SECURITY ATLAS / EVALUATION BRIEF
Continuous Threat Detection (CTD)
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/claroty-ctd/

THE ATLAS TAKE
Claroty CTD is worth a close look for industrial environments that require an on-premises platform and more than one way to build asset context. Passive, active and AppDB discovery address different visibility problems, and that difference is central to the evaluation. Atlas would demand field provenance and engineering approval for each method, then test whether Virtual Zones and alert timelines support a useful investigation. CTD can inform segmentation, but an inferred zone is not an enforced boundary. xDome SaaS and secure remote access remain separate architectural and commercial decisions.

SCOPE
CTD is evaluated separately from xDome SaaS and xDome Secure Access. Passive monitoring, Active discovery and AppDB collection are different methods with different prerequisites; approve the method for each equipment class.

WORTH A LOOK WHEN
Industrial teams needing on-premises visibility with approved complementary discovery methods.

THINK TWICE WHEN
The plan assumes active discovery is acceptable on every device or that virtual zones automatically enforce segmentation.

IMPLEMENTATION
1. Approve methods by equipment class
Document vendor constraints, maintenance windows and safe lab evidence before enabling active collection.

2. Reconcile inventory provenance
Compare known devices with observed, queried and imported fields and resolve discrepancies with engineers.

3. Validate a proposed boundary
Review a Virtual Zone against real process dependencies before any connected enforcement change.

OPERATING REALITY
Engineering and security must jointly maintain the inventory, collection-method approvals and zone model. New equipment or process changes can invalidate assumptions. Exposure findings should be translated into feasible mitigation work with an asset owner; patch urgency alone is not a safe industrial change instruction.

COMMERCIAL CONSIDERATIONS
Quote CTD and its deployment infrastructure explicitly. Separate xDome, secure remote access and enforcement integrations, including engineering work required to validate collection and segmentation.
- Monitored sites and deployment components
- Selected collection and integration scope
- Engineering validation and separate secure-access requirements

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Build one asset record through two approved methods
Acceptance evidence: Keep field provenance and disagreement resolution.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Review a safe cross-zone lab communication
Acceptance evidence: Capture the zone relationship and alert evidence.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Tabletop a segmentation recommendation
Acceptance evidence: Document external enforcement, process owner approval and rollback.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which discovery methods are approved by the equipment manufacturer?
- Which firewall or NAC connector actually enforces a suggested boundary?
- Is secure remote access included or a separately entitled integration?

EVIDENCE GAPS
- Atlas has not independently validated protocol depth or discovery safety.
- Confirm supported equipment and exact integration entitlements for the release.

SOURCES
Claroty Continuous Threat Detection (Product information)
https://www.claroty.com/industrial-cybersecurity/ctd
Claroty CTD solution overview (Product information)
https://web-assets.claroty.com/resource-downloads/ctd-overview-2024.pdf
Claroty passive monitoring and collection boundaries (Product information)
https://claroty.com/platform/passive-monitoring

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.