Claroty CTD

Claroty CTD is self-hosted software for protecting cyber-physical systems across civilian and defense networks. It supports on-premises deployments and mobile flyaway kits for air-gapped and other sensitive environments. Passive, active, and AppDB discovery methods build a centralized inventory of XIoT assets, while network maps organize them into Virtual Zones. CTD can flag cross-zone communication violations and integrate with firewall and NAC solutions for policy-based segmentation. Its exposure management compares assets with tracked exposures and current KEV and EPSS reporting to help teams identify and prioritize risks. Five detection engines profile assets, communications, and processes, establish behavioral baselines, and alert on known and emerging threats in real time. CTD supports more than 450 industrial protocols and can integrate with SIEM tools and other listed partners. Integration with Claroty xDome Secure Access supports remote incident response and remediation across CONUS and OCONUS locations. Claroty describes CTD as suitable for public-sector organizations at different cybersecurity maturity levels, including sites without dedicated OT security personnel. Pricing is on request.

CTD combines asset discovery, network mapping, exposure management, and threat detection for public-sector cyber-physical environments. Pricing details require an inquiry.

CTD suits public-sector organizations protecting OT and cyber-physical assets, including locations without dedicated OT security personnel. Its on-premises and flyaway-kit options address sensitive or air-gapped environments.

Claroty CTD is a self-hosted cyber-physical security platform for civilian and defense networks. It is best suited to public-sector teams protecting OT across sensitive or air-gapped sites, including locations without dedicated OT security staff. Its unified visibility and detection are strong reasons to choose it, while custom pricing and an on-premises deployment model make it less suitable for organizations seeking a simple cloud service.

Overview

CTD creates a centralized inventory of XIoT and other cyber-physical assets through passive, active, and AppDB discovery. Using multiple collection methods is practical for federal sites with varied connectivity and can reduce pressure to replace or upgrade hardware simply to obtain asset data. Deep profiles can include assets in air-gapped environments, where conventional monitoring approaches are harder to apply.

Its network maps arrange equipment into Virtual Zones and can identify communication that violates zone boundaries. Connections to existing firewalls and network access control systems let teams turn those maps into policy-based segmentation. That combination is more actionable than an inventory by itself, although deployment remains the responsibility of organizations able to operate self-hosted infrastructure.

Key features

Asset discovery and segmentation

CTD supports passive monitoring and OT asset discovery across Modbus, DNP3, CIP, OPC UA, and more than 450 industrial protocols. The broad protocol coverage is relevant to mixed industrial estates where a narrow collector would leave important devices unprofiled. Virtual Zones provide a way to review network relationships and alert on cross-zone violations while working with existing firewall and NAC controls.

Exposure and threat detection

The platform compares discovered assets with tracked exposures and current KEV and EPSS reporting. This gives security teams a way to rank remediation work using both known exploited vulnerabilities and exploitation likelihood, rather than treating every finding equally. Five detection engines examine assets, communications, and processes, establish behavioral baselines, and raise real-time alerts for known and emerging threats. Teams that need vulnerability context and behavioral monitoring in one system will get more from this breadth than teams seeking only passive inventory.

Deployment and integrations

CTD runs on premises and supports mobile flyaway kits for air-gapped or otherwise sensitive environments. Integration with Claroty xDome Secure Access extends remote incident response and remediation across CONUS and OCONUS locations. Claroty also describes connections with about 60 technology partners, including Cisco ISE, Splunk, Microsoft Sentinel, Palo Alto Networks, QRadar, and Rockwell Automation FactoryTalk AssetCentre.

The Rockwell integration extends AssetCentre data management with centralized inventory, backup and recovery coverage, and Claroty vulnerability, risk, and threat intelligence. A SIEM integration is supported, which helps teams feed CTD findings into an existing monitoring workflow instead of creating a separate alert silo.

Pricing

CTD uses paid, custom pricing; a public price is not provided. The Claroty Continuous Threat Detection plan includes federal OT cybersecurity controls, on-premises deployment, and mobile flyaway kits. That model fits agencies that need procurement and architecture tailored to sensitive environments, but it prevents straightforward budget comparison and offers no low-cost entry tier.

Platforms

CTD is self-hosted. On-premises operation and flyaway kits suit air-gapped and tightly controlled networks, but organizations looking for a fully managed SaaS deployment should consider a different approach.

Who it's for

CTD is aimed at federal and other public-sector organizations securing OT and cyber-physical systems at civilian or defense sites. Its in-tool guidance is intended to help locations without dedicated OT security personnel, while passive monitoring, broad protocol support, and flexible discovery address heterogeneous estates. It is a particularly strong fit where remote sites, air gaps, or existing firewall, NAC, SIEM, and Rockwell investments shape the design.

Pros and cons

Pros

• Works in sensitive environments: On-premises deployment and mobile flyaway kits support air-gapped and restricted federal sites.
• Broad asset visibility: Passive, active, and AppDB discovery plus more than 450 industrial protocols can cover varied OT equipment.
• Prioritized risk context: KEV and EPSS reporting is combined with tracked exposures to guide remediation decisions.
• Actionable network control: Virtual Zones, cross-zone alerts, and firewall/NAC integration connect inventory to segmentation policy.
• Operational ecosystem: SIEM support and integrations with roughly 60 partners can fit established security stacks.

Cons

• Custom pricing: Buyers must contact Claroty, making costs difficult to compare before procurement.
• Self-hosting required: Teams wanting a cloud-first service or minimal infrastructure ownership may find the deployment model burdensome.
• Public-sector orientation: The feature set is designed around federal OT needs and may be excessive for smaller, non-industrial environments.

Alternatives

Honeywell Forge is the better fit when you need a broader product family spanning Android, iOS, desktop, web, API, and Linux platforms, with product-specific licensing. Choose EmberOT instead for a free, self-hosted OT PCAP Analyzer that breaks down devices and protocols, provided you can supply a valid school or business email.

Nozomi Networks Platform suits teams wanting a free Vantage SaaS licensing tier for hardware and Guardian nodes with cloud-hosted security infrastructure. Claroty xDome is the natural alternative when a modular SaaS platform is preferable to CTD's on-premises model.

FactoryTalk Analytics, Radiflow iSID, TXOne EdgeOne, and Dragos Platform are other paid options for evaluating against your preferred deployment and OT security requirements.

For a wider comparison, see the OT and ICS Security Monitoring Software list.

Verdict

Choose Claroty CTD if you are a public-sector or defense organization that needs deep OT asset inventory, segmentation context, exposure prioritization, and real-time detection across on-premises or air-gapped sites. Its main reason to look elsewhere is equally clear: organizations that prioritize transparent pricing, cloud delivery, or a lighter deployment will find CTD harder to justify.