Claroty adds business-centred risk tools to xDome platform

Claroty has introduced new capabilities to its Claroty xDome platform designed to offer organisations an impact-centric perspective of their cyber-physical systems (CPS) environment.

The Claroty xDome platform now features Device Purpose and Risk Benchmarking, additions that enable users to assess how the risks within their CPS environment are influenced by the function of each device, such as those deployed across production lines, building floors, or hospital wings. These functionalities are intended to help organisations prioritise risk reduction by evaluating potential impacts on critical business outcomes and facilitate greater collaboration between CPS personnel and other business units.

Research from Gartner highlights the shifting focus in this area. According to the firm, "Organisations are becoming aware of their blind spots. Asset-intensive organisations increasingly realise that CPS environments are value creation centres. A manufacturing company makes money by producing goods, for instance. Once largely 'out of sight, out of mind,' boards and C-suite executives increasingly want to know how their CPS production and mission-critical environments are protected."

Historically, the CPS protection sector has concentrated on an asset-centric approach, offering detailed visibility into individual assets and their respective risks. Although developing a comprehensive asset inventory is considered a core component of any cybersecurity programme, Claroty points out that an exclusive focus on assets might inadvertently prompt security teams to invest resources in protecting devices whose compromise would have minimal or no direct business impact.

The company notes the need for organisations to align remediation efforts with the business importance of each asset, whether it relates to critical public services or the company's largest revenue-generating systems. Claroty emphasises scenarios such as a security analyst and operational technology (OT) engineer evaluating two identical devices, where understanding each device's business function is crucial for determining which to address first.

The Device Purpose and Risk Benchmarking features in Claroty xDome aim to enable this shift from asset-centricity to impact-driven risk mitigation. These tools furnish maintenance teams with the business context necessary to avoid process disruption, operational downtime, and financial loss. Integrating business context with technical risk profiles creates a shared framework for dialogue between security teams and CPS operators, and also links their activities with broader organisational Business Impact Analysis initiatives.

Yoram Gronich, Chief Product Officer at Claroty, commented on recent challenges facing the sector, stating: "The security of critical infrastructures are under growing scrutiny as adversaries increasingly target these systems of the greatest criticality. The teams managing these environments are facing mounting pressure from multiple fronts in their organisations and need tools that exponentially make their jobs easier so they can focus on protecting the mission-critical infrastructures that sustain societal operations - that means having the business context to meaningfully reduce risk."

Among the key features of Device Purpose, users can categorise assets according to a hierarchical model and taxonomy aligned with their specific industry sector. The setup allows refinement from an established baseline that includes business impact scoring. This, in turn, enables measurement of how device-level and overall risk scores are affected when assets are reprioritised based on business importance.

Risk Benchmarking, the second core capability, gives organisations the ability to compare their CPS risk environment against those of similar organisations. With these analytics, users can observe how protection measures for their most critical assets stack up against industry peers, and track the effectiveness of risk mitigation strategies across a range of risk factors and multiple network segments over time.