Cylera

Models support detection and prioritization inside a wider platform. Cylera says its platform is powered by machine learning insights, applies machine learning to threat prioritization and alert reduction, and uses network traffic emulation to build virtual stand-ins for devices so they can be probed without touching the real equipment. Asset discovery and inventory, the segmentation policy generator, device utilization analytics, compliance reporting and its NAC, SIEM and CMMS integrations would still stand without the models.

Automation is described and the approval step is not. The segmentation policy generator writes rules, auto-enrolls new IoT devices into policy and monitors it, with enforcement through NAC and firewall integrations such as Cisco ISE; probing is done against emulated devices rather than live ones. Nothing published says which policy changes wait for a person, how auto-enrollment of a misidentified clinical device is caught, or how a change is rolled back.

The approach is explained, and the models behind it are not. Cylera explains why it emulates devices: fragile medical equipment cannot be actively scanned in use, passive monitoring alone cannot test for vulnerabilities, so the platform builds virtual stand-ins from traffic and probes those, extracting context from known and unknown protocols without depending on protocol decoder libraries. Machine learning drives prioritization and alert reduction. No model, training data, version or accuracy figure is published.

The architecture is described and no party is named. Collection, emulation and machine learning are described as Cylera's own, but no hosting provider, model provider or subprocessor list is published, and nothing states where captured traffic and device emulations are kept.

Named customers without published results. St. Luke's University Health Network's CISO is quoted, case studies are listed for RWJBarnabas Health, St. Luke's and Morecambe Bay (behind download forms), the American Hospital Association selected Cylera as a preferred cybersecurity provider in April 2021, and an analyst SPARK Matrix report is offered. The home page lists improvements in discovery, risk score accuracy and alert workload without a figure.

Nothing published on how customer data moves through the product. Collection is agentless and passive, and building an emulated device means capturing and reconstructing its network communications, but no page states what traffic is retained, for how long, where it is stored, whether PHI in device payloads is handled, or whether one hospital's data informs emulations or models for others. The privacy statements cover website visitors only.

No statement of status and no privacy document that reaches the product. Cylera publishes HIPAA and UK Data Security and Protection Toolkit material about customers' own compliance, but no page states business associate status, offers an agreement, or says the platform does not handle PHI, and the US privacy statement and terms of use cover the website only. Clinical network traffic can carry PHI.

No independent assurance is offered. The site has no trust center, security page or certification claim, and no SOC 2 or ISO 27001 statement from the company appears elsewhere. The product holds a map of every connected device in a hospital and emulations of how they communicate, and no penetration test results are published either.

No device claim, with healthcare compliance work named. The platform is security software without a clearance and needs none. Cylera publishes separate US and UK healthcare compliance pages, supports the NHS Data Security and Protection Toolkit, and was selected by the American Hospital Association as a preferred provider in 2021; nothing addresses FDA device recalls or manufacturer disclosure statements, and no page states its own regulatory position.

Nothing evaluates the models. Machine learning alert reduction and risk scoring are presented as core capabilities, and the site calls the platform the most accurate available, but no accuracy, precision, false negative rate or governance framework is published, and nothing says whether one customer's device data informs models used for others. Alert reduction without a false negative rate cannot be judged on safety grounds.

The company says nothing about what happens when the system is wrong. It gives no detection or false positive rate and no measure of how faithfully an emulated device matches the real one. Generated policies come with no described review before commit step or audit trail, and there is no warranty, indemnity or remediation commitment; the only terms published cover the website and disclaim accuracy. The vulnerability findings rest on the emulation, yet how its fidelity is validated, and for which device classes it works poorly, goes undescribed.

It does not connect to the clinical record; its integrations with the hospital's security and clinical engineering systems are named without production evidence. Integration pages and solution briefs cover Cisco ISE, Prime and DNA Center, Aruba ClearPass, Extreme NAC, Forescout, Illumio, Check Point, SonicWall, Microsoft Sentinel, Google Chronicle, IBM QRadar, Splunk, Rapid7 InsightVM, ServiceNow, Nuvolo and Integra e-Quip. No named hospital is shown running a two-way CMMS integration.

Nothing published about where the system runs or where the data rests. The platform is described as agentless and passive, with probing done against emulated devices and a central console for multi-site networks, but no page says whether it is cloud hosted or on premises, which provider or region holds customer data, or how tenants are separated.

No price is published, and the sales route is discoverable. The platform is sold through demos, a product tour and channel partners in North America, the UK and Europe. No unit of charge or tier is published.

Healthcare settings are named, with results behind download forms. The platform covers medical devices, OT and IoT for hospitals and health networks in North America and Europe, with roles for biomedical engineering, IT and security, and it now also sells to finance, higher education, transportation, manufacturing and energy. Named hospital customers (St. Luke's, RWJBarnabas, Morecambe Bay, Dartford and Gravesham NHS Trust) appear in quotes and gated case studies.