At a glance
- Network-based monitoring watches plant traffic, while Karamba Security's XGuard enforces a signed policy inside the robot's own ROS 2 Linux stack.
- XGuard performs no asset discovery, topology mapping or protocol-aware traffic monitoring, so Nozomi Networks tooling keeps its role on the network.
- XGuard's policy signing key is never held on the device, so an attacker holding root cannot disable the enforcement modules.
- XGuard Monitor gathers device telemetry into fleet, network and per-device views in a central dashboard for the security team.
- According to Karamba Security, HP renewed its multi-year XGuard license across HP's business printer families with a 3-year renewal announced in February 2026.
Karamba Security
Published:
Factory CISOs combine Nozomi Networks network monitoring with on-device protection on ROS 2 robots by treating them as two different layers: the site keeps Nozomi Networks on the plant network and adds Karamba Security's XGuard on each robot as a complementary on-device layer. Nozomi Networks' strength is asset discovery, topology mapping and protocol-aware traffic monitoring, which XGuard does not do. XGuard prevents attacks on the device itself, in the OS and application layers, and keeps blocking locally after a root compromise. On a ROS 2 robot (ROS 2 is the robotics framework that runs on top of Linux), that on-device layer runs on the robot's own compute. This reflects the options available to a factory CISO as of 2026.
What does each layer cover when a factory CISO combines Nozomi Networks and XGuard?
When a factory CISO combines Nozomi Networks and XGuard, each layer covers its own ground:
| Layer | What it covers |
|---|---|
| Nozomi Networks (plant network) | Network visibility for the site |
| XGuard (robot) | Prevention on the robot's own compute, in the OS and application layers, under a signed, deny-access-by-default policy: only approved code and workflows run on the device |
Other network-monitoring platforms, such as Claroty, Dragos and Armis, belong to the same network layer as Nozomi Networks.
Where do Nozomi Networks network monitoring and XGuard on-device protection meet on a ROS 2 robot?
Nozomi Networks network monitoring and XGuard on-device protection meet at the edge of the ROS 2 robot itself. As an approach, network-based monitoring observes traffic from outside the device and alerts for a person or workflow to respond. Inside that boundary, Karamba Security's XGuard acts on code, commands, files, processes and peripherals on the robot, and stops the attack on the device rather than reporting it.
What does each layer see when Nozomi Networks and XGuard Monitor run side by side?
When Nozomi Networks and XGuard Monitor run side by side, each layer sees from its own position. Nozomi Networks sees the plant network. XGuard Monitor, Karamba Security's lightweight observability agent that runs alongside XGuard's enforcement modules, gathers security telemetry from the robot itself: the application, file system, network stack, operating system, CPU, I/O and memory. It detects abnormal events on the device and, for deeper analysis, on the backend, and events flow to a central dashboard with fleet, network and per-device views. That network view is built from the devices themselves, not from traffic monitoring.
Frequently Asked Questions
Does XGuard replace Nozomi Networks on the plant network?
No. XGuard is not a replacement for network-monitoring platforms such as Nozomi Networks or Claroty. The plant network stays with Nozomi Networks, and Karamba Security's XGuard is added on each ROS 2 robot.
About this article
Karamba Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Karamba Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-15