
Do not replace mature OT security. Sit above and alongside it. Existing platforms observe, detect and score. NightOwl's job is to determine what the combined evidence actually establishes.
Different control point, not another scanner.
Four reasons the buyer can care.
Evidence-controlled findings
A finding should not advance when required evidence is absent.
Known / inferred / unknown
Fact, hypothesis and unresolved knowledge remain explicit and separate.
Unknown → evidence
Missing knowledge becomes a targeted evidence request rather than a silent estimate.
Cross-source assurance
Telemetry, historian data, engineering records and incumbent OT outputs can be reasoned over together.
See the market. Click the infrastructure.
The map is the investor interface; the canonical asset record is the backbone. Geography shows where the opportunity is. NightOwl shows what the evidence can support.
864 is a planning scenario, not a verified billable TAM. The commercial question is how many assets are core plants, regional OT nodes, satellite nodes or evidence-only assets.
Major treatment environments with meaningful SCADA / PLC / historian systems.
Pumping, booster, reservoir or collection infrastructure with independent telemetry/control.
Smaller remote sites sharing architecture and reusable connectors.
Mapped infrastructure that may not justify its own NightOwl deployment.
Strong incumbents. Different problem.
NightOwl should not compete on protocol libraries, device discovery or threat detection. The question is whether evidence assurance is important enough to become its own durable layer.
Nozomi. Guardian goes further than the other reviewed products in exposing source, granularity and confidence around individual asset facts. That is important competitive pressure — and a useful design benchmark.
No reviewed public product documentation established the complete proposed combination of proposition-level evidence state, structured evidence requests, sufficiency gates and source-to-conclusion control.
Industrial protocol depth, asset discovery, threat/vulnerability intelligence, network detection, installed base, SOC integrations, certifications and enterprise support.
| Platform | OT visibility | Evidence assurance | Role with IQAI | Why it matters |
|---|---|---|---|---|
IQAI NightOwl Continuous OT Evidence & Assurance | Integrates / consumes | Core focus | Platform | Evidence-controlled findings, known/inferred/unknown, evidence requests, sufficiency gates. IQAI thesis / partial validation |
Nozomi Networks Partial competitor | Strong | Closest overlap | Integrate + compete | Guardian exposes source, granularity and confidence metadata at asset-field level; assertions/audit data model. Verified overlap |
Claroty Partial competitor | Strong | Partial overlap | Integrate | Mature OT asset discovery, risk and multi-site capabilities. Verified overlap |
Dragos Partial competitor + service substitute | Strong | Partial overlap | Integrate | Exposure Management consumes third-party data and supports audit-ready inventory evidence. Verified overlap |
Forescout Partial competitor | Strong | Limited equivalent found | Evidence source | Passive/active sensing, classification, vulnerabilities and event workflows. Verified overlap |
Armis Partial competitor | Strong | Partial overlap | Integrate | Evidence-based vulnerability assessment and gap/coverage concepts in VM workflows. Verified overlap |
Tenable OT Partial competitor | Strong | Limited equivalent found | Evidence source | Passive/active OT discovery, exposure and configuration/change monitoring. Verified overlap |
Fortinet Complementary platform | Strong network/security layer | Complementary | Transport + security + evidence source | Segmentation, NDR, SIEM/SOAR, secure transport and public-sector channel ecosystem. Verified complementary |
OT Security Core
Guardian NSG-P550
U.S. State Dept. licences
OT / IoT scanning
Québec public-sector examples
One base case. Low and high one click away.
The model changes the unit rather than simply lowering price: portfolio base + implementation + tiered site class + recurring assurance + optional services.
C$55K
Base year-one scenario · C$35K low · C$85K high
Illustrative programme value for the selected scenario.
Illustrative annual recurring value after initial implementation.
It multiplied standalone-site economics across 864 records with effectively no fleet discount and no distinction between major plants and repeat/satellite architectures. The revised model makes the structure scalable.
Simple on top. Auditable underneath.
The investor brief should never ask the reader to trust an unexplained green checkmark or dollar figure. Material claims remain tied to scope, evidence class and a last-verified date.
Controlling competitive, pricing, technical-feasibility and go-to-market research.
Existing public-source infrastructure map and layer system.
Frozen interactive demonstration of Water Operations, Evidence Gap Analysis, QeM and Secure Plant Link.
Known / inferred / unknown, evidence requests, knowledge coverage and finding readiness.
Reviewed material establishes the capability.
Meaningful overlap exists, but not full equivalence.
Reviewed public material did not establish the function. This is not proof that the vendor lacks it.
The available evidence was too ambiguous to classify.