Source: CRN / TechCrunch (original reporting, June 2020)
Microsoft Confirms CyberX Acquisition
Microsoft officially confirmed its acquisition of CyberX, an industrial IoT (IIoT) cybersecurity startup based in Waltham, Massachusetts. The announcement came more than a month after Israeli media outlets first reported that the two companies were in the final stages of a deal. While Microsoft did not publicly disclose the purchase price, multiple reports — including one from TechCrunch — placed the deal at approximately $165 million.
The acquisition was announced in a blog post co-authored by Microsoft executives Michal Braverman-Blumenstyk (CTO, Microsoft Security) and Sam George (VP, Azure IoT), who outlined how CyberX would be integrated into Microsoft’s existing Azure cloud security portfolio.
Why CyberX? Filling the Industrial IoT Security Gap
Microsoft’s Azure platform already offered multi-layer IoT security and monitoring capabilities prior to this acquisition. However, CyberX addresses a specific and growing challenge: securing devices in industrial IoT (IIoT), operational technology (OT), and critical infrastructure environments — settings where traditional IT security tools often fall short.
Many industrial environments run legacy equipment — programmable logic controllers (PLCs), SCADA systems, industrial sensors — that cannot run security agents. These unmanaged devices present significant blind spots for security teams. CyberX’s platform is designed specifically for this problem.
What CyberX Brings to the Table
Founded in 2013, CyberX had raised $48 million across five funding rounds and employed approximately 163 people at the time of the acquisition. Its most recent round — $18 million closed in April 2019 — was led by Qualcomm Ventures and Inven Capital.
CyberX’s core product is an agentless cybersecurity platform built for industrial environments. Key capabilities include:
- Passive asset discovery: Automatically identifies and inventories unmanaged IIoT and OT devices without requiring agents or active scanning that could disrupt sensitive industrial equipment.
- Continuous network monitoring: Monitors OT networks in real time for anomalous behavior, unauthorized changes, and indicators of compromise.
- Vulnerability management: Profiles each discovered device — including firmware version, open ports, and known CVEs — to help operators understand their attack surface.
- Threat intelligence: Applies threat intelligence specific to industrial control systems (ICS) to identify attack patterns relevant to OT environments.
- Digital asset mapping: Produces a visual map of thousands of devices across a factory floor or facility, showing asset relationships and communication paths.
The platform’s XSense product line focuses specifically on anomaly detection and threat intelligence for securing industrial operations and reducing unplanned downtime caused by cyber incidents.
Integration with Azure Sentinel and the Broader Azure Security Stack
One of the most significant planned integrations at the time of the announcement was with Azure Sentinel, Microsoft’s cloud-native Security Information and Event Management (SIEM) platform. The addition of CyberX’s OT visibility data was expected to give Sentinel the ability to surface cyber threats targeting operational technology assets — something most enterprise SIEMs are not equipped to do out of the box.
This matters because OT attacks — such as those targeting power grids, water treatment facilities, or manufacturing lines — can have physical consequences that go well beyond data theft. Correlating OT signals with IT telemetry inside a unified SIEM is a meaningful step toward converged IT/OT security operations.
Microsoft’s executives also emphasized that the acquisition did not signal a retreat from ecosystem partnerships. Third-party security vendors providing on-the-ground expertise and integration services for OT environments would remain an important part of Microsoft’s go-to-market approach.
CyberX’s Customer Base and Market Position
At the time of the acquisition, CyberX counted among its customers two of the top five U.S. energy providers, a top-five global pharmaceutical company, a top-five U.S. chemical company, and national electric and gas utility operators across Europe and Asia-Pacific. This roster reflects the company’s strength in regulated, high-consequence industries where OT security failures carry serious operational and safety risks.
Strategic Context: The Growing IIoT Security Market
The CyberX acquisition fits into a broader trend of major cloud and security vendors moving to address the OT/ICS security market. Industrial environments are increasingly connected to corporate IT networks and the internet — expanding the attack surface dramatically. High-profile incidents targeting industrial control systems (such as attacks on energy infrastructure) have heightened awareness of the risks.
For Microsoft, adding native OT visibility to Azure IoT and Azure Sentinel positions the company to compete more directly for security budgets in manufacturing, energy, utilities, and critical infrastructure — sectors where Azure was already making inroads through its broader cloud platform.
The acquisition also reflects the difficulty of building ICS/OT security expertise organically. CyberX’s founding team had backgrounds in Israeli military intelligence cyber units, giving it deep domain knowledge in adversarial ICS attack techniques — the kind of institutional knowledge that is hard to replicate quickly.
What This Means for DevOps and Security Teams
For engineering and security teams operating in or adjacent to industrial environments, the key takeaways from this acquisition are:
- OT asset visibility is now a first-class Azure capability. Teams managing hybrid IT/OT environments can expect tighter integration between IIoT device inventory and Azure security tooling.
- Azure Sentinel gains OT context. Security operations teams using Sentinel for IT incident detection can anticipate expanded coverage for OT threats in the same interface.
- Agentless coverage matters. The agentless approach is not optional in OT — it is often a hard requirement. Any security tooling for industrial environments must accommodate devices that cannot run software agents.
- IT/OT convergence security is accelerating. As digital transformation pushes more industrial systems online, the boundary between IT and OT security is dissolving. Architects designing connected factory or smart grid solutions should plan for security tooling that spans both domains.
Note: This article is based on reporting from CRN and TechCrunch from June 2020 and Microsoft’s original acquisition announcement blog post. CyberX technology has since been rebranded and integrated into Microsoft’s security portfolio as Microsoft Defender for IoT.