Claroty

1.1 Corporate Identity, Founding History, and Leadership Structure

Claroty was founded in October 2014 as the second cybersecurity startup incubated by the Team8 foundry, launched by co-founders Amir Zilberstein (initial CEO), Galina Antova (Chief Business Development Officer), and Benny Porat (Chief Technology Officer) [CO001]. The company maintains headquarters in New York City with substantial research and engineering operations in Tel Aviv-Yafo, Israel, alongside regional presences across North America, Europe, Asia-Pacific, and Latin America [CO002]. Operating leadership is headed by Chief Executive Officer Yaniv Vardi, supported by a governance board including NightDragon Founder Dave DeWalt [CO003]. Functional executive appointments include former Ford Motor Company AI Chief Gil Gur Arie as Chief Product Officer and retired U.S. Air Force Colonel Jen Sovada leading public sector growth [CO004]. Total reported global headcount spans between 700 and 809 personnel across 27 countries, reflecting sustained global expansion [CO005].

1.2 Capitalization Trajectory, Series F Financing, and Scale Metrics

Claroty completed a $150 million Series F financing round in January 2026 led by Golub Growth, an affiliate of Golub Capital, with additional confirmed participation from existing syndicate investors of up to $50 million [CO006]. The transaction included an estimated secondary component of $30 million to $40 million and represented an 80% increase in valuation over its March 2024 strategic growth round, reaching an estimated $3.0 billion post-money valuation [CO007]. Lifetime funding totals approximately $882 million to $890 million across equity and credit facilities, including strategic backing from automation vendors Rockwell Automation, Siemens, Schneider Electric, and BMW i Ventures [CO008]. On operating scale, Claroty surpassed $100 million in Annual Recurring Revenue (ARR) during calendar year 2023, while current ARR run-rate, gross margins, and cash burn remain non-public diligence gaps [CO009]. The enterprise customer roster exceeds 1,000 organizations globally, encompassing 24 Fortune 100 industrial, energy, and healthcare enterprises [CO010].

1.3 Platform Evolution, Strategic Milestones, and Enterprise Exposure

Claroty's operating trajectory spans ten years of cyber-physical systems protection, advancing from early industrial network visibility into an integrated XIoT platform [CO011]. A defining strategic milestone was the January 2022 acquisition of Medigate, which nearly doubled company scale and laid the architectural foundation for its flagship cloud SaaS product, Claroty xDome [CO012]. Product innovation accelerated in 2025 and 2026 with the introduction of the CPS Library, an AI-powered asset catalog developed in partnership with Schneider Electric and Rockwell Automation [CO013]. Core operational and market risks persist around secondary liquidation discounts, lack of audited current financials prior to an anticipated initial public offering, and governance dependencies across sovereign critical infrastructure procurement [CO014].

1.4 Exhibits

2.1 Market Boundary, Category Definitions, and Included Spend

The addressable market for cyber-physical systems (CPS) security encompasses software, hardware appliances, and services deployed to discover, monitor, assess, and defend operational technology (OT), industrial control systems (ICS), the Internet of Medical Things (IoMT), and smart building management systems (BMS). Unlike traditional information technology (IT) security, which prioritizes data confidentiality across servers and endpoints, CPS security is governed by availability, physical safety, and operational resilience across fragile controllers, sensors, and actuators that cannot tolerate active scanning or unplanned downtime. Included addressable spend covers passive and safe-active network monitoring, continuous threat exposure management, secure remote access (SRA) for internal and third-party technicians, and specialized CPS threat intelligence. Excluded from this core boundary are standard enterprise IT endpoint protection platforms (EDR), generic cloud security posture management (CSPM), identity and access management (IAM) directory services, and broad physical facility security controls. Within this landscape, Claroty defines its addressable scope around the Extended Internet of Things (XIoT), explicitly unifying classic manufacturing shop-floor automation with clinical healthcare devices and commercial infrastructure.[CM001, CM002, CM003, CM004, CM008]

2.2 Market Sizing, TAM/SAM/SOM Breakdown, and Growth Lenses

Independent market research from MarketsAndMarkets sizes the worldwide operational technology security market at $23.54 billion in 2025, climbing to $27.39 billion in 2026 at an annual expansion rate of roughly 16%. In parallel, long-range tracking from ABI Research pegs the broader critical infrastructure OT/ICS security market at $12.75 billion in 2023, charting an expansion trajectory toward $21.60 billion by 2028. Sizing the serviceable available market (SAM) requires segmenting spend by delivery and product type: on-premises hardware and software installations still accounted for 70.42% of category spending in 2025 according to Mordor Intelligence, while pure software solutions commanded 62.34% of total vendor revenues relative to consulting and integration services. Claroty's serviceable addressable opportunity sits squarely at the intersection of commercial platform software and enterprise hybrid deployments across high-threat verticals. Serviceable obtainable market (SOM) capture is directly constrained by incumbent automation contracts, procurement fragmentation between IT and plant engineering, and multi-vendor bake-offs against specialized peers such as Dragos and Nozomi Networks.[CM005, CM006, CM007, CM012, CM013]

2.3 Buyer Segmentation, Governance Friction, and Procurement Dynamics

Purchasing authority for cyber-physical security sits at a historically tense organizational intersection between corporate Chief Information Security Officers (CISOs) and operational plant engineering managers. While enterprise CISOs and VP of Security Operations titles increasingly control the formal capital budget, Operational Technology directors and Chief Operating Officers maintain functional veto power over any tool that risks interrupting continuous production line availability. Adoption paths typically begin when a security audit, regulatory inspection, or sector-specific cyber alert prompts a proof-of-concept (POC) at a single high-profile plant, water treatment facility, or hospital campus. Enterprise procurement commonly requires vendors to demonstrate frictionless coexistence with legacy supervisory control and data acquisition (SCADA) networks without requiring hardware-heavy architecture changes. Once passive visibility is established, budget allocations expand from initial asset discovery into recurring operational licenses for vulnerability management, micro-segmentation modeling, and privileged remote session access.[CM008, CM009, CM010, CM011, CM014]

2.4 Growth Drivers, Regulatory Mandates, and Adoption Constraints

Category adoption is accelerating under the dual pressure of targeted nation-state cyber campaigns and escalating government regulatory mandates. In 2026, multi-agency advisories from CISA, the FBI, NSA, Department of Energy, and Environmental Protection Agency documented extensive Iranian-affiliated cyber targeting of programmable logic controllers (PLCs), remote terminal units (RTUs), and human-machine interface (HMI) displays at U.S. water and energy utilities. These operational threats coincide with stringent compliance enforcement, including NERC CIP audit standards for bulk electric power, TSA security directives for oil and gas pipelines, and the European Union's NIS2 directive covering essential operators across healthcare, water, and manufacturing. However, several friction factors temper conversion velocity: industrial operators face severe shortages of dual-skilled IT/OT personnel, legacy controller architectures often remain in active service for decades past original support windows, and many plant operators harbor deep skepticism toward cloud telemetry uplinks, sustaining high demand for hybrid and strictly on-premises architectures.[CM003, CM007, CM010, CM014, CM015, CM016]

2.5 Exhibits

3.1 Competitive Landscape: Architectural Split, Direct Peers, and Adjacencies

The competitive landscape in cyber-physical systems (CPS) security divides along a fundamental architectural axis: deep packet inspection (DPI) platforms versus cross-estate asset intelligence engines. Claroty, Nozomi Networks, and Dragos operate primarily as DPI-first platforms whose physical or virtual sensors sit on mirrored network traffic via SPAN or TAP ports, dissecting industrial protocols locally to construct asset inventories, establish behavioral baselines, and detect anomalous commands. In contrast, Armis Centrix positions DPI as only one telemetry stream among dozens, relying primarily on API integrations across enterprise switches, firewalls, wireless controllers, Network Access Control (NAC), Endpoint Detection and Response (EDR), and Configuration Management Databases (CMDBs). This structural difference dictates enterprise fit: Armis delivers superior out-of-the-box visibility across blended enterprise IT, IoT, and clinical medical environments (IoMT), whereas Claroty, Nozomi, and Dragos provide documented visibility and forensic parsing at Purdue Model Levels 1 and 2 (controllers, remote terminal units, and safety instrumented systems). Beyond direct peers, the market includes industrial automation incumbents such as Rockwell Automation and Schneider Electric—who act simultaneously as strategic distribution partners and equity backers—alongside legacy IT security incumbents attempting to extend network access control into operational plants.[CP001, CP002, CP003, CP004, CP008, CP012]

3.2 Telemetry Architecture, Forensic Depth, and Protocol Parsing Differentiation

Evaluating CPS protection platforms requires analyzing how telemetry is gathered when passive network sniffing reaches its physical limits. While passive monitoring avoids operational disruption, it cannot inspect traffic contained entirely inside a programmable logic controller (PLC) backplane, unrouted serial links between field devices, or direct point-to-point engineering connections. To penetrate these blind spots, vendors deploy secondary collection mechanisms with distinct risk profiles. Claroty utilizes Safe Active Queries, sending native-protocol requests engineered to mirror standard engineering workstation communications, alongside its proprietary AppDB engine that directly parses offline PLC and SCADA project configuration files—reaching air-gapped, powered-down, or silent controllers. Nozomi Networks pairs passive collection with optional Smart Polling and host-based Nozomi Arc endpoint sensors, whereas Dragos utilizes lightweight software collectors and edge containers. In threat detection, Claroty deploys five parallel detection engines (anomaly detection, security behaviors, SNORT/YARA known threats, operational configuration changes, and custom rules). Dragos distinguishes itself through adversary-focused threat behavior analytics mapped directly to MITRE ATT&CK for ICS and backed by first-party incident response playbooks. However, Dragos has also closed the anomaly detection gap by introducing baseline learning modes, while all four vendors integrate with perimeter firewalls and switches to recommend segmentation policies rather than executing inline blocking directly.[CP002, CP005, CP006, CP007, CP008, CP009, CP010, CP016]

3.3 Commercial Models, Pricing Opacity, and Total Cost of Ownership

Commercial procurement across the CPS protection category is characterized by extreme quote-based opacity, with no universal public price lists available from major vendors. Claroty licenses its platform through annual subscription or perpetual tiers scaling by protected asset volume, site count, and modular add-ons. While AWS Marketplace private listings for Claroty xDome indicate annual entry tiers starting around $100,000 for Essential packages and climbing past $1,200,000 for Advanced multi-site enterprise deployments with bundled engineering services, total cost of ownership (TCO) extends substantially beyond base software licensing. Enterprise buyers routinely incur significant auxiliary costs for professional deployment services across segmented OT enclaves, specialized hardware sensors, and complex API integrations into SIEM, SOAR, and NAC infrastructure. Furthermore, baseline tuning for OT anomaly detection introduces temporary alert noise that demands dedicated analyst bandwidth before reaching steady-state operations. A crucial commercial differentiator is first-party Secure Remote Access (SRA): Claroty provides native xDome Secure Access with credential vaulting, session recording, and asset-scoped least-privilege controls, whereas Nozomi Networks and Dragos rely on third-party remote access integrations, requiring buyers to negotiate separate software licensing.[CP003, CP011, CP013, CP014, CP015]

3.4 Moat Durability, Platform Expansion, and Displacement Risks

Claroty's competitive moat rests upon deep protocol parsing intellectual property, an extensive library of industrial communication protocols, and strategic distribution lock-in through global automation giants Rockwell Automation and Schneider Electric. These automation leaders not only participated as equity investors but actively bundle Claroty's Continuous Threat Detection (CTD) and xDome platforms into their managed cybersecurity service offerings. Switching costs are reinforced once an enterprise embeds Claroty's asset taxonomy into corporate ServiceNow CMDBs and establishes automated firewall segmentation rules based on Claroty Virtual Zones. Nevertheless, Claroty faces intensifying displacement and margin pressure on two fronts. First, Dragos has expanded aggressively beyond passive detection into active remediation via its Phosphorus acquisition—automating firmware updates, credential rotation, and configuration hardening—while acquiring runZero and NetRise in September 2026 to add device exposure management and firmware software bill of materials (SBOM) analysis. Second, Armis continues to capture enterprise-wide deals where CISOs prioritize broad visibility across mixed campus, healthcare, and IT networks over specialized Purdue Level 1/2 controller inspection. If industrial security spending consolidates under corporate IT budgets, Claroty risks commoditization unless it sustains clear protocol depth and expands automated remediation.[CP004, CP008, CP010, CP012, CP014, CP016]

3.5 Exhibits

4.1 Revenue Model and Commercial Streams

Claroty operates an enterprise B2B cybersecurity model centered on recurring software subscriptions for cyber-physical systems protection across critical infrastructure, healthcare, and industrial operational technology networks. Commercial monetization occurs predominantly via annualized subscriptions priced according to the scale of monitored assets and physical facilities, delivered through the cloud-native Claroty xDome platform or on-premise Continuous Threat Detection (CTD) software. The company achieved a major commercial milestone by surpassing $100 million in annual recurring revenue during 2023, driven by rapid customer expansion across heavily regulated sectors. Third-party market intelligence indicates top-line revenue reached approximately $200 million by January 2026. Claroty's revenue quality benefits from multi-year enterprise commitments, high contract renewal rates, and deep integration with strategic industrial automation partners including Rockwell Automation, Schneider Electric, and Siemens.[CI001, CI002, CI003, CI009, CI010]

4.2 Pricing Structure and Monetization Mechanics

Claroty employs a closed enterprise pricing structure where list prices are not publicly published, requiring custom commercial quotes based on asset density, protocol coverage, and deployment topology. The monetization architecture packages core asset discovery and inventory with premium add-on modules such as vulnerability and risk management (VRM), the AI-powered CPS Library, and Secure Remote Access (SRA). While headline software license agreements frequently reach multi-million dollar annual commitments among large global accounts, realized pricing reflects aggressive volume discounting for enterprise-wide rollouts across Fortune 100 enterprises. In secondary markets, transaction pricing has mirrored late-stage institutional rounds, with Claroty commanding an implied valuation of $3 billion following its January 2026 Series F. That valuation marks an expansion of roughly 80% over 2024 pricing, corresponding to an implied revenue multiple of 15.0x against estimated $200 million revenue.[CI001, CI006, CI009, CI013]

4.3 Unit Economics and Margin Structure

Evaluating Claroty's underlying unit economics reveals notable disclosure gaps typical of late-stage venture-backed infrastructure software firms. Key operating metrics—including gross margin percentages, Net Revenue Retention (NRR), Customer Acquisition Cost (CAC), and payback duration—remain confidential private metrics that are withheld from public statements. However, structural proxies indicate a gross margin profile governed by the hybrid nature of industrial OT deployments. On-premise deployments require initial network appliance configuration and high-touch professional services, which typically yield lower gross margins than pure multi-tenant cloud software. Conversely, expansion into the SaaS-native xDome architecture provides a pathway toward higher gross margins as software telemetry scales without dedicated hardware. Headcount data indicating approximately 750 to 859 employees suggests revenue per employee of $230,000 to $265,000, illustrating steady progress toward public SaaS operational efficiency benchmarks.[CI002, CI003, CI011, CI014]

4.4 Capital Adequacy, Burn Dynamics, and Diligence Verdict

Claroty's capital adequacy was substantially strengthened in January 2026 through a $150 million Series F financing round led by Golub Growth, complemented by up to $50 million in additional investor participation. This transaction brought cumulative funding to approximately $882 million across equity rounds and strategic credit agreements, following an earlier $100 million growth round in March 2024. Leadership has indicated that the company expects to reach profitability in the near term while actively preparing for an initial public offering as market windows permit. Nonetheless, prospective investors must underwrite several structural caveats. The Series F round incorporated a secondary liquidity component of $30 million to $40 million, enabling early stakeholders to take liquidity off the table. Furthermore, absence of audited disclosures regarding current monthly burn rates, remaining cash reserves, and liquidation preferences leaves downside protection uncertain. Validating exact preference structures and forward cash runway remains a critical diligence priority before underwriting late-stage equity participation.[CI004, CI005, CI006, CI007, CI008, CI010, CI012]

4.5 Exhibits

5.1 Platform Portfolio and Core Capabilities

The Claroty Platform provides a purpose-built security solution engineered for environments where cyber-physical systems (CPS) directly govern physical processes, operational safety, and patient care. Claroty delivers its capabilities through two primary deployment paradigms: Claroty xDome, a modular SaaS platform designed for rapid cloud time-to-value, and Claroty Continuous Threat Detection (CTD), an on-premise solution delivering comprehensive network visibility and controls for air-gapped or strictly regulated industrial sites. Across both footprints, the platform integrates five foundational capability pillars: deep asset discovery and inventory, automated exposure management, network policy modeling and protection, secure interactive remote access, and real-time threat detection. In healthcare and clinical environments, Claroty xDome for Healthcare incorporates technology acquired from Medigate to secure Internet of Medical Things (IoMT) devices alongside building management systems (BMS) and operational technology (OT). Furthermore, the portfolio incorporates the CPS Library, an artificial intelligence catalog co-developed with automation leaders Schneider Electric and Rockwell Automation to standardize and track operational asset specifications with high precision.[CE001, CE002, CE003, CE004, CE005, CE006]

5.2 Operating Architecture, Integrations, and Data Engine

Claroty’s technical backbone is structured around non-disruptive data collection, distributed stream processing, and high-performance relational storage. Because cyber-physical systems cannot tolerate intrusive active scanning that risks operational disruptions or device reboots, Claroty employs five complementary discovery mechanisms: passive network monitoring via deep packet inspection, safe low-impact queries calibrated for fragile controllers, lightweight Claroty Edge collectors, engineering project file analysis (including PLC logic files), and ecosystem enrichment pulling from existing CMMS, CMDB, and biomedical inventories. For cloud-hosted xDome environments running on Amazon Web Services, Claroty deployed Amazon Aurora PostgreSQL with Aurora Optimized Reads on NVMe SSD storage and Aurora I/O-Optimized configurations. This architectural enhancement resolved write bottlenecks and temporary storage saturation caused by multi-attribute querying across millions of asset records, reducing complex dashboard API query latency from over 30 seconds to under one second while lowering database infrastructure costs by 50%. Third-party ecosystem integrations, including Elastic Agent and Datadog Marketplace modules, ingest normalized alert, event, and vulnerability streams via REST APIs to support SOC workflows.[CE007, CE008, CE009, CE010, CE011]

5.3 Technical Differentiation, Threat Research, and Trust Controls

Claroty’s primary technical defensibility originates from its specialized CPS domain models and proprietary threat intelligence engine, Team82. Operating dedicated CPS testing laboratories, Team82 has discovered and responsibly disclosed over 650 vulnerabilities across industrial control systems, medical devices, and building automation protocols. Rather than relying exclusively on generic Common Vulnerability Scoring System (CVSS) metrics, Claroty calculates dynamic risk scores incorporating Known Exploited Vulnerabilities (KEVs), active ransomware campaign linkage, network exposure, and clinical or operational criticality. Because legacy medical and OT assets operate across 10-to-15-year lifecycles where direct firmware patching is unfeasible or delayed by FDA re-certification rules, Claroty generates compensating control profiles and network policy recommendations. These policies are enforced via bidirectional API integrations with microsegmentation platforms such as Elisity, Cisco Identity Services Engine (ISE), switches, and firewalls. For enterprise and government procurement trust, Claroty maintains an externally verified Trust Center documenting compliance with ISO 27001, ISO 27701, SOC 2 Type 2, GDPR, and HIPAA, alongside STIG-hardened configuration management controls supporting federal FISMA mandates.[CE012, CE013, CE014, CE015, CE016]

5.4 Exhibits

6.1 Customer Base Segmentation by Buyer, Vertical, and Operational Environment

Claroty segments its customer base across four primary operating environments comprising the Extended Internet of Things (XIoT): industrial automation and operational technology (OT), healthcare Internet of Medical Things (IoMT), commercial facilities, and the public sector. Purchasing decisions involve distinct buyer and payer dynamics across these verticals. In industrial manufacturing, energy, and utilities, Chief Information Security Officers (CISOs) and Vice Presidents of Security Operations act as primary budget holders, but plant managers and Operational Technology directors retain veto authority to protect continuous production availability. In healthcare systems, Chief Information Officers and biomedical engineering leads partner with IT security to safeguard connected clinical equipment and patient monitoring devices. Across commercial infrastructure, real estate and building management teams procure exposure management for environmental control systems. In the public sector and defense agencies, Claroty targets federal civilian and intelligence infrastructure through specialized partnerships and certifications. Enterprise contracts are characterized by multi-site deployments that scale with the total number of connected assets and physical facilities monitored across hybrid architectures.[CU001, CU002, CU003, CU004, CU009]

6.2 Adoption Trajectory, Enterprise Scale, and Strategic Channel Expansion

Claroty's commercial adoption has scaled from early industrial pilot deployments into enterprise-wide standardization across Fortune 100 conglomerates and multinational asset owners. Between 2020 and 2023, the company grew its active customer count by over 300%, driving annual recurring revenue past $100 million in 2023. By early 2026, following its $150 million Series F financing, Claroty confirmed active commercial deployments with 24 of the Fortune 100 organizations, up from 20% in early 2024. Adoption velocity is significantly amplified by go-to-market alliances with major industrial automation original equipment manufacturers (OEMs), including Schneider Electric, Rockwell Automation, and Siemens, who serve simultaneously as strategic investors, technology integration partners, and distribution channels. Additionally, managed security service providers (MSSPs) including IBM, NTT Data, and eSentire incorporate Claroty into ongoing security operations center workflows. However, while aggregate customer growth metrics demonstrate accelerating enterprise penetration, Claroty does not publicly disclose absolute paying customer counts, customer cohort trajectories, or average annual contract value, requiring independent diligence on true deployment depth.[CU005, CU006, CU007, CU008, CU013]

6.3 Named Customer Proof, Strategic Investor Deployments, and Reference Quality

Claroty's customer reference base is closely linked to its ecosystem of strategic corporate backers and mission-critical asset operators. Industrial leaders such as BMW Group, through its venture arm BMW i Ventures, invested in Claroty to secure connected manufacturing operations and protect automotive assembly facilities against operational disruption. Similarly, automation leaders Rockwell Automation and Schneider Electric have embedded Claroty's continuous monitoring capabilities into joint customer deployments and co-developed the Claroty CPS Library to standardize device visibility. In the public sector, Claroty expanded federal and defense presence by appointing former U.S. Air Force leadership, partnering with Carahsoft to reach state, local, and educational (SLED) agencies, and integrating with Mission IT and Parsons' SealingTech to access the U.S. Intelligence Community and defense operational networks. While these strategic deployments validate enterprise-grade production readiness and rigorous security compliance, independent verification of individual commercial account satisfaction and renewal history remains constrained by widespread non-disclosure agreements across sensitive critical infrastructure operators.[CU009, CU010, CU011, CU012, CU014]

6.4 Retention Durability, Land-and-Expand Mechanics, and Procurement Friction

Customer expansion within Claroty accounts follows a land-and-expand trajectory that typically begins with passive network monitoring and asset discovery across a single production plant, hospital campus, or data center. Once baseline asset visibility is established, customer accounts expand into recurring software modules covering exposure management, network protection, vulnerability and risk management (VRM), and secure remote access (SRA). However, customer retention and expansion face measurable structural headwinds. First, security leaders managing cyber-physical systems programs report organizational friction stemming from unclear operational ownership between corporate IT teams and plant engineering staff, insufficient specialized skills, and the absence of standardized maturity models. Second, enterprise procurement cycles commonly extend over several quarters due to stringent testing requirements on live production networks. Third, because Claroty is privately held, key customer durability metrics such as net revenue retention (NRR), gross revenue retention (GRR), logo churn, and customer concentration among top accounts are not publicly reported, representing a critical area for prospective investor diligence.[CU002, CU003, CU004, CU015, CU016]

6.5 Exhibits

7.1 Regulatory Compliance Mandates and Federal Governance

Claroty's market expansion is tightly coupled to federal cybersecurity mandates and critical infrastructure compliance frameworks [CR005]. As cyber-physical systems (CPS) face accelerating geopolitical threats, regulatory bodies have shifted from voluntary guidelines to strict compliance requirements including CISA emergency directives, NIST guidance, and Department of Defense Cybersecurity Maturity Model Certification (CMMC) requirements [CR002, CR005]. Claroty xDome and Continuous Threat Detection (CTD) provide configuration controls and logging necessary to comply with federal requirements such as FISMA, supported by STIG-hardened configuration management baselines [CR005, CR008]. However, achieving and sustaining compliance across public sector accounts introduces continuous audit risk and extensive verification demands [CR002, CR005]. While federal agencies report that 100% launched new CPS security initiatives in the past year, only 36% have achieved full asset visibility and over 60% face internal CPS skill shortages, leaving implementation and compliance timelines vulnerable to customer-side operational bottlenecks [CR005]. Failure of customers to establish rigorous evidence paths or verify automated compliance mappings can result in regulatory scrutiny and false compliance assurance [CR002].

7.2 Operational Exposure, Vulnerability Backlog, and Agentic AI Governance

Operational security risks in CPS environments differ fundamentally from corporate IT because disruptions can shut down factory lines, municipal water systems, or clinical healthcare workflows [CR002, CR003]. Proprietary research from Claroty's Team82 analyzing over 125,000 operational technology (OT) assets revealed that 3.7% of all OT assets are insecurely connected to the public internet, and 13% of critical engineering workstations (EWS) and human-machine interfaces (HMIs) harbor insecure direct internet connections [CR003, CR004]. More acutely, 36% of those internet-connected EWS and HMIs contain at least one confirmed Known Exploited Vulnerability (KEV), creating severe initial access and lateral movement exposure [CR003, CR004]. Because industrial controllers often cannot be patched without taking entire production facilities offline, operators must rely heavily on network segmentation and secure remote access as compensating controls [CR001, CR003]. Furthermore, Claroty's recent introduction of Claire—a CPS-native AI security agent—and the xDome Model Context Protocol (MCP) Server introduces emerging operational and software supply chain risks [CR002]. Independent diligence highlights that deploying agentic AI in mission-critical OT environments carries failure modes including unsafe remediation recommendations, tool-permission sprawl, prompt injection via imported asset notes, and degraded telemetry behavior [CR002]. OT security governance dictates that buyers must enforce read-only validation, strict change-window adherence, and mandatory human-in-the-loop approvals before allowing automated remediation actions [CR002].

7.3 Channel Concentration, Commercial Dependencies, and Diligence Gaps

Claroty's commercial scale relies heavily on an indirect go-to-market model through channel aggregators, cloud hyperscalers, and original equipment manufacturer (OEM) alliances [CR005, CR006, CR007]. In the public sector, Claroty distributes through Carahsoft as its master government aggregator under NASPO ValuePoint contracts, creating operational and counterparty dependency on Carahsoft's federal reseller apparatus [CR005]. On the technology and product development side, Claroty partners with Rockwell Automation and Schneider Electric—both strategic investors—for initiatives like the CPS Library, as well as AWS for cloud-hosted xDome infrastructure [CR001, CR006, CR007]. Cloud-managed xDome deployments introduce third-party cloud availability risks and operational friction for highly segmented air-gapped plants [CR006]. Crucially, while Claroty disclosed reaching $100M+ in ARR in 2023 and completed a $150M Series F round in January 2026, the company keeps its current ARR, renewal rates, gross margins, cash burn, vertical revenue mix, and customer concentration metrics private [CR007, CR008]. These undisclosed metrics create significant financial underwrite uncertainty for prospective late-stage and pre-IPO investors [CR007].

7.4 Exhibits

8.1 Investment Thesis and Anti-Thesis

The investable thesis is that Claroty has both a durable demand backdrop and evidence of enterprise adoption. The company reported working with 24 Fortune 100 organizations in the January 2026 financing announcement, while Facilities Dive's account of Claroty research described widespread known vulnerabilities in building-management devices. Those facts support the need for cyber-physical-systems protection, but they do not establish Claroty's renewal economics or market share. The anti-thesis is therefore evidence-driven rather than categorical: the latest financing materials omit current ARR, growth, gross margin, net retention, burn, and runway. Claroty's Cloud 100 recognition is a positive signal, yet the supporting page is company-issued and discloses the ranking methodology rather than Claroty's underlying scores. Product relevance and customer logos should not substitute for audited operating quality.[CV004, CV005, CV006, CV010, CV011, CV012]

8.2 Financing Context and Entry Discipline

Claroty announced a $150 million Series F led by Golub Growth in January 2026, with up to $50 million of participation from existing investors. The company reported an 80% valuation increase from its March 2024 financing but did not disclose the absolute value. CTech estimated the resulting value at approximately $3 billion and reported that roughly $30 million to $40 million of the transaction was secondary; both figures should be verified in transaction documents. Tracxn reports $882 million raised across eight rounds, including a $400 million Series E at a $2 billion post-money valuation in 2021, but cumulative funding is not cash available today. The public record also does not disclose liquidation preferences, ownership, debt balances, or fully diluted capitalization. Entry discipline should therefore be based on a verified common-equity waterfall, not the headline financing estimate.[CV001, CV002, CV003, CV007, CV008, CV009, CV013, CV016]

8.3 Scenarios, Exit Readiness, and Diligence

Public evidence does not support numeric bull, base, or bear valuation ranges. The only usable anchors in the assigned evidence are Claroty's own historical financing marks, an independent approximately $3 billion estimate, and a stale company-reported 2023 ARR milestone above $100 million; combining those different dates into a current revenue multiple would be misleading. The scenario framework is therefore conditional. A bull case requires verified durable growth, strong retention and margins, cash-generation visibility, and a clean preference stack. A base case requires adequate growth and a credible profitability path at an entry price supported by current metrics and genuine peer benchmarks. A bear case is triggered by weak retention, cash needs, senior preference overhang, or a closed IPO window. Management discussed an IPO aspiration and near-term profitability, but also tied timing to market conditions. Final diligence must obtain audited financials, cohort retention, the cap table and waterfall, debt terms, and directly comparable public-company or M&A evidence.[CV003, CV004, CV006, CV008, CV012, CV014, CV015, CV016]

8.4 Exhibits