Claroty for Healthcare: The hospital's missing map

The awkward discovery at Quirónsalud was that different hospitals could have overlapping IP addresses. Machines were talking, but their identities were muddled. For a hospital group trying to divide its networks into sensible security zones, that is an unfortunate starting point. Imagine issuing backstage passes before anyone has agreed on the cast.

Claroty for Healthcare makes its living in this gap between owning equipment and understanding it. Its customers are healthcare organizations; its users include security specialists, network engineers, biomedical technicians and facilities teams. Each has a different reason to ask what a machine is doing. The intriguing proposition is that they can begin with the same evidence.

A boundary needs a map

Quirónsalud’s existing network access control project had struggled with incomplete visibility and inconsistent infrastructure. Claroty’s discovery work exposed aging devices and switches as well as the overlapping addresses. The resulting inventory helped teams put equipment into appropriate virtual networks, establish communication policies and advance segmentation. The published customer account places the start of the relationship in January 2022 and reports progress across dozens of care centers by November.

There is a useful sequence here for any buyer: identify the device, understand its conversations, then decide which conversations should continue. A rule written too early can interrupt the very workflow it is supposed to protect. In healthcare, the networking team needs the biomedical team’s knowledge of how equipment supports care before tightening those rules.

The hospital extends past the bedside

Claroty’s industrial background helps explain its view of a hospital. An infusion pump belongs on the map. So do ventilation controls, electrical systems and other connected building equipment. These are cyber-physical systems: software and networks attached to things with physical jobs. Keeping care running involves more than protecting the patient record.

The parent company was founded in 2015 by Amir Zilberstein, Galina Antova and Benny Porat. Antova previously established and led industrial security services at Siemens. Clinical expertise arrived through Medigate, whose acquisition Claroty completed in January 2022. Medigate brought knowledge of medical workflows and proprietary device protocols. That combination gives the healthcare business an intelligible position: clinical equipment within a wider operational environment.

Claroty’s stated culture puts customers and people alongside integrity and excellence. The product offers a more concrete expression of that ambition: teams with different responsibilities can work from a shared inventory. Whether they actually do so remains an organizational choice. A dashboard cannot appoint the person responsible for an overdue device replacement.

A device identity becomes a decision

xDome for Healthcare is a modular SaaS platform. Discovery uses passive observation and safe queries, enriched by device-protocol knowledge. Exposure management helps prioritize remediation; network protection supports segmentation; threat detection monitors suspicious behavior. Operational efficiency adds utilization and lifecycle intelligence. Secure Access controls remote connections for employees and outside vendors, with privileged access, identity governance and auditing.

These functions address different questions. What is connected? Which exposure deserves attention? What traffic is legitimate? Who should be allowed to service a device? Claroty announced full native integration of xDome and Secure Access in June 2026, connecting remote access more closely to asset context. The purpose is to make the permission decision better informed.

Integrations help turn observation into work. Accruent receives asset attributes; Nuvolo connects device information with maintenance records; Aruba integrations support network workflows. The commercial model is enterprise software sold through sales conversations and partners. Buyers should evaluate the modules and deployment architecture against their own environment. Claroty’s on-premises CTD product is a separate offering from SaaS xDome.

One percent can command the queue

Claroty’s Team82 analyzed more than 2.25 million medical devices across 351 healthcare organizations for its 2025 exposure report. One percent combined known exploited vulnerabilities associated with ransomware and insecure internet connectivity. Those devices appeared in 89 percent of the organizations studied. A small share of assets could therefore create a widely distributed problem.

This is vendor research describing the analyzed population, rather than a census of every hospital. Still, it suggests a practical ordering principle: combine vulnerability information with reachability and clinical consequences. Team82 also publishes research tools on GitHub. The company’s expertise includes investigating the devices themselves, alongside selling software to the people responsible for them.

For a proof of concept, ask the vendor to identify equipment your biomedical team already knows well. Compare the output with maintenance records. Then test a proposed policy against a real clinical workflow. Budget for the subscription, integration work and staff time together. Measure progress in resolved exposures and usable records; a larger discovered-device count is only the beginning of the exercise.

The security budget meets the maintenance bill

The financial wrinkle appeared in Quirónsalud’s biomedical work. Device utilization data gave the team evidence to negotiate lower maintenance fees with suppliers. Equipment could carry a fixed service charge regardless of how heavily it was used. Understanding usage made that discussion more informed. Customer-reported savings provide an appealing second reason to maintain an accurate inventory.

“I never expected us to be able to do that.”Pau Giménez, Quirónsalud Chief Biomedical Officer, on negotiating maintenance fees

Useful evidence should survive a little skepticism. Claroty’s healthcare product received five consecutive Best in KLAS awards from 2021 through 2025, including its Medigate lineage. In 2026 it was named a Top Performer, scoring 92.5 out of 100. That recognition reflects customer evaluations; it does not promise that another hospital will achieve the same implementation results.

Armis, Palo Alto Networks and Forescout offer overlapping healthcare security capabilities. Buyers can compare identification accuracy, clinical context, integrations and support for their actual equipment. Claroty’s case is strongest where medical devices and facilities infrastructure need attention together. Its map becomes valuable when people use it to change policies, resolve exposures and make purchasing decisions. The work still requires compatible controls, clinical validation and teams willing to act.