Claroty CTD vs Dragos Platform
Claroty CTD
claroty.comDragos Platform
dragos.comSide by side
| Figure | Claroty CTD | Dragos Platform |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · OT and ICS Security Monitoring Software | 8.0 (#7) | 7.4 (#11) |
| Founded | 2015 | 2016 |
| Headquarters | Claroty says it is headquartered in New York City. | Washington, DC, United States |
| Intended users | Claroty describes CTD as suitable for public-sector organizations at different cybersecurity maturity levels, including sites without dedicated OT security personnel. | Dragos identifies industrial and critical infrastructure operators, including electric, oil and gas, manufacturing, water, transportation, mining, and government organizations, as customers it serves. |
| Purpose | CTD delivers cybersecurity controls for federal OT, including air-gapped and other sensitive environments. | The platform provides cybersecurity for extended operational technology (xOT) and critical infrastructure environments. |
| Threat detection | CTD uses five detection engines to profile assets, communications, and processes, establish behavioral baselines, and alert on known and emerging threats in real time. | Its multi-detection capabilities use OT-specific protocols, behavior, and threat intelligence to detect threats. |
Plans
In their own words
Claroty CTD
Claroty CTD is a self-hosted, on-premises platform for protecting cyber-physical systems across civilian and defense networks. It discovers OT and other XIoT assets through passive, active, and AppDB methods, then builds centralized inventories and detailed profiles, including in air-gapped environments. Network maps organize assets into Virtual Zones; CTD can alert on cross-zone communication violations and integrate with firewall and NAC systems for policy-based segmentation. Exposure management compares assets with tracked exposures and current KEV and EPSS reporting to support risk prioritization. Five detection engines profile assets, communications, and processes, establish behavioral baselines, and alert to known and emerging threats in real time. Deployments include on-premises installations and mobile flyaway kits for sensitive settings. CTD integrates with xDome Secure Access, Rockwell Automation AssetCentre, SIEM tools, and approximately 60 technology partners. It supports Modbus, DNP3, CIP, OPC UA, and more than 450 industrial protocols. Pricing is on request.
Dragos Platform
Dragos Platform is cybersecurity software for extended operational technology and critical infrastructure environments. It inventories assets across OT, IT, IoT and IIoT, and supports active and passive monitoring across more than 600 industrial and IT protocols. Its threat detection uses OT-specific protocols, behavior and threat intelligence. The Now, Next, Never framework helps teams prioritize vulnerability risk by operational impact. Response features include expert-authored playbooks, case management and AI-powered investigation; Dragos states that incident response is backed by an SLA within one hour. EmberAI is described as trained on the Dragos Intelligence Fabric and more than five petabytes of OT telemetry and adversary research. The platform integrates with ServiceNow for asset discovery and vulnerability management, and with Microsoft Sentinel. Deployment options include self-hosted, web, Azure, on-premises and hybrid models. Dragos states that customer data is encrypted in transit and at rest, and that major releases receive third-party penetration testing at least annually. Pricing is on request.