CyberDragon.ai correlates telemetry from enterprise IT and industrial OT into one compliance-ready operations loop — with hybrid post-quantum identity, OT policy compliance reporting, and multi-tenant architecture built for regulated enterprises.
| Capability | CyberDragon.ai | Generic SIEM | OT Monitor Only |
|---|---|---|---|
| Native OT protocol parsing (Modbus, DNP3) | ✔ Passive Edge | ✗ | ✔ |
| Hybrid post-quantum identity (ML-DSA-65) | ✔ Live today | ✗ | ✗ |
| Risk-chain correlation (MITRE ATT&CK + ICS) | ✔ Cascading W15/W60/W24 | ✔ Partial | ✗ |
| OT policy compliance reporting on automated workflows | ✔ OPA enforced | ✗ | ✗ |
| Multi-tenant MSSP architecture (DB-level RLS) | ✔ PostgreSQL RLS | ✗ Logical only | ✗ |
| Tamper-evident hash-chained evidence vault | ✔ SHA chain per tenant | ✗ Log retention only | ✗ |
| Unified IT/OT risk & compliance dashboard | ✔ Single platform | ✗ IT-focused | ✔ OT-only scope |
| Air-gapped deployment (no internet required) | ✔ | ✗ | ✔ Partial |
| Built-in framework evidence mapping (IEC 62443, NERC CIP) | ✔ Per-control evidence mapping | ✗ Rules only | ✗ |
| FAIR risk scoring with Kafka real-time delta | ✔ | ✗ | ✗ |
“We evaluated three SIEM vendors and two OT-specific platforms before selecting CyberDragon.ai. The difference was immediate: our first OT anomaly scenario was correlated into a six-stage risk-chain incident in under fifteen seconds, with MITRE ICS techniques mapped on the timeline. The OPA policy checks gave our plant managers confidence that every reporting workflow is documented against OT safety policy before it is marked complete — that was the decision point for our board.”
“Passive Edge collection was non-negotiable for us — we cannot install agents on safety instrumented systems. CyberDragon.ai Edge deployed in two days across three substations with zero network impact. When we lost WAN connectivity during a maintenance window, the SQLite buffer held five thousand events and replayed automatically. Our OT team finally has visibility without compromising safety.”
“Managing twelve industrial clients on separate SIEM instances was unsustainable. CyberDragon.ai's MSSP portal gives us cross-tenant incident visibility with database-level isolation we can demonstrate to auditors. Per-tenant compliance tracking against IEC 62443 means we deliver audit-ready reports without manual spreadsheet work. Our analysts handle three times the client portfolio with the same headcount.”
“Our compliance team used to spend weeks assembling IEC 62443 evidence from three different tools. CyberDragon.ai links every incident artifact to specific control IDs in the hash-chained vault — auditors get a verified chain export in minutes, not months. Detection, risk, and compliance finally share one source of truth.”
CyberDragon.ai charges on value delivered: base platform fee + per-asset usage + low-cost Edge collectors to maximize telemetry coverage and reduce network blind spots.
Cancel anytime · ISA-62443-aligned · Save 17% on annual billing
7-day trial window · 1 Edge collector included · Credentials emailed instantly
Cancel anytime · Cancellation policy
Base platform fee billed monthly (USD)
Usage limits
Cancel anytime · Cancellation policy
Base platform fee billed monthly (USD)
Usage limits
Cancel anytime · Cancellation policy
A 300-asset industrial facility with 5 Edge collectors:
| Standard | Premium | |
|---|---|---|
| Platform fee | $11,760/yr | $23,760/yr |
| Asset overage | 275 × $144/yr = $39,600 | 200 × $432/yr = $86,400 |
| Edge collector overage | 3 × $144/yr = $432 | Included (5 collectors covered) |
| Total/year | ~$51,792 | ~$110,160 |
Same category, transparent economics. See how CyberDragon.ai's asset-based pricing compares to platforms using per-site or opaque enterprise pricing.
| Metric | CyberDragon.ai | Dragos | Claroty | MS Defender for IoT |
|---|---|---|---|---|
| Charging basis | Per monitored asset + platform fee | Per site / SiteStore | Per protected asset + modules | Per site or per device |
| Entry price | $980/mo (Standard) | ~$10,000/yr entry tier | From ~$150,000/yr | $70–$400+/site/mo |
| 300-asset example (annualized) | ~$51,792–$110,160/yr | Not publicly disclosed at this scale | $150K–$1M+/yr | Requires M365 E5 / Defender P2 |
| Native OT protocol parsing | ✓ | ✓ | ✓ | Partial |
| Post-quantum identity (ML-DSA-65) | ✓ Live today | ✗ | ✗ | ✗ |
| Air-gapped, no outbound internet | ✓ | Partial | Partial | ✗ |
| MSSP multi-tenant portal | Built-in | Partner program | Partner program | Varies by tenant |
| Deployment model | SaaS, Private Cloud, or Air-Gap | On-prem / hybrid | On-prem / hybrid / cloud | Cloud-connected deployment |
Competitor information based on publicly available data as of July 2026; actual capabilities vary by vendor and deployment. All trademarks are property of their respective owners. Pricing figures reflect published entry tiers and industry estimates where per-asset rates are not disclosed; actual enterprise contract pricing varies by deployment size.
A traditional SIEM aggregates logs and applies correlation rules — often producing high alert volume with limited OT context. CyberDragon.ai is a converged IT/OT/IoT continuity platform: passive Edge collectors parse industrial protocols natively, a risk-chain correlator reconstructs multi-stage campaigns across cascading time windows, TI fusion enriches every event in-flight, and OPA policy checks flag every reporting workflow for OT safety review. It is designed for Purdue-segmented environments, not retrofitted from enterprise log management.
No. CyberDragon.ai Edge operates as a passive collector using Scapy/libpcap packet capture on a SPAN/mirror port or network tap. It does not install software on PLCs, HMIs, RTUs, or safety instrumented systems. Edge parses Modbus TCP, DNP3, and OPC-UA from captured traffic and forwards normalized events to Core. This passive-first design is a core architectural principle.
CyberDragon.ai supports fully air-gapped deployment via pre-built container image bundles and offline risk-intelligence feed packages. Edge collectors buffer events in a local SQLite queue (5,000-event capacity) and synchronize with Core during controlled transfer windows. No outbound internet connectivity is required for detection, response, compliance, or evidence vault operation.
It means your authentication tokens are signed with both classical (Ed25519) and post-quantum (ML-DSA-65, NIST FIPS 204 / CRYSTALS-Dilithium) algorithms today — not in a future product release. Every analyst login, API call, and Edge-to-Core transport handshake uses hybrid PQC JWTs with Vault-backed key management. If a cryptographically relevant quantum computer emerges, your identity layer retains a quantum-resistant signature path. No migration project required — it is the default token format.
CyberDragon.ai supports evidence mapping for IEC 62443-3-3, NIST CSF 2.0, ISO/IEC 27001:2022, and NERC CIP — with per-control evidence linking, gap analysis, and audit-ready PDF export. Frameworks are installed per tenant via API. This helps teams align operations with framework controls; it is not a certification that your environment meets any framework. Evidence vault entries and incident artifacts are linked to specific control IDs with hash-chained integrity.
Yes. CyberDragon.ai's multi-tenant architecture is MSSP-native: PostgreSQL row-level isolation enforces tenant isolation at the database level, and the MSSP Operator role provides cross-tenant incident visibility, portfolio health dashboards, and read-only evidence access across managed customers. Your MSSP operates the service desk; you retain tenant-admin control over users, compliance frameworks, and data sovereignty. MSSP operators cannot write evidence cross-tenant — isolation is enforced by policy and tested in regression suites.
Free Trial is $0 for 7 days with 1 Edge collector. Standard is $980/mo platform fee (includes 25 assets + 2 collectors) with $12/asset/mo and $12/collector/mo overages. Premium is $1,980/mo (includes 100 assets + 5 collectors). A 300-asset deployment with 5 collectors runs about $51,792–$110,160/yr. Annual platform billing saves 17%. Online signup supports up to 50 Edge collectors; contact our solutions team for larger deployments.
SaaS tenants are provisioned in days with immediate analyst UI access. A proof-of-value deployment with one Edge collector typically completes within two to four weeks, including passive tap installation, Edge configuration, and Core tenant setup. Full on-premises or air-gapped deployments with multiple Edge sites require four to twelve weeks depending on infrastructure readiness and compliance review cycles. Contact Axix for deployment SLAs specific to your model.
Yes. You can cancel anytime from your account or by contacting support. There are no lock-in contracts or cancellation fees on self-serve plans. Access continues through the end of your current billing period.
We accept major credit and debit cards (Visa, Mastercard, Amex) through Paddle, our authorized payment provider and Merchant of Record where applicable. Card details are entered only in the secure Paddle checkout and are not stored on Axix servers.
Yes. After each successful payment you receive a receipt/invoice from Paddle for your records. Contact support if your organization needs a tax invoice or additional billing documentation.
Yes. Paid plans renew automatically at the end of each billing period (monthly or annual) until you cancel. Cancel or change your plan before the next renewal to avoid being charged for a new period.
When your IT, OT, and IIoT environments share a converged risk surface, you need a continuity platform that speaks every protocol, correlates every stage, documents every exposure, and reports on every automated workflow — with cryptography built for the next decade, not the last one.
