Dragos launches EmberAI to address shortage of OT cybersecurity workers
cybernewschronicle.com · post 59806 · 2026-06-23
WASHINGTON — The cyberattack surface for critical infrastructure keeps expanding. Power grids, water systems, pipelines, data centers — they all run on operational technology, or OT. And the people who know how to defend that technology are scarce.
Dragos Inc. sees a gap, and it is betting an artificial intelligence assistant called EmberAI can help fill it. The company launched EmberAI on June 23.
The tool runs on what Dragos calls the Dragos Intelligence Fabric, a data set the company describes as the largest of its kind in OT cybersecurity. That data set is enormous — more than 5 petabytes of daily OT telemetry alone. It draws on over a decade of adversary tracking and incident response work.
Dragos also holds status as a Common Vulnerabilities and Exposures Numbering Authority, and its research spans more than 600 OT protocols. General-purpose AI models, Dragos argues, are not built for this world.
They cannot tell the difference between a critical vulnerability and routine system noise. They lack understanding of the physical plant — the pumps, valves, controllers and sensors that make up industrial operations. EmberAI is built specifically for that environment.
Analysts can query the system in plain language. They can ask about assets, vulnerabilities or network activity. The assistant ranks threats by operational impact.
That means a plant engineer with no formal cybersecurity training can ask the same question a veteran OT specialist might — and get an answer grounded in real threat data. The timing is no accident.
Attacks on critical infrastructure are rising. The workforce of OT security specialists is not keeping pace. Dragos is positioning EmberAI as a force multiplier — a way to put years of threat intelligence into the hands of people who may have little experience in cybersecurity but deep knowledge of the systems they run.
That matters for organizations securing power grids, manufacturing plants, water systems, pipelines and data centers. The tool is designed to be accessible to a wide range of users, from IT practitioners to plant engineers to seasoned OT veterans.
What this means in practice is still unfolding. But the logic is straightforward. The data exists.
The threat intelligence is there. The bottleneck is human — not enough specialists, not enough time, not enough context shared across teams. EmberAI is an attempt to compress that context into something a machine can surface on demand.
Dragos has spent more than a decade building the intelligence base that feeds the assistant. The company tracks adversaries, responds to incidents, and catalogs vulnerabilities.
EmberAI draws on all of that. It is not a chatbot bolted onto a generic model. It is a purpose-built tool for a specific, high-stakes domain.
The OT security skills gap is not going away. Training enough specialists takes years.
Critical infrastructure cannot wait that long. EmberAI is one answer — a narrow one, tied to a single vendor’s platform, but a serious attempt to bridge the gap with software rather than headcount. Whether it works as advertised will depend on how well it handles real-world plant environments.
The data set is large. The need is real. The tool is now live.