Claroty Startup Diligence Report
Claroty merits continued diligence as a category leader candidate in cyber-physical systems security; investment reliance should wait for ARR cohort validation, customer contract review, technical/security diligence and legal/compliance review.
Claroty Startup Diligence Report
Claroty has credible public evidence of late-stage scale, a strong CPS/OT cybersecurity positioning, named enterprise case studies and a public trust posture, but valuation, ARR quality, customer concentration, gross retention, deployment economics and audit-report exceptions remain private.
CB Insights lists $3B while SecurityWeek reports a $2.5B valuation was reported but not confirmed; full capital structure, preferences and current fair value are private.
Diligence request: Request cap table, round docs, debt/credit terms, board valuation support and latest 409A.
$100M+ ARR and Fortune 100 penetration claims are public but not supported by cohort exports, contracts, churn or top-customer concentration in public sources.
Diligence request: Request ARR waterfall, NRR/GRR, customer-contract schedule, top-10 ARR share and reference calls.
Claroty operates in industrial, healthcare, commercial and public-sector environments where misconfiguration, detection gaps or access-control failures can carry high consequences.
Diligence request: Review incident logs, SLAs, product-liability terms, deployment QA and customer escalation records.
Trust Center lists certifications but audit reports and pen tests are not public, leaving scope, exceptions and remediation unknown.
Diligence request: Review SOC 2, ISO, pen-test reports, exceptions, remediation, subprocessor and incident history under NDA.
Specialist OT-security competitors and broader security-suite vendors can challenge pricing, bundling and renewals.
Diligence request: Request win/loss, pricing-discount, competitive-displacement and renewal data.
Critical-infrastructure, healthcare and public-sector customers can impose indemnity, breach-notification, audit and procurement obligations that are not visible publicly.
Diligence request: Review customer MSAs, public-sector terms, data-processing terms, indemnities and limitation-of-liability schedules.
Public evidence supports major funding and ARR-scale claims, but valuation anchors conflict and current financial quality is not public.
partially verified confidence: medium
Claroty's public financing profile is strong, but investors need direct records to reconcile CB Insights' $3B valuation row with SecurityWeek's $2.5B reported-but-unconfirmed valuation and to validate ARR quality.
| date | event | public evidence | diligence gap |
|---|---|---|---|
| 2021-06-17 | Unicorn-list anchor | CB Insights row lists $3B valuation and first-unicorn date | Round documents and valuation support |
| 2024-03-06 | $100M strategic growth funding | SecurityWeek says total funding reached $735M and reported $2.5B valuation was not confirmed by Claroty | Security terms, proceeds, debt/private-credit components and current valuation |
Treat $2.5B and $3B as public valuation anchors, not audited fair value.
| metric | public signal | verification status | request |
|---|---|---|---|
| ARR | Exceeded $100M ARR in 2023 per SecurityWeek | partially_verified | ARR waterfall, new/expansion/churn, invoiced vs recognized revenue |
| Runway/burn | $100M strategic growth funding in 2024 | partially_verified | Cash balance, burn, debt and forecast |
| Gross margin | No public gross-margin evidence | not_publicly_verifiable | SaaS/on-prem/services gross margin by product |
ARR quality is the central financial diligence item.
Values are public anchors, not audited valuation.
Claroty publicly markets a CPS protection platform with asset inventory, exposure management, network protection, secure access, threat detection and flexible cloud/on-prem deployment.
verified confidence: high
Public product pages clearly describe modules and deployment modes, but pricing, module attach rates, implementation times and support economics are not public.
| capability | public evidence | diligence gap |
|---|---|---|
| Asset inventory | Platform page calls asset inventory critical and describes multiple discovery methods | Accuracy, false positives and deployment scope |
| Exposure management | Platform page says it scopes CPS assets to prioritize vulnerabilities and exposures | Remediation outcomes and vulnerability SLA |
| Network protection and secure access | Platform page describes segmentation policy and secure third-party access | Integration costs and access-control exceptions |
| Threat detection | Platform page says alerts integrate with SIEM, SOAR, EDR and SOC technologies | Detection efficacy and alert fatigue |
Product descriptions are public company claims.
| product or model | public signal | private data needed |
|---|---|---|
| xDome SaaS | Platform page calls xDome a modular SaaS-based cloud solution | ARR, retention, gross margin and implementation effort |
| CTD on-premise | Platform page says CTD is an on-premise deployment option | License mix, support cost, renewal rates and upgrade path |
| Professional services | Not publicly broken out | Services attach, margins and revenue recognition |
Public pages do not disclose pricing.
Simplified from public product descriptions.
Public evidence includes case studies across healthcare, data centers and industrial customers plus a reported Fortune 100 penetration claim; concentration and contract economics remain private.
partially verified confidence: medium
Public case studies show named/partly named enterprise deployments, while SecurityWeek reports 20% Fortune 100 usage; customer concentration, ACV and renewal quality are not public.
| customer or segment | public evidence | diligence gap |
|---|---|---|
| Ohio State University Wexner Medical Center | Featured case study on xDome for IoMT/IoT/OT device visibility | Contract size, duration and reference-call validation |
| PHSA and FHA | Featured healthcare case study listed | ARR and renewal status |
| Hydrovolt / data-center platform / Phlow | Case-study page lists industrial, data-center and pharma/manufacturing examples | Customer concentration and deployment outcomes |
Case studies validate customer logos/use cases, not financial concentration.
| relationship type | public signal | risk or gap |
|---|---|---|
| Technology alliances | Company navigation exposes Technology Alliance Partners | Integration depth, revenue share and co-sell terms |
| Channel partners | Company navigation exposes Channel Partners and partner login | Partner-sourced ARR and channel conflict |
| Enterprise integrations | Threat detection integrates with SIEM/SOAR/EDR and SOC technologies | Integration maintenance and vendor roadmap dependency |
Partner economics are not public.
Counts reflect cited public examples, not full customer base.
Claroty competes in OT/CPS cybersecurity against specialist OT-security vendors and broader security-platform vendors extending into industrial, IoT and healthcare environments.
partially verified confidence: medium
Public positioning emphasizes purpose-built CPS breadth and analyst recognition; competitive durability depends on protocol coverage, integrations, deployment success and budget consolidation.
| competitor | segment | overlap | diligence question |
|---|---|---|---|
| Dragos | OT security specialist | Industrial threat detection and asset visibility | Win/loss, protocol coverage and incident-response attach |
| Nozomi Networks | OT/IoT security specialist | Asset visibility, monitoring and threat detection | Customer overlap and pricing |
| Microsoft / Palo Alto / Cisco extensions | Broad security platforms | Security operations and IoT/OT modules | Bundling pressure and suite displacement |
Competitor details should be validated with win/loss data.
| axis | claroty position | risk |
|---|---|---|
| CPS breadth | Industrial, healthcare, commercial and public-sector verticals are public | Breadth can dilute product focus and increase support complexity |
| Deployment flexibility | Cloud and on-premise options are public | Dual deployment models can pressure gross margin and roadmap |
| Trust posture | Multiple certifications listed | Audit exceptions and incident history not public |
Scoring is qualitative until win/loss and customer calls are complete.
Placement is qualitative and should be verified against win/loss data.
Claroty appears to sell enterprise CPS-security solutions through direct, partner and industry-specific motions; channel economics and pipeline quality are not public.
partially verified confidence: medium
Public site navigation surfaces demo requests, case studies, partner programs, events and resources, but sales productivity, CAC payback and pipeline conversion are private.
| channel | public evidence | diligence gap |
|---|---|---|
| Direct enterprise sales | Request-a-demo and enterprise case studies | Sales productivity and pipeline conversion |
| Technology alliances | Technology Alliance Partners navigation | Co-sell terms and attach rate |
| Channel partners | Channel Partners and partner login navigation | Partner-sourced ARR, margin and churn |
Public site does not disclose channel mix.
| signal | public evidence | diligence relevance |
|---|---|---|
| Analyst recognition | Company page lists 2026 Gartner Magic Quadrant Leader and Forrester Wave Leader badge | Supports category credibility but not conversion |
| Case-study library | Case-study page lists multiple named/segmented examples | Supports use-case breadth |
| $100M+ ARR claim | SecurityWeek reported ARR exceeded $100M in 2023 | Indicates GTM scale but needs current ARR validation |
Marketing outcomes are not public.
Public data does not provide conversion rates.
Claroty's R&D credibility is supported by platform breadth, Team82 threat research, vulnerability disclosure resources and named technology leadership, but roadmap, engineering productivity and IP ownership remain private.
partially verified confidence: medium
Company navigation and leadership pages indicate threat research, vulnerability disclosure, CTO/CIO roles and multiple discovery methods, but detailed roadmap and engineering health are not public.
| role or team | public evidence | diligence gap |
|---|---|---|
| Chief Technology Officer | Leadership page lists Amir Preminger as CTO | R&D org and roadmap ownership |
| Chief Information Officer | Leadership page lists Yuval Zilberman as CIO | Internal security operations and audit ownership |
| Team82 threat research | Site navigation links Team82, threat intelligence, vulnerability disclosure dashboard and research | Research output, disclosure SLAs and legal review process |
Technical organization size and productivity are private.
| product or research area | public signal | diligence request |
|---|---|---|
| Discovery methods | Claroty Edge, passive monitoring, safe queries, project file analysis and ecosystem enrichment listed | Coverage roadmap and attach rates |
| Compliance/security controls | SOC 2 Type 2, ISO and other certifications listed | Audit reports, exceptions and remediation status |
| Vulnerability disclosure | Vulnerability disclosure dashboard and PGP key in navigation | Disclosure backlog, SLA and legal review |
Pipeline dates are not public.
Artifact scope and exceptions require NDA.
Claroty publicly lists a deep executive team and board, including CEO Yaniv Vardi, CFO/COO Udi Bar Sela, CTO Amir Preminger and investors/directors from Team8, Bessemer, SoftBank, MoreVC, Standard Investments, Rockwell Automation and SE Ventures.
verified confidence: high
Leadership depth is visible, but tenure, founder operating roles, attrition, headcount distribution and compensation liabilities need private diligence.
| name | role | diligence gap |
|---|---|---|
| Yaniv Vardi | Chief Executive Officer | Employment terms, retention and succession |
| Udi Bar Sela | Chief Financial Officer and Chief Operating Officer | Finance controls and IPO readiness |
| Gil Gur Arie / Amir Preminger / Yuval Zilberman | CPO / CTO / CIO | Product and technology org retention |
| Upa Campbell / James Love / Shira Bar Yosef | CMO / CRO / CCO | GTM productivity and customer-success accountability |
Public page is current enough for roster, not compensation.
| area | public evidence | request |
|---|---|---|
| Board/investor governance | Board includes co-founders and directors from Team8, Bessemer, SoftBank, MoreVC, Standard Investments, Rockwell Automation and SE Ventures | Board rights, consent rights and related-party contracts |
| Workforce scale | No current headcount found in public sources in this pass | Headcount by function/location, attrition and hiring plan |
| Culture/employer signal | Company page lists Great Place to Work April 2025 | Employee survey, attrition and critical-role vacancies |
Workforce metrics require company records.
Reporting lines are inferred from executive structure, not confirmed reporting relationships.
The zero value denotes unavailable public data, not an employee-count estimate.
Public sources did not confirm an IPO, acquisition or shutdown; legal diligence should focus on security/compliance audit evidence, customer/regulatory obligations, IP ownership and IPO-preparation reports.
partially verified confidence: medium
Public evidence indicates compliance claims and possible IPO preparation, but no completed IPO; audit reports, open matters, IP schedules and regulatory correspondence remain private.
| matter | public evidence | status | request |
|---|---|---|---|
| Completed IPO/acquisition/shutdown | IPO snippets described possible preparation, not completion | No completed IPO found | Confirm corporate status, board minutes and strategic process |
| Open litigation/regulatory actions | No complete docket/regulatory search evidence in public notes | not_publicly_verifiable | Counsel open-matter schedule, reserves and regulatory correspondence |
| Security/compliance audit reports | Trust Center says reports and pen tests require NDA | not_publicly_verifiable | SOC 2/ISO reports, pen-test reports and remediation log |
Absence of public matter is not a clean legal opinion.
| topic | public evidence | risk or request |
|---|---|---|
| Certifications | SOC 2 Type 2, ISO 27001:2022, ISO 27701:2019, C5, CSA STAR, HIPAA, GDPR and SOCI listed | Review audit scope and exceptions |
| IP ownership | Not public in this pass | Request patents/trademarks, invention assignments and OSS/SBOM review |
| Critical-infrastructure customer obligations | Public-sector, healthcare and industrial markets are public | Review indemnities, breach obligations, export controls and public-sector clauses |
Compliance claims need documentary audit review.
Risk placement is an analyst judgment from public evidence.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-CLY-001 | CB Insights candidate data listed Claroty as a United States enterprise-tech unicorn headquartered in New York, valued at $3B with first-unicorn date June 17, 2021. | partially verified medium | SRC-CLY-001 |
| EC-CLY-002 | SecurityWeek reported Claroty raised $100M strategic growth funding in March 2024, bringing total investment to $735M, with a reported $2.5B valuation that Claroty declined to confirm while confirming an up-round. | verified high | SRC-CLY-002 |
| EC-CLY-003 | SecurityWeek reported Claroty exceeded $100M ARR in 2023 and claimed its solutions are used by 20% of Fortune 100 companies. | partially verified medium | SRC-CLY-002 |
| EC-CLY-004 | Claroty says it secures industrial, healthcare, commercial and public-sector cyber-physical systems. | verified high | SRC-CLY-003 |
| EC-CLY-005 | Claroty's platform includes asset inventory, exposure management, network protection, secure access, threat detection, multiple discovery methods and cloud/on-prem deployment. | verified high | SRC-CLY-004 |
| EC-CLY-006 | Claroty Trust Center lists SOC 2 Type 2, ISO 27001:2022, ISO 27701:2019, C5, CSA STAR, HIPAA, GDPR and SOCI posture, while audit reports and pen tests require NDA. | partially verified high | SRC-CLY-005 |
| EC-CLY-007 | Claroty publicly lists case studies including Ohio State University Wexner Medical Center, PHSA/FHA, Phlow, Hydrovolt and a global data center platform. | verified high | SRC-CLY-006 |
| EC-CLY-008 | Claroty company page lists multiple awards and recognitions including Gartner, Forrester, Forbes Cloud 100, Deloitte Fast 500 and Great Place to Work. | partially verified medium | SRC-CLY-003 |
| EC-CLY-009 | Claroty's leadership page lists its executive team, board and Team82/threat research navigation. | verified high | SRC-CLY-008 |
| EC-CLY-010 | Public IPO-related snippets indicated Claroty may be preparing for an IPO, but no completed IPO was found. | partially verified medium | SRC-CLY-009 |
| EC-CLY-011 | Several material diligence items, including current financials, contracts, headcount, legal matters and IP schedules, are not publicly verifiable. | not publicly verifiable high | SRC-CLY-011 |
| ID | Publisher | Title | Accessed |
|---|---|---|---|
| SRC-CLY-001 | CB Insights | CB Insights unicorn-list candidate row for Claroty | 2026-05-25 |
| SRC-CLY-002 | SecurityWeek | Fresh $100 Million Claroty Funding Brings Total to $735 Million | 2026-05-25 |
| SRC-CLY-003 | Claroty | Claroty About Us / Company page | 2026-05-25 |
| SRC-CLY-004 | Claroty | Claroty Platform page | 2026-05-25 |
| SRC-CLY-005 | Claroty | Claroty Trust Center | 2026-05-25 |
| SRC-CLY-006 | Claroty | Claroty XIoT Cybersecurity Case Studies | 2026-05-25 |
| SRC-CLY-008 | Claroty | Claroty Leadership Team | 2026-05-25 |
| SRC-CLY-009 | Public web search snippets / aggregator notes | Claroty IPO search and aggregator notes | 2026-05-25 |
| SRC-CLY-011 | GitHub Copilot diligence agent | Analyst gap log from public-source diligence | 2026-05-25 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.