Dragos, a 5-year-old company that provides cybersecurity for industrial control systems (ICS) and operational technology (OT) environments, today said it closed a $200 million Series D funding round on a $1.7 billion valuation. This brings Dragos’ total raised to $340 million.

CEO Robert M. Lee is a former U.S. Air Force cyberwarfare operations officer who worked with the National Security Agency before co-founding Dragos. He says the new investment marks the largest funding round and highest valuation ever achieved by an OT cybersecurity company.

Dragos raised its Series D as its security platform revenue grew 100% year over year for the period ending Sept. 30. It also follows an earlier record-setting round (a $110 million Series C) last year — and comes at a time when OT security has become a White House and C-suite level discussion. Meanwhile cyberattacks against OT systems like the water treatment plant hack in Florida become more frequent.

In April, the Biden Administration announced a 100-day plan to improve cybersecurity across the U.S. power grid. Lee says 155 utilities opted in to this initiative. “And out of that 155, 80% of them ended up going with Dragos,” he said. “We had this massive movement of customers all at once, which validates the market.”

Following the Department of Energy’s 100-day cybersecurity sprint, Dragos in partnership with the DOE launched the Neighborhood Keeper initiative. This is a free, opt-in, anonymized information-sharing network available to all Dragos platform customers.

“For decades we’ve been talking about information sharing between infrastructure and government, and it’s happened to some degree on the IT side, but it’s never, not once, zero happened on the OT side of the house — with good reasons,” Lee said. “Because the data is really sensitive, and the idea that I have to give up sensitive OT data to some ISAC or government or something, and it’s got to be off my premises, that’s terrifying.”

The Neighborhood Keeper technology accounts for all of these concerns by anonymizing the customer identity and information and allowing them to keep their data on premises.

“We don’t know who they are, but we know that utility two, five, and 15 have these vulnerabilities and these types of threats,” Lee explained, adding that more than 100 energy companies are now sharing data in real time via Neighborhood Keeper. The vendor is also in discussions about developing similar initiatives in the United Kingdom and Australia, he said.

“The Neighborhood Keeper technology, and the fact that it has been massively adopted this past year, has put this country in a different place than it was a year ago in terms of threat insights being shared across the community and with government,” Lee said. “It’s solving a long-standing problem on the national security discussion.”

Dragos didn’t try to raise more capital, Lee said. Instead, the investors came looking for Dragos. “We still have most of that funding left,” he said, referring to the Series C. “The D round was pre-emptive. The market very obviously moved in the direction of OT security. And Dragos has been pretty far out in front of our competitors in terms of number of customers that it attracted the attention of the super players.”

He’s talking about Koch Disruptive Technologies and BlackRock, which led the funding round. Koch Industries is also a Dragos customer. Other investors include Emerson, Hewlett Packard Enterprise, AllegisCyber, Canaan, DataTribe, Energy Impact Partners, Schweitzer Engineering Labs, National Grid Partners, Global Reserve Group, and Rockwell Automation.

But while investors vie to fill Dragos’ coffers now, that wasn’t the case when the startup launched almost six years ago. “We took an approach, which was almost antithetical to what the market was doing at the time,” Lee said.

At the time, investors and organizations didn’t consider industrial cybersecurity a legitimate market, he added. Plus, other vendors in the space focused primarily on asset identification and visibility — not ICS-specific threats.

Dragos, on the other hand, built a platform that provides asset visibility, but it also provides vulnerability management, threat detection, and response. Plus it has dedicated threat intelligence and incident response teams.

“Over the last two or three years it’s pretty obvious there are industrial-specific threats,” Lee said. “As we look more, we find more. There’s stuff happening in these networks and it shouldn’t be a surprise if we were never monitoring them, we’re not seeing things. But now that people are starting to get visibility and insights, it’s like holy crap, there’s a lot of industrial-specific threats.”

Industrial cybersecurity firms including Claroty and Nozomi compete against Dragos in the space, but Lee says his company’s threat-hunting and incidence response capabilities give it an advantage. For comparison, Nozomi has raised $152.5 million to date, and Claroty has raised $240 million.

Dragos has more than 200 customers across critical-infrastructure sectors in industries including electric, oil and gas, chemical, pharmaceutical, food and beverage, water, and manufacturing.

And while Dragos exclusively focuses on securing these organizations’ operational technology environments, over the past few years some enterprise-IT security vendors including Microsoft, Forscout, and Cisco have acquired OT and IoT security startups in a push to move into industrial security. “I don’t think it’s going to work at all,” Lee said.

IT enterprise security companies don’t understand how industrial and critical infrastructure systems work, he added. “We can demonstrate how our tech works better than an IT product,” Lee said. “But before we even get to that: We know their mission and what they’re trying to accomplish. We know how they’re doing it, and we know those systems, and we can have a conversation with IT and OT in that company. The IT companies don’t get past that barrier to get to a tech discussion.”