Cylera
Healthcare IoT security platform, MedCommand, built exclusively for hospitals rather than adapted from a general IoT product, covering connected medical devices, operational technology and traditional IoT. THE TECHNICAL DIFFERENTIATOR IS GENUINELY NOVEL AND RESOLVES THE CENTRAL CONSTRAINT OF THIS CATEGORY. Medical devices are fragile and cannot be actively scanned while in clinical use, because a vulnerability scan can take a device out of service mid-treatment, which is why every competitor relies on passive network monitoring. Passive observation, however, cannot rigorously test for vulnerabilities, only infer them from observed traffic. Cylera's patented Digital Twin approach resolves that tension: it uses network traffic emulation to construct a virtual replica of each medical device, learning its behaviour agentlessly, and then probes the TWIN rather than the live device, enabling out-of-band vulnerability detection without ever touching equipment attached to a patient. Machine learning continuously updates the device and vulnerability knowledge base from multiple sources. The platform also automatically identifies zero-day devices and zero-day protocols, meaning previously unknown equipment appearing on the network is flagged proactively rather than sitting unclassified. Capabilities span asset discovery and real-time inventory across managed and unmanaged devices, vulnerability and risk assessment, segmentation, threat detection, and notably device utilisation and fleet optimisation analytics, which serve biomedical engineering and finance rather than security alone. Targets providers with 150 or more beds and multi-facility networks, unified through a central management console. Integrates with Cisco ISE and TrustSec for segmentation enforcement, with the integration maintained in the standard platform at no additional cost or consulting hours. A UK deployment at Dartford and Gravesham NHS Trust pairs Cylera with The AbedGraham Group's clinical risk analysis platform to quantify device risk in terms of patient safety and clinical service impact rather than technical severity alone.
Capability Axes
Graded A on the strength of the Digital Twin mechanism rather than on generic AI claims. Constructing a behavioural replica of each medical device from observed network traffic, accurate enough that probing the replica yields valid vulnerability findings about the real device, is a substantive modelling problem and is patented. Machine learning additionally maintains the device and vulnerability knowledge base from multiple sources, and the platform automatically identifies zero-day devices and protocols, meaning classification generalises to equipment it has never seen rather than matching against a fixed profile library. That last capability is the tell that the models are doing real work: a pure lookup approach cannot classify an unknown device.
Detection, risk assessment and policy-driven protection feeding human decisions, with segmentation enforcement delivered through integrated infrastructure such as Cisco ISE and TrustSec rather than acted on unilaterally, which is the appropriate posture given that automatically isolating a misidentified clinical device is a patient safety event. The Digital Twin design is itself an oversight-conscious choice, since probing an emulation rather than live equipment removes the risk of the security tool causing the outage it exists to prevent. Graded B rather than A because no explicit statement of the human approval boundary before enforcement was located, unlike Ordr which describes simulating enforcement impact and showing blast radius before any rule changes.
The clearest mechanistic explanation in this category, and it earns the grade by explaining WHY the approach is necessary rather than only what it does. The reasoning chain is fully legible: medical devices cannot be scanned in real time without risking taking them out of service during patient use; passive monitoring alone cannot rigorously detect vulnerabilities; therefore emulate the device from network traffic and probe the emulation out-of-band. The technique is patented, which provides publicly readable technical disclosure. A buyer can evaluate the claim on its logic rather than taking an accuracy figure on trust, which is the opposite of the marketing-language problem the index's category editorial warns about.
The weakest axis and an honest gap. No independent benchmark, KLAS ranking or published performance data was located, and third party Gartner Peer Insights commentary describes Cylera as relatively new to the space, strong on device detection and categorisation but with vulnerability assessment capabilities still maturing. That is a fair and specific limitation from actual users. Named deployments exist, including Dartford and Gravesham NHS Trust serving a population of around 500,000, and partner commentary praises ease of deployment and time to value, but these are references rather than measured outcomes. Against Asimily at KLAS 96.6 and Ordr at 89.4 in the same category, Cylera has no comparable third party score located.
Passive and agentless collection means the platform observes device behaviour and network traffic rather than ingesting clinical content, and the Digital Twin architecture strengthens this further by moving active testing off the live device entirely. Graded B rather than A because clinical network traffic can carry PHI in protocol payloads, and because traffic emulation implies capturing and reconstructing device communications, which raises a specific question about what is retained in building and maintaining a twin. No published statement on that was located.
No published BAA terms or HIPAA posture statement located at the time of review.
No third party attestation such as SOC 2 Type II or ISO 27001 was retrieved at the time of review. Consistent with every other vendor in this category, none of which publishes one.
Not an FDA regulated product; the platform secures medical devices rather than performing a medical function. The operative constraint is the inverse and is central to this vendor's design: clinical devices cannot be scanned or modified in use without risking service interruption or voiding manufacturer support, which is precisely the problem the Digital Twin approach exists to route around.
No governance framework or model evaluation disclosure located. The relevant risk class is fidelity rather than demographic bias, and it is specific to this architecture: if a Digital Twin does not faithfully replicate the real device, probing it produces findings that do not hold for the physical equipment, generating either false confidence or false alarms. No published validation of twin fidelity against real device behaviour was located, and that is the single most important technical question a buyer should ask this vendor.
The Cisco integration is the standout and is unusually well handled commercially: MedCommand feeds device profiles and policies into Cisco ISE and TrustSec to automate segmentation, the integration is built and maintained within the standard platform at no additional cost, requires no consulting hours, and is described as configurable in seconds. Charging nothing for an integration that competitors treat as professional services revenue is worth noting. Graded B rather than A because Cisco is the only named integration located, where Asimily documents firewall, NAC, SIEM and CMMS connections and Ordr claims broad NAC, SIEM and CMDB coverage.
The safest deployment posture in the category, which is the direct consequence of the Digital Twin design. Fully agentless and passive on the live network, with rigorous vulnerability probing performed against emulated devices out of band, so no scanning traffic ever reaches equipment attached to a patient. Independent commentary credits ease of use, ease of deployment and rapid time to value. Unified central management console supports multi-site networks. No data residency disclosure located, which is the only qualification.
No pricing published; third party listings confirm custom quote only, targeting medium to large enterprise healthcare organisations with 150 or more beds. Consistent with the entire category, where no vendor publishes pricing. The bed-count targeting is at least a useful public signal about intended customer size, which most competitors do not state.
Purpose-built for hospitals and explicit about it, covering medical devices, operational technology and traditional IoT within provider environments, targeted at facilities of 150-plus beds and multi-site networks. The notable breadth is functional rather than sectoral: alongside security, the platform delivers device utilisation and fleet optimisation analytics, so it serves biomedical engineering and capital planning as well as security teams, and the AbedGraham integration extends risk framing into clinical service impact. Graded B rather than A because coverage is confined to healthcare providers, without the cross-industry reach of Asimily or Ordr, though that focus is a deliberate and defensible strategy.
Pricing
Vendor-published figures are labeled as such. Figures labeled “Estimated” are derived from third-party sources and have not been confirmed by the vendor.
| Entry Price | Pricing Basis | BAA Tier | Implementation | Source |
|---|---|---|---|---|
|
Not published
|
Undisclosed, custom quote. Targets providers with 150+ beds and multi-facility networks. Cisco ISE integration included at no extra cost. | — | — | Third Party Estimated |
No pricing published; third party listings confirm custom quote only. The one useful public signal is customer sizing: the platform targets healthcare providers with 150 or more beds and larger multi-facility networks, which is more than most competitors disclose and tells a smaller hospital immediately whether it is in the intended market. Buyers should establish whether pricing scales by bed count, device count or site, since a multi-facility network consolidating onto one central management console may price very differently from single-site deployments. Two considerations specific to this vendor. First, the Cisco ISE and TrustSec integration is explicitly included in the standard platform at no additional cost with no consulting hours required, which is a genuine commercial differentiator worth quantifying against competitors that treat enforcement integration as professional services, and worth confirming covers the customer's actual Cisco estate. Second, the device utilisation and fleet optimisation analytics may justify cost-sharing across budgets, since that capability serves biomedical engineering and capital planning rather than security, and organisations that can attribute part of the spend to avoided device purchases or improved utilisation build a materially stronger business case than a pure security justification allows. Given third party commentary that vulnerability assessment capabilities are still maturing relative to established competitors, buyers should also negotiate on evidence: request the Digital Twin fidelity validation and a proof of value against their own device fleet rather than relying on the architectural argument alone.