How do you calculate OT monitoring sensor density?

Divide the monitoring demand (zones or segments to cover) by your target utilization to get the required sensor load, then subtract installed capacity to find the gap. The tool reports a total load figure of 1,470 from the default inputs at the configured scaling, which you compare against available capacity.

What is a good target sensor utilization for OT monitoring?

Most teams size passive OT sensors to 70-80% of rated capacity so there is headroom for traffic spikes during incidents or maintenance windows. Running sensors at 100% risks dropped packets and missed detections exactly when traffic surges.

Why divide by utilization instead of just counting segments?

Sizing to a utilization target builds in headroom. If you need to cover 42 segments and want sensors at 80% load, you provision for more than 42 segments' worth of capacity so no sensor is maxed out under normal conditions.

What does a capacity gap mean here?

A positive gap means your installed sensors cannot cover all zones at the target utilization, leaving segments either unmonitored or running sensors over the safe ceiling. Close it by adding sensors or re-architecting span/tap points.

How does this relate to the Purdue model?

Each Purdue level and zone boundary is a monitoring point. The demand input should reflect every segment you need east-west and north-south visibility into, so the calculation drives full-coverage sensor placement.

Can one sensor cover multiple segments?

Yes, via multiple SPAN ports or taps, but each added segment consumes capacity. That is why the utilization target matters - it caps how many segments you load onto a single sensor before provisioning another.

Industrial Cybersecurity & OT Risk calculator

OT Monitoring Sensor Density Calculator

OT Monitoring Sensor Density sizes how many network-monitoring sensors a plant needs to keep visibility across its OT zones without running any single sensor past a safe utilization ceiling. ICS network architects and OT SOC leads use it when rolling out passive monitoring platforms like Nozomi, Claroty, or Dragos, where each sensor can only inspect so many segments or so much traffic before it drops packets and loses detections. By dividing monitoring demand by a target utilization and comparing against installed capacity, it exposes the coverage gap that leaves blind spots between zones. It matters because an unmonitored Purdue-model segment is exactly where an intruder wants to live undetected.

What this calculator does

Estimate OT monitoring sensor or collector density required for network zones and compare it with available monitoring capacity.
Use it when planning passive network monitoring coverage for zones, conduits, switches, and critical assets.
It computes the required monitoring sensor load at your target utilization and the gap between that requirement and your installed sensor capacity.

Formula used

Required OT monitoring sensor load = monitoring demand in zones or segments ÷ target sensor utilization
OT monitoring sensor capacity gap = required load - available monitoring sensor capacity

Inputs explained

Network zones or segments needing monitoring:
Monitoring sensor capacity available:
Target sensor utilization:

How to use the result

Use it when planning or expanding OT network monitoring coverage, validating that a deployment leaves no segment unwatched at safe sensor loading.
Segment count is a coarse proxy for sensor strain - actual load depends on traffic volume, protocol mix, and packet rates, so a high-throughput segment may demand more sensor capacity than the count suggests.

Current U.S. benchmarks

As of May 2026, U.S. manufacturing runs at 75.6% of capacity (Federal Reserve via FRED), up 0.2 points from a year earlier. Enter your own plant's utilization; the national figure is a reference point for how loaded the industry is.

Common questions

How do you calculate OT monitoring sensor density? Divide the monitoring demand (zones or segments to cover) by your target utilization to get the required sensor load, then subtract installed capacity to find the gap. The tool reports a total load figure of 1,470 from the default inputs at the configured scaling, which you compare against available capacity.
What is a good target sensor utilization for OT monitoring? Most teams size passive OT sensors to 70-80% of rated capacity so there is headroom for traffic spikes during incidents or maintenance windows. Running sensors at 100% risks dropped packets and missed detections exactly when traffic surges.
Why divide by utilization instead of just counting segments? Sizing to a utilization target builds in headroom. If you need to cover 42 segments and want sensors at 80% load, you provision for more than 42 segments' worth of capacity so no sensor is maxed out under normal conditions.
What does a capacity gap mean here? A positive gap means your installed sensors cannot cover all zones at the target utilization, leaving segments either unmonitored or running sensors over the safe ceiling. Close it by adding sensors or re-architecting span/tap points.
How does this relate to the Purdue model? Each Purdue level and zone boundary is a monitoring point. The demand input should reflect every segment you need east-west and north-south visibility into, so the calculation drives full-coverage sensor placement.

Last reviewed 2026-05-12.