I've been tasked with evaluating XDR platforms, specifically for an OT/ICS environment. My team currently uses a mix of tools, and Vision One keeps coming up. So does Nozomi Networks.
I need a practical, hands-on comparison. Not just feature lists, but how they actually work in a real OT setting. For instance:
* How is agent deployment handled on sensitive, often old, OT assets? Is passive network monitoring the primary method for both?
* How do the alerting and dashboards compare for a SOC team that's mostly IT-focused? Is one noticeably more "OT-aware" out of the box?
* What's the integration story like with common PLCs or DCS systems?
Pricing is also a factor, but I'm more concerned about operational fit right now. Has anyone had to choose between these two? What tipped the scale?