Phosphorus Cybersecurity

Phosphorus Cybersecurity Inc. is a Nashville, Tennessee-based provider of security and management software for the extended Internet of Things (xIoT) — the combined population of IoT, OT, IIoT, and Internet of Medical Things (IoMT) devices in enterprise environments. The platform discovers and classifies connected devices, assesses and prioritizes their vulnerabilities, and then performs remediation actions directly on the devices: rotating default and weak passwords, upgrading or downgrading firmware, managing and renewing certificates, disabling unnecessary network services such as Telnet or FTP, monitoring for device drift, and retrieving device logs for analysis. A prohibited-device capability discovers and remotely disables equipment banned under U.S. NDAA Section 889, including Huawei, Dahua, Hikvision, ZTE, and Hytera hardware and devices running their OEM firmware.

The company positions the product as going beyond visibility-only tooling by acting on devices in their native protocols. Deployment is agentless and does not require SPAN ports, TAPs, packet brokers, or network re-architecture; it can run on-premises as a virtual appliance, in AWS, Azure, or GCP, or in hybrid form, with an optional siteManager/zoneWorker component for segmented, DMZ, or air-gapped networks. The company states initial deployment takes hours, first discovery results minutes, and full environment visibility typically the same day. Integrations extend existing security and IT investments, including Check Point, ServiceNow, CyberArk, Axonius, Microsoft Sentinel, Qualys, Forescout, and Milestone XProtect.

Phosphorus serves data centers and colocation, manufacturing and industrial OT/ICS, healthcare, financial services, hospitality and retail, critical infrastructure and energy, and federal and public sector customers, and maps its capabilities to frameworks and directives such as CISA Binding Operational Directive 26-02, CISA Zero Trust guidance, and 33 CFR Part 101 Subpart F. In June 2026 the company announced it had been acquired by and joined Dragos, combining device-level xIoT security with Dragos's OT network security.

Founding story

Phosphorus was founded in 2017 by Chris Rouland, Rebecca Rouland, and Earle Ady. Rouland, who previously founded Endgame and Bastille and established X-Force at IBM, came out of an attempted retirement after his third exit when he encountered a University of Wisconsin research paper analyzing a large-scale IoT-based DDoS attack; the researchers found the average "half-life" for IoT firmware updates was seven years, meaning most connected devices ran vulnerable software long after exploits were known. Early customer engagements revealed a consistent pattern of missing device inventory, widespread default credentials, and unmanaged firmware, certificates, and configurations, leading to a founding premise that organizations cannot secure what they cannot see or fix what they cannot control.

Business model

Phosphorus sells its platform as an annual subscription, with pricing based on the number of devices managed and the features employed. The subscription covers continuous discovery and inventory, risk assessment and enrichment, automated remediation capabilities, and ongoing device support and updates, with support for new device types added over time as part of the subscription.

Recurring annual software subscription revenue, priced by managed device count and feature set.

Traction

The company reports assessing more than one billion enterprise IPs to date and helping customers assess over 50 million new IPs each week, with a device network spanning more than 600 IoT, OT, IIoT, and IoMT manufacturers and over one million unique device models. It reports customers updating firmware 24x more often and rotating passwords 110x more often than in prior years. Phosphorus doubled its workforce in the year preceding its February 2022 Series A and committed to adding 50 new jobs by 2024, mostly in software engineering; a third-party profile lists 125 employees. Published case studies cover healthcare, hospitality, data center, and manufacturing deployments.

Latest developments

On June 1, 2026, Phosphorus announced that it had been acquired by and joined Dragos, with the stated aim of pairing device-level xIoT security with Dragos's OT network security across the full xOT environment. Earlier in 2026 the company introduced the Phosphorus xIoT Compliance Report, which shifts compliance from documentation to enforceable device-level evidence, published guidance mapping its platform to CISA Binding Operational Directive 26-02 on unsupported edge devices, and was named a finalist in the SC Awards for both innovation and leadership.