Mitsubishi Electric has developed an operational technology security solution intended to place threat detection within industrial equipment while connecting individual devices to wider factory monitoring systems. The company plans to launch the technology commercially during the financial year ending in March 2028, rather than supplying it as a generally available product today.
The development draws on Nozomi Networks, which became a wholly owned Mitsubishi Electric subsidiary in January 2026. It uses the monitoring capabilities of Nozomi Arc, a host-based security sensor, and is designed to integrate them into industrial products, including Mitsubishi Electric controllers. The first product incorporating the solution is due to appear as a reference exhibit at JIMTOF 2026 in Tokyo from 26 to 31 October.
Mitsubishi Electric identified USB monitoring, malware detection, quarantine and removal, and software management among the functions planned for the new system. The company also intends to connect equipment-level observations to Nozomi’s operational technology and industrial internet of things visibility and threat detection products. This would allow events originating within a device to be considered alongside communications and behaviour elsewhere in a facility.
Industrial security teams frequently have to protect installations containing controllers, drives, operator interfaces, engineering workstations and other equipment installed over many years. Such systems exchange information to control machinery and industrial processes, but devices may have different software, vendor support arrangements and practical restrictions on maintenance. Production requirements can limit the opportunities to stop equipment for updates or intrusive checks.
A network monitoring system can observe communications between connected devices and identify traffic that deviates from established patterns. It does not necessarily provide a complete view of activity that originates on an individual machine. Files introduced through removable media, local configuration changes or activity that produces little network traffic may require monitoring closer to the equipment itself.
Integrating a host-based sensor into a controller or other supported industrial device provides a possible route to that additional visibility. The sensor can examine selected local activity while sending relevant observations to systems responsible for wider monitoring and incident investigation. The type and depth of information available will depend on the final device implementation, supported software and operating permissions.
Removable media is a particular concern where technicians use USB devices to transfer configuration files, diagnostics or software into equipment that is not routinely connected to external networks. Monitoring USB activity can help identify suspicious files or unexpected changes before they affect other devices. Mitsubishi Electric has not stated that removable media will be prohibited or specified the file types inspected on each supported platform.
Malware detection and quarantine add a further operational consideration. In an office computing environment, isolating a compromised application may be inconvenient but manageable. In industrial automation, interrupting a process at the wrong moment could affect production continuity or equipment behaviour. Protective actions must therefore be evaluated against the operational and safety requirements of the particular installation.
Mitsubishi Electric has not published detection rates, processing overhead, supported controller models or the specific response rules available to operators. Those details will be relevant when industrial users assess whether protection can be introduced without compromising control performance. A reference demonstration will establish the intended functionality more clearly, but will not amount to independent validation across operating factories.
The proposed connection with Nozomi’s broader systems addresses another practical problem: a single device alert may have little meaning without an understanding of the equipment’s role in production. An unexpected controller configuration change, for example, may be related to authorised maintenance, a production adjustment or unauthorised activity. Reviewing the event against asset information and network communications can support the investigation, although it cannot automatically determine the cause in every case.
Centralised visibility also depends on reliable identification of industrial assets. Engineers need to establish which systems communicate with one another, how they are configured and what normal operation looks like. Incorrect inventory records or incomplete communications data can obscure the relationship between an alert and the underlying manufacturing process.
The acquisition of Nozomi Networks gave Mitsubishi Electric direct access to established industrial threat detection technology. The October development marks a move towards incorporating that technology in equipment rather than treating security monitoring exclusively as an additional network service. The company intends to extend its application across a wider range of Mitsubishi Electric products and make it available to machinery manufacturers.
European cybersecurity regulation is providing a further incentive for equipment suppliers to review product security. The Cyber Resilience Act creates requirements for products with digital elements, with its main provisions applying from December 2027 and certain obligations beginning earlier. Applicability depends on the particular product and its regulatory treatment; adopting a security sensor alone does not demonstrate legal compliance.
Mitsubishi Electric also proposes future integration with its Serendie digital platform, allowing equipment data to contribute to security analysis and wider operational applications. That integration was described as a plan, not an existing capability in a deployed customer installation.
The first reference product at JIMTOF will provide a nearer-term opportunity to examine the design. Commercial adoption remains dependent on supported hardware, practical deployment arrangements and evidence that local monitoring can be introduced without interrupting the industrial processes it is intended to protect.
