Claroty Gets $150M to Lead in AI for Infrastructure Security

A cyber-physical systems security powerhouse hauled in $150 million to better map and understand the vulnerabilities of physical assets in industrial environments.

See Also: The State of Operational Technology and Cybersecurity

The Golub Growth-led Series F funding will help New York-based Claroty build capabilities in specific domains including healthcare, manufacturing and industrial to address unique challenges like proprietary protocols and critical process risk prioritization, said CEO Yaniv Vardi. The company plans to evaluate ARR, profitability and platform differentiation to determine when Claroty is ready for an IPO.

“You want to make sure you have the financial runway to either profitability or an IPO,” Vardi told Information Security Media Group. “And we wanted to make sure we have enough to continue with our inorganic growth, take a platform that is very unique to really focus on verticalization in manufacturing, healthcare and obviously industrial to the next level.”

Vardi declined to provide a valuation associated with Claroty’s latest round of funding, though Calcalist reported the company is now worth $3 billion. The money comes 22 months after Claroty received $100 million in strategic growth funding from Delta-v Capital at a reported $2.5 billion valuation. Claroty, founded in 2015, employs 815 people and has been led by Vardi since July 2020 (see: Nation-State Threats Push Claroty to Take on Risk Reduction).

Are Additional Acquisitions in Claroty’s Future?

Critical infrastructure is facing an unprecedented level of threat activity, Vardi said, with healthcare attacks doubling year-over-year and 25% of all incidents now targeting manufacturing. Given this high-risk environment, Claroty needs to accelerate investment in its artificial intelligence-driven platform, aiming to deeply integrate automation and intelligence across all components of its technology stack, Vardi said.

“With AI, we want to push forward to help our customers,” Vardi said. “And we wanted to make sure we can continue with the organic growth strategy as well.”

The IPO market has reopened, but with more stringent expectations than in the past. Vardi said companies now need to demonstrate substantial recurring revenue, a path to profitability and clear differentiation in the market. He said Claroty is also focused on demonstrating predictability through consistent performance, efficient growth, and robust forecasting and execution discipline.

“You also have to have enough capacity on recurring revenues, and you have to show that you’re a sustainable business that is growing in an efficient way, and you are predictable, meaning you are forecasting and hitting and exceeding your targets,” Vardi said.

Claroty looks for acquisition targets with technology that can be integrated into its platform, especially companies that align with its zero trust philosophy, network segmentation or secure remote access capabilities, he said. In addition, Claroty pursues acquisitions that can help them expand into new verticals or geographies such as the public sector or data centers where Claroty wants to grow, Vardi said.

“Once you identify these target companies, you approach them – usually for a partnership – and we basically present to them the acquisition thesis, and we get their response,” Vardi said. “And then we start to interact and get to one that we are focusing on.”

Why Manual Asset Mapping, Vulnerability Analysis Don’t Work

Manual asset mapping and vulnerability analysis don’t work at the scale and speed needed in modern industrial environments. Claroty parses OEM data, tracks naming discrepancies and informs customers of what their assets are, what risks they carry and how to address them, Vardi said. The firm’s AI assistant will enable users to ask natural language questions and receive contextual, precise responses.

“If you don’t have the AI model that continues to discover, link and assess you won’t be able ever manually to do it to all the assets in the universe,” Vardi said. “And then we also link it to other value sources like threat intel. It’s all linked together, and you have to use AI and AI capabilities, because otherwise, you’ll always be missing something and you’re never up to date.”

Off-the-shelf IT cybersecurity tools struggle in OT environments, Vardi said, largely because they can’t interpret proprietary industrial communication protocols or identify the vast range of unique physical assets in use. Claroty’s vertical focus helps it provide process-aware risk prioritization and supports enforcement actions using whatever security controls a customer already has in place, Vardi said.

“If you are being a generic tool, you basically have a hard time to map the network with all the physical assets,” Vardi said. “Our research team, Team 82 – that’s what they do. They identify these communication protocols that are proprietary. So, when I say verticalization, first step is really to identify these assets. Because of our expertise, we know what the critical processes are.”

Mitsubishi’s proposed buy of Nozomi and ServiceNow’s proposed buy of Armis means the Claroty rivals are now subject to the priorities of their parent companies, which may create gaps or limitations in how quickly they can evolve. Meanwhile, Claroty retains full autonomy over its road map and vision, allowing the company to push boundaries on product innovation, market entry and customer-specific solutions.

“If the competitive landscape is now going through consolidation, they will have to adjust to the strategy of the parent company,” Vardi said. “For us, it’s great that we’re becoming one of the few leaders that are being owned and managed independently, focusing on innovation and pushing forward as a market leader. It’s always good to see how hot the market is.”