Senrio Insight

Short Summary

Senrio is a privately held software company in Portland, Oregon, founded in 2015 by veteran security researchers and former intelligence officers to secure industrial embedded devices in the Industrial Internet of Things (IIoT). Its core premise is that organizations cannot protect devices they cannot first discover and understand. Industrial control systems historically relied on proprietary, isolated technologies and were not built with security in mind, but modernization since the 1990s introduced commodity computing and connectivity to corporate networks, and newer smart sensors now often communicate over the public Internet while lacking basic security features and the ability to run agent-based protection.

Senrio Insight is a lightweight, fully passive IIoT monitoring and analytics platform designed to discover devices, profile their communication patterns, and alert on abnormal behavior without deploying agents or appliances or changing network configurations. A sensor can run on any Linux computer or even a commodity wireless access point, with support for over 700 hardware devices. Instead of deep packet inspection, it captures limited network metadata (including MAC addresses, TCP/IP and Modbus metadata, and DNS traffic) to identify device makers/models, map communications, and maintain compliance in regulated environments by avoiding sensitive content capture. Minimal data collection enables a single sensor to monitor tens of thousands of devices, with centralized management of multiple sensors across segments and sites.

Collected metadata is typically pushed to a dedicated public-cloud instance (AWS supported out of the box) for storage, adaptive cloud learning, threat intelligence correlation (including botnet C&C detection), and real-time alerting after an initial training period of hours to days. The console emphasizes tagging, search, visualization, and notifications, with exports (STIX/TAXII, CEF, JSON, CSV), a REST API, and a Splunk app. Key limitations include lack of turnkey MSSP multi-tenant support, AWS-centric deployment, and notification rules that are not yet fine-grained or tag-aware. Pricing for cloud analytics starts at $4,999/year, and Senrio Trace extends monitoring by integrating directly into IoT firmware.

Interesting Facts

• Senrio is a privately held software development company based in Portland, Oregon, USA.
• Senrio was established in 2015 by veteran security researchers and former intelligence officers.
• Senrio Insight operates in a fully passive mode without agents or appliances and without changes to existing network configuration.
• The sensor software can be deployed on any Linux computer or a commodity wireless access point.
• The company supports over 700 popular hardware devices for sensor deployment.
• Senrio Insight does not perform deep packet inspection and instead uses MAC addresses, TCP/IP and Modbus metadata, and DNS traffic.
• A single network sensor can track tens of thousands of devices due to minimal metadata collection.
• The cloud service supported out of the box is AWS.
• The initial behavior-training period can take from hours to a couple of days depending on traffic volume.
• Pricing for the cloud-based analytics platform starts at $4,999 per year and includes one free sensor appliance plus unlimited software sensors.

Notable Quotes

• “you cannot protect what you do not know”
• “Industrial control systems have been a very separate area of information technology”
• “were never designed with security in mind.”
• “IoT devices are everywhere, with their numbers already in billions and growing at a staggering rate.”
• “Traditional IT security tools have long been frowned upon by OT engineers”
• “operate in a completely passive mode, without agents or appliances.”
• “the solution does not perform deep packet inspection”
• “These attributes alone are sufficient to discover IIoT devices present on the network”
• “the notifications list”
• “notification rules are not yet fine-grained enough”