Claroty

Models drive detection and identification inside a wider platform. Claroty xDome for Healthcare flags devices that behave outside learned "known good" patterns alongside signature matches, identifies assets with statistical inference and a retrieval-augmented language model over its CPS Library, and adds Claire, an AI agent that triages alerts, drafts segmentation policy and opens tickets. Discovery, inventory, segmentation enforcement, secure access and device utilization reporting would still stand without the models.

Agentic action is offered and the approval step is left to the customer. Claire is marketed as moving from dashboards to "agentic execution with human-in-the-loop," generating segmentation policies to apply automatically at the firewall or network access control layer and submitting tickets on its own.

The AI Addendum (revised 28 Sep 2026) makes human review of output the customer's obligation and bars use of the AI features to control a medical device or life-sustaining system without that review; nothing published says which Claire actions wait for approval, what can be rolled back, or how actions are logged.

The methods are named without models, versions or evaluation. Detection combines learned behavioral baselines with signatures; asset identification uses statistical inference, human review and a regionalized retrieval-augmented language model over a library built with device manufacturers; Claire runs on what the company calls a CPS language model trained on more than ten years of data from over 20,000 sites. No model, version or accuracy figure is published, and the AI Addendum lets Claroty substitute models or model providers at any time.

Hosts are named and the model provider is not. The public subprocessor list names cloud hosts (AWS, Google Cloud, Azure), Databricks for network data and business tools, with the data each receives and its region. The AI Addendum says AI features may use third-party model providers and bars them from training on customer input or output, but no model provider is named.

Named health systems with dated operational figures, all vendor published. Ohio State University Wexner Medical Center, on xDome since 2021, reports a 70 percent cut in manual inventory time, 60 percent less time on IoMT risk management, a 76 percent rise in CVE remediation in one year against a backlog of 11,000 CVEs, and $13 million in replacement costs identified. University of Rochester Medicine reports 11,000 medical devices found against 4,400 by its previous tool.

KLAS rated Claroty a 2026 Top Performer for Healthcare IoT Security at 92.5 from 35 organizations, a satisfaction measure rather than a detection result. No independent test of detection or identification accuracy is published.

Customer-derived data improves the product, beside firm limits on raw content. The AI Addendum says Claroty will not use a customer's input or output to train generally available foundation models without consent and binds its model providers not to train on them, but it may use Products Data (telemetry, asset, anomaly and vulnerability signatures, de-identified or aggregated) to develop and improve its products, and owns that data; Claire is marketed as trained on data from more than 20,000 deployed sites.

The HIPAA policy (effective 30 Sep 2024) says device traffic may incidentally contain PHI and bars de-identifying PHI for internal use without authorization. No retention period for collected device traffic is published.

Business associate status is stated in a published HIPAA policy; the agreement is not published. Claroty's HIPAA Privacy Rule policy (effective 30 Sep 2024, a downloadable document on the trust center) says it maintains a business associate agreement with each applicable covered entity, uses PHI only for the contracted services, returns or destroys it at termination, and discloses it to subcontractors only under their own business associate agreements; the policy says collected device data may incidentally contain PHI. The agreement text and its tier are not published.

Certifications are named with type and version and several can be opened without asking. The trust center lists SOC 2 Type 2 across all five trust services criteria, ISO/IEC 27001:2022 (certificate 1707260-1 from Schellman, issued 17 Feb 2026, expiring 25 Feb 2028, scoped to the ISMS supporting development, sales and support of its security solutions), ISO/IEC 27701:2019, BSI C5 and a CSA STAR registry listing, with the ISO certificates as direct downloads. The SOC 2 report and recent penetration test results are available under NDA, and a product security team publishes a vulnerability disclosure dashboard.

No device claim, and the intended purpose is stated in contract. The platform is security software with no clearance and none required. The AI Addendum says its AI features are not for medical diagnosis or treatment and not to be used as a safety component of, or to control, a medical device or life-sustaining system without human review, and it sets Claroty as provider and the customer as deployer under the EU AI Act. The company also runs coordinated vulnerability disclosure with device manufacturers.

Governance is contractual, with no evaluation behind it. The AI Addendum allocates EU AI Act roles (Claroty as provider, the customer as deployer), lists prohibited uses, promises the technical documentation customers need for their own obligations, and allows one written governance questionnaire a year. No evaluation of detection, asset identification or Claire's output is published, and no performance is reported across device types, manufacturers or network segments.

A warranty that the features work as documented, with nothing attached to any output. The AI Addendum warrants that the AI features are provided with reasonable skill and care and as documented, with correction or termination and a pro rata refund as the remedy, so a customer can challenge features that do not behave as described. That is a promise about the product working, not about a classification, a risk score or an action being right.

The same addendum disclaims any warranty that output is accurate or that the features will find every vulnerability, threat or asset, and caps beta features at EUR 100. Device intelligence is partly supplied by manufacturers rather than inferred, which a buyer can check by asking which manufacturers participate. No accuracy or false positive figure is published.

It does not connect to the clinical record and needs no such link; its depth is in the security and clinical engineering systems a hospital already runs. The integrations catalog lists connectors built and supported by Claroty for Accruent, in both directions with more than 60 device attributes, Nuvolo on ServiceNow, TRIMEDX, ServiceNow, Splunk, CrowdStrike, Rapid7, Tenable, Cisco, Aruba ClearPass, Check Point, Fortinet and Palo Alto. Parkland Health runs a live connection to its CMMS and University of Rochester Medicine enforces firewall policy from xDome classifications.

SaaS with named hosts and regions, and the healthcare data path partly open. xDome for Healthcare is delivered as SaaS with passive and query-based collectors on site. The public subprocessor list names AWS (PHI, region on request), Google Cloud (PHI, global), Microsoft Azure (US) and Databricks for network data (EU and US), and the security FAQ describes VPC isolation between customers. Where a given hospital's device data rests, and whether it crosses a border, depends on the region chosen and on the global Google Cloud entry.

No price is published, and the sales route is discoverable. xDome for Healthcare is sold as modular SaaS through a demo request and channel partners, with an ROI calculator on the site; no unit of charge, tier or list price is published.

Healthcare delivery settings are named and supported by named deployments. xDome for Healthcare covers medical devices, IoT, facilities and building systems across hospitals and health systems, with case studies at Ohio State Wexner, University of Rochester Medicine, Parkland Health, Yale New Haven, Maastricht UMC+ and NHS South Tees, among others, and a KLAS evaluation drawn from 35 healthcare organizations. Coverage outside hospitals, such as ambulatory or home care networks, is not described.