The Atlas take.
Claroty CTD is worth a close look for industrial environments that require an on-premises platform and more than one way to build asset context. Passive, active and AppDB discovery address different visibility problems, and that difference is central to the evaluation. Atlas would demand field provenance and engineering approval for each method, then test whether Virtual Zones and alert timelines support a useful investigation. CTD can inform segmentation, but an inferred zone is not an enforced boundary. xDome SaaS and secure remote access remain separate architectural and commercial decisions.
02 / DEFINE THE BOUNDARY
What you are actually evaluating.
CTD is evaluated separately from xDome SaaS and xDome Secure Access. Passive monitoring, Active discovery and AppDB collection are different methods with different prerequisites; approve the method for each equipment class.
03 / THE CONTROL PATH
Where it sits. How it works.
Atlas architecture interpretation: combine approved industrial collection methods, build asset/session/process context, and use CTD investigations or integrations to support an authorized mitigation.
- 01
Passive, active or AppDB evidence
Select methods for each equipment class and retain where important asset fields came from.
- 02
CTD inventory and Virtual Zones
Review assets, communication groups, exposure context and related alert timelines.
- 03
Investigation and external enforcement
Route an approved mitigation to the actual firewall, NAC or secure-access workflow when integrated.
04 / WHAT EARNS ITS PLACE
Strengths, with the evidence attached.
Atlas analysis of documented capabilities; availability and behavior depend on the edition and environment.
Complementary discovery choices
CTD documents passive, active and AppDB collection, allowing the trial to address devices that one method cannot fully characterize.
Zone-oriented investigation
Virtual Zones and cross-zone alerting connect communication patterns with an industrial network model.
Inspect the documented capability notes
- Passive, Active and AppDB discovery contribute complementary industrial inventory evidence.
- Virtual Zones organize communications and support cross-zone violation alerts.
- Exposure and threat views connect observed activity with assets and alert timelines.
05 / KNOW THE COMPROMISES
The tradeoffs to take seriously.
Architectural implications and procurement questions from Atlas; these are not independently measured product failures.
Passive collection is incomplete by nature
Claroty explicitly describes complementary methods; traffic observation alone should not be treated as a complete industrial inventory.
Enforcement depends on integration
The CTD material describes integration with firewall and NAC controls; suggested segmentation still needs a separate authorized enforcement path.
06 / FROM PURCHASE TO PRACTICE
Make it work in your environment.
A proposed implementation sequence. Confirm supported versions, permissions, and rollback with the current documentation.
- 01
Approve methods by equipment class
Document vendor constraints, maintenance windows and safe lab evidence before enabling active collection.
- 02
Reconcile inventory provenance
Compare known devices with observed, queried and imported fields and resolve discrepancies with engineers.
- 03
Validate a proposed boundary
Review a Virtual Zone against real process dependencies before any connected enforcement change.
07 / THE OPERATING COMMITMENT
The bill is only part of the cost.
Commercial shape
Quote CTD and its deployment infrastructure explicitly. Separate xDome, secure remote access and enforcement integrations, including engineering work required to validate collection and segmentation.
- Monitored sites and deployment components
- Selected collection and integration scope
- Engineering validation and separate secure-access requirements
08 / COMPARE THE JOB
Put these beside it.
Alternatives worth examining for the same problem. Check each offering’s scope before treating it as a substitute.
Guardian
Compare local sensor investigation and historical changes against the same site asset sample.
TenableTenable One OT Exposure
Compare controller/configuration evidence and exposure workflows for the same equipment families.
09 / MAKE THE DECISION OBSERVABLE
Earn confidence through a real evaluation.
Suggested by Atlas. Agree acceptance criteria, use synthetic fixtures in an authorized environment, and capture both useful work and failed controls.
- TEST 01
Build one asset record through two approved methods
Acceptance evidence: Keep field provenance and disagreement resolution.
- TEST 02
Review a safe cross-zone lab communication
Acceptance evidence: Capture the zone relationship and alert evidence.
- TEST 03
Tabletop a segmentation recommendation
Acceptance evidence: Document external enforcement, process owner approval and rollback.
START WITH ONE EXERCISE
Use a fictional factory diagram to place a historian, engineering station and controller in zones. Review an unexpected historian-to-controller conversation against the maintenance record.
Evidence to look for: Deliver an allowed-communications table, the evidence supporting the exception and a proposed change test. Keep monitoring and enforcement responsibilities distinct.
Questions to bring to the vendor
- Which discovery methods are approved by the equipment manufacturer?
- Which firewall or NAC connector actually enforces a suggested boundary?
- Is secure remote access included or a separately entitled integration?
10 / SHOW THE WORK
Evidence, and what is still unknown.
What this research cannot establish
- Atlas has not independently validated protocol depth or discovery safety.
- Confirm supported equipment and exact integration entitlements for the release.
Dossier research reviewed October 18, 2026. Earlier profile references are retained for traceability; products and commercial terms change.
- Claroty Continuous Threat Detection ↗Product information
- Claroty CTD solution overview ↗Product information
- Claroty passive monitoring and collection boundaries ↗Product information
KEEP BUILDING YOUR JUDGMENT