Not by default on most platforms, which is exactly the gap Dispel Intelligence closes. Session Forensics and Dynamic Risk Scoring are built into the same remote access session, not a separate tool bolted on after the fact.

MFA is foundational, CIP-005 R2 requires it for Interactive Remote Access, and every credible OT security framework treats it as a baseline control, not optional. But foundational isn’t the same as sufficient: MFA confirms a valid authentication factor was presented, not that the person behind it is who they claim to be, or that their behavior after login stays normal. Phishing and MFA fatigue attacks both succeed by getting a legitimate user to approve a prompt, the factor is real, the moment is compromised. Dynamic Risk Scoring catches what happens next, once MFA has already succeeded and the session is open.

Recurring travel simply becomes part of that user’s behavioral profile over time, the system learns the pattern rather than treating every trip as new.

Secure Remote Access and OT asset visibility are two different disciplines, both are among the SANS ICS 5 Critical Controls, but they answer different questions. Nozomi and Dragos answer “what’s on my network, and how vulnerable is it” (Control 3: ICS Network Visibility and Monitoring). Dispel answers “who is connecting right now, and how risky is this specific session?” (Control 4: Secure Remote Access). Dispel Intelligence doesn’t replace either, it’s the layer that pulls your existing Nozomi or Dragos device risk data directly into the access decision, so a vulnerable or high-criticality asset gets treated differently the moment someone tries to connect to it, not just flagged separately on a dashboard you’d have to cross-reference by hand.

That’s a core use case, not an edge case. Device risk scores, enriched with vulnerability and criticality data from partners like Nozomi Networks and Dragos, are surfaced at every access approval, so an admin can document the rationale for allowing access anyway, creating exactly the audit evidence regulators ask for.

The strongest evaluation criteria map to the SANS Five ICS Critical Controls: does the platform broker Zero Trust access (Control 4) without relying on standing VPN pathways, does it generate session-level evidence for compliance rather than requiring a separate audit process, and does it integrate with your existing OT visibility tools rather than duplicating them. Dispel Intelligence is built around all three, Session Forensics and Dynamic Risk Scoring score every session in real time, evidenced continuously, layered on top of the asset visibility you already run.