Rhebo

Rhebo has sustained a decade of continued product investment in OT/IIoT anomaly detection since 2014, evidenced by continued independent operation and technology development in Leipzig through two ownership changes, though a detailed public product roadmap is not independently available.

Rhebo's passive, non-intrusive monitoring architecture is purpose-built for the operational constraints of critical infrastructure (power, water, manufacturing) where active scanning risks downtime, and the retained Leipzig-based management team and technology base through two acquisitions suggests operational continuity rather than disruption.

Being acquired twice in five years (Landis+Gyr in 2021, then Everfield in 2026) is a meaningful strategic-value signal, but neither transaction disclosed pricing beyond a 'low double-digit million USD' figure for the first deal, and no independent customer-growth or revenue figures were found to corroborate broader momentum.

Passive network-traffic baselining for OT anomaly detection is now a well-established approach used by most serious OT security vendors (Dragos, Claroty, Nozomi Networks); Rhebo's contribution is competent execution within an established category rather than a novel technique.

No independent third-party technical evaluation (e.g., a named MITRE ATT&CK for ICS evaluation) of Rhebo's detection engine was found; efficacy evidence rests primarily on the fact that a smart-metering leader (Landis+Gyr) judged the technology valuable enough to acquire and integrate for five years, which is a meaningful but indirect signal rather than a published benchmark.

OT and IIoT visibility remains a critical, underserved need for critical infrastructure operators facing increasing targeting of industrial control systems, keeping non-intrusive anomaly detection directly relevant to utilities and industrial security teams.