Claroty announces that it has updated its Software as a service (SaaS) platform’s vulnerability and risk management (VRM) tools, allowing cybersecurity teams to assess and strengthen their organization’s cyber-physical system (CPS) defenses.

The enhancements comprise a granular-yet-flexible risk scoring framework, features that enable vulnerability prioritization workflows to be more efficient than industry standards, and support for the evolving Software Bills of Materials, or SBOM, landscape.

The enhancements to xDome and Medigate, Claroty’s SaaS-based solutions for industrial and healthcare organizations, respectively, build upon already-advanced VRM capabilities to now:

  • Provide a detailed method to measure CPS risk posture: Claroty’s new risk framework is more accurate than ever because it accounts for an expanded range of factors that can increase risk, as well as compensating control improvements that can offset risk. The framework comes pre-configured out-of-the-box, so even customers who are new to CPS security can calculate their risk posture immediately and take prioritized actions to protect their operations.
  • Help customers customize CPS risk calculation: Claroty’s new risk framework allows customers to tailor it to align with their existing GRC processes and risk priorities, and to have greater control of how different factors are weighted in their CPS risk posture assessments—further empowering them to prioritize remediation steps appropriately.
  • Prioritize vulnerabilities based on exploitation likelihood, asset criticality, and impact: Claroty now automatically assigns all CPS vulnerabilities to priority groups based on the latest indicators from the Known Exploited Vulnerabilities (KEV) catalog and Exploit Prediction Scoring System (EPSS), as well as the criticality and risk of affected assets. As a result, customers can even more effectively—and up to 11 times more efficiently—prioritize the vulnerabilities that threat actors are most likely to weaponize.
  • Prepare for the CPS risk implications of the evolving SBOM landscape: As recent regulatory developments have made it clear that SBOMs are key to software supply chain risk management, Claroty now enables customers to upload SBOMs, view those uploaded by their peers, and support related workflows moving forward.

“CISOs and security teams are facing an increasingly uphill battle in mitigating the risk from obsolescent and insecure assets, as well as new vulnerability discoveries. Due to the uniqueness of CPS and critical infrastructure environments, patching everything is often impossible or too complex to execute,” says Grant Geyer, chief product officer of Claroty.

“These VRM enhancements to the Claroty SaaS portfolio further equip our customers to answer their toughest cybersecurity questions: how to accurately assess risk, and which vulnerabilities to mitigate first based on how likely they are to be exploited in industrial, clinical, or other mission-critical environments,” Geyer adds.

The KEV/EPSS, SBOM upload, and risk capabilities are all generally available now. Features enabling SBOM analysis and parsing will be available in the fourth quarter of 2023.