Claroty

What is Claroty?

Claroty is a US-Israeli cybersecurity vendor for cyber-physical systems (CPS) whose platform maps industrial networks, exposes vulnerabilities, detects attacks and secures remote access to OT environments. The company focuses on industrial control systems, building management and medical devices: environments where an ordinary IT scanner can cause outages and where patching is often only possible months later. Within OT convergence, Claroty is one of the best-known platforms alongside Nozomi, Dragos and Tenable OT.

🧠 Who is Claroty and where does the company come from?

Claroty was founded in 2015 by Amir Zilberstein, Galina Antova and Benny Porat. The company came out of the Israeli cybersecurity incubator Team8 and is headquartered in New York, with much of its development in Israel. In 2016 Claroty emerged from stealth mode with 32 million dollars in initial funding.

The list of investors stands out. Besides venture capital (including SoftBank, Bessemer and Team8), automation vendors such as Siemens, Rockwell Automation and Schneider Electric invested as well. Those strategic ties show in the close technical cooperation with these manufacturers, for example in parsing their proprietary protocols.

According to the company, Claroty has more than 1,300 customers worldwide. Its research team Team82 discloses vulnerabilities in industrial products and analyses OT malware.

🔧 Which products and modules does Claroty offer?

Claroty bundles its functions in the xDome platform, with modules for asset inventory, exposure management, network protection, secure access and threat detection. Depending on your data storage requirements, you choose between a cloud and an on-premises variant.

Claroty uses its own term XIoT (Extended Internet of Things) for the combination of industrial controllers, IoT devices, building management systems and medical equipment that the platform monitors.

🔎 How does Claroty discover assets without disrupting production?

Asset Discovery is the starting point of every Claroty deployment. Many organisations lack a complete overview of their PLCs, HMIs, SCADA servers, engineering stations, sensors and industrial switches. Claroty therefore combines several methods:

Passive monitoring remains the core, because active scanning is risky in OT: a port scan can hang an older PLC or trip a safety system. A purely passive sensor, however, never sees a device that never communicates. Safe queries close that gap, but always schedule them together with the person responsible for the process.

The platform recognises, among others, Modbus, Modbus TCP, IP, DNP3, OPC UA, BACnet, S7 and ProfiNET. The same applies to DCS environments from vendors such as ABB and Siemens. For each asset it records vendor, model, firmware version, protocols, communication relationships and known vulnerabilities.

🌐 Where do you place Claroty in the Purdue Model?

A common mistake is to assume that monitoring belongs “above” the control layer. In reality, the sensor must see traffic where it originates: on the level 1 and level 2 switches of the Purdue Model, in the control network and the supervisory network. The sensor only listens and sends nothing back into the process network.

This keeps the OT network separated while the IT security team still receives the alerts. The level structure follows ISA-95, on which the Purdue Model is based.

⚠️ How does Claroty detect threats?

Claroty builds a baseline of normal communication for each network and flags deviations through anomaly detection, signatures and threat intelligence from Team82. Detections are mapped to MITRE ATT&CK for ICS, so an analyst can see which stage of an attack an alert belongs to.

Alerts go to a SIEM, SOAR or XDR platform and to ticketing. Claroty thus acts as NDR for OT and as a sensor for an OT SOC. It remains a network-based IDS, not a host-based one: endpoint protection needs additional measures.

🔐 How does Claroty secure remote access?

Vendors and system integrators regularly need access to PLCs and SCADA systems. Poorly secured remote access is one of the most common entry points in OT incidents. xDome Secure Access replaces scattered VPNs and TeamViewer-style tools with a single controlled access point.

This fits the requirements for managed access in IEC 62443 and a jump server architecture in the IDMZ.

🛡️ How does Claroty help with vulnerabilities?

In OT you cannot always patch: an update needs a downtime window, vendor validation and sometimes recertification. Claroty therefore links every asset to known CVEs and weighs them using CVSS, listing in the KEV catalogue of CISA, reachability from other zones and process impact. The result is a short list of what really comes first.

Where patching is not possible, the platform suggests compensating controls, such as tighter firewall rules or segmentation. This supports vulnerability management and lifecycle management: end-of-life systems and outdated firmware become visible for migration planning.

Team82 provides the research foundation. Its vulnerability disclosure dashboard lists more than 750 disclosures, including flaws in OPC UA stacks and in Kepware, and in December 2024 the team described the IOCONTROL malware of CyberAv3ngers.

🔄 How does Claroty compare with Nozomi, Dragos and Tenable OT?

The four well-known OT platforms overlap considerably: all four combine passive monitoring with controlled active queries. The differences lie mainly in emphasis and coverage.

The right choice depends on your existing SOC, scalability across many sites, whether data may leave the site, and how far you also want to cover building management or medical devices.

🏭 How do you approach a Claroty deployment in practice?

For Dutch organisations covered by the Cybersecurity Act (the Cyberbeveiligingswet, in force since 15 August 2026 as the Dutch implementation of NIS2), an up-to-date overview of OT assets and risks is no longer optional. A common approach:

1. Define the scope - choose sites and zones, for example starting with the treatment plant with the most external connections.
2. Plan the mirror ports - check whether switches support SPAN without overload; on busy or older switches a TAP is more reliable. Neither adds latency to process traffic, but an overloaded SPAN port drops packets and then gives an incomplete picture.
3. Choose cloud or on-premises - xDome requires an outbound connection through the IDMZ, CTD stays entirely local.
4. Let the baseline learn - give the platform a few weeks to record normal behaviour before you tune alerts strictly.
5. Validate the inventory - compare with drawings and a physical walkdown; record deviations in your risk management.
6. Connect it to processes - send alerts to the SIEM and SOC, and agree who decides on an OT alert.

For compliance and continuous monitoring, the platform provides evidence for IEC 62443, NIST SP 800-82, NIST CSF and ISO 27001, and supports defence in depth and the zones and conduits model. Manufacturers that build their own products also use the inventory to determine which components fall under the Cyber Resilience Act.

❓ Frequently asked questions

Is Claroty an IDS or a firewall?

Claroty is not a firewall, because it does not block traffic itself. The platform acts as a passive network IDS or NDR for OT, extended with asset inventory, vulnerability management and secure remote access.

What is the difference between Claroty xDome and CTD?

Claroty xDome is the cloud-based SaaS platform, whereas Continuous Threat Detection (CTD) runs entirely on-premises. CTD suits organisations that may not send OT data to the cloud or that operate networks without internet access.

Does Claroty disrupt the production process?

Claroty primarily works passively via SPAN ports or TAPs and then sends no traffic into the process network. Only the optional safe queries contact devices actively, using read-only requests in their own protocol, and you schedule those together with operations.

Is Claroty also suitable for hospitals?

Yes, through xDome for Healthcare, which stems from the Medigate acquisition of 2021-2022. With it, Claroty inventories medical equipment such as infusion pumps and imaging systems and links them to vulnerabilities and usage data.

What is Claroty Team82?

Team82 is Claroty’s research unit that looks for vulnerabilities in industrial and IoT products and reports them to manufacturers through coordinated disclosure. The team has published more than 750 vulnerabilities and analyses OT malware such as IOCONTROL.

Does Claroty help with the Dutch Cybersecurity Act?

Claroty delivers the asset inventory, risk analysis and detection that the duty of care under the Dutch Cybersecurity Act requires in practice. The platform does not replace policy, governance or the incident reporting procedure, however: those remain the organisation’s own responsibility.

📌 In summary

Claroty is an OT and CPS security platform that maps industrial, building and medical networks passively and through safe queries, prioritises vulnerabilities, detects attacks and secures remote access. You choose between xDome in the cloud and CTD on-premises; the value only appears when sensors sit on the right switches and alerts land in your SOC processes.