Appgate, Claroty, Dispel and ThreatLocker

About Claroty

The Claroty Platform combines asset visibility, threat detection, exposure management, network protection and secure access. The Claroty Platform can be deployed on-premise or in the cloud. The stated mission of Claroty is to secure the cyber-physical systems that underpin our lives. Claroty serves industrial, healthcare, public sector and commercial organizations that secure cyber-physical systems in their environments, described as the Extended Internet of Things (XioT).^[1][3]

Claroty says the convergence of IT and operational technology (OT) adds risk to primary revenue streams. Claroty lists regulatory pressure from NIS2, NERC CIP and sector-specific mandates among the same risks. Claroty describes IT, Biomed, Network Engineering and Facilities teams in healthcare as operating in silos without a shared security language. Claroty describes healthcare organizations using retrofitted IT security or narrow IoMT solutions to secure their connected care infrastructure.^[5][6]

The Claroty Platform uses multiple discovery methods to identify devices along with their vulnerabilities, communication pathways and other key attributes. Claroty asset discovery profiles CPS devices such as PLCs, HMIs, IIoT sensors and building management systems across more than 450 industrial protocols. Claroty provides automated asset discovery capabilities and a centralized asset inventory for IoT, IIoT, IoMT and other connected devices. The Claroty Platform scopes CPS assets in a network to identify and prioritize vulnerabilities and other exposures. Claroty prioritizes remediation based on risk scores, exploitability and business impact using its proprietary risk engine. The Claroty Platform offers over a hundred native integrations that feed alerts and vulnerability data into existing workflows.^[3][5][7][8]

The Claroty Platform uses the visibility it provides into CPS assets to define and recommend network policies. Network policies from the Claroty Platform can be monitored, refined and enforced with existing firewalls, switches or NAC solutions. Claroty defines policies for firewalls and NAC solutions to support network segmentation. The Claroty Platform includes secure access with control over third-party interactions with CPS. The Claroty Platform continuously monitors an environment for the earliest indicators of known and emerging threats. Claroty threat detection covers anomalies, policy violations and malicious activity. Claroty alerts include root-cause analyses and mapping to the MITRE ATT&CK Framework. The Claroty Platform integrates with SIEM, SOAR, EDR and other SOC technologies.^[1][3][5][8]

Claroty xDome is a modular SaaS-based solution. Claroty xDome is a Cyber-Physical Systems (CPS) Protection Platform built to secure healthcare environments. Claroty xDome provides visibility and business context for cyber-physical systems in a connected building environment. Claroty xDome has threat detection, alerting and response capabilities designed for OT environments. Claroty Continuous Threat Detection (CTD) delivers cybersecurity controls. Customers can choose where and how to deploy Claroty Continuous Threat Detection (CTD). Edge is used to enhance the visibility of OT devices by incorporating information from ICS project files. Claroty offers Claire for ensuring operational resilience and trust in an AI-powered world. Team82 provides vulnerability and threat research to Claroty customers and defenders of cyber-physical networks worldwide.^{[1][3][5][6][9][10]}

Claroty industrial offerings are for controlling, monitoring and protecting industrial control systems and XIoT assets. Claroty offers real-time monitoring for patient safety and clinical continuity in the connected care ecosystem. Claroty commercial offerings cover cyber-physical systems serving real estate properties, retail locations, data centers and other commercial facilities. Claroty public sector offerings cover defense systems, space, utilities, port, transit, building management and other public sector systems. Standard Industries is deploying the Claroty Platform across its manufacturing sites globally. Claroty CTD provides real-time monitoring in the main manufacturing environments of Pfizer.^[10]

Claroty provides expert-led deployment services that include setup, tuning and solution training. Claroty offers support, deployment and program development to all customers. The Claroty platform has technical compatibility with third-party systems. Alert and vulnerability data from Claroty can be exported to AWS Security Hub.^[9]

Claroty holds a SOC 2 certification. Claroty follows the ISO 27001 framework for information security management systems (ISMS). Claroty states conformity with ISO 27701. Claroty states adherence to ISO 27017. Claroty states adherence to ISO 27018. C5 is the Cloud Computing Compliance Controls Catalog, a standard developed by BSI for cloud service providers. Claroty participates in the Security, Trust, Assurance and Risk (STAR) program of the Cloud Security Alliance (CSA). Claroty states conformity with HIPAA. Claroty states alignment with GDPR. Claroty publishes a SOC 3 report.^[1][5][12]

About Dispel

Dispel sells OT secure remote access, connecting vendors, OEMs, and operators to critical systems and data. Dispel replaces legacy remote access tools with a unified platform purpose-built for OT. Dispel says many industrial organizations still depend on IT-centric tools like RPAM, jump servers, and VPNs for remote access, and that these tools were not built for today's OT. Dispel connects internal and external users to ICS/OT assets such as PLCs, HMIs, and SCADA. Dispel says it delivers purpose-built OT SRA for operators, engineers, and vendors, with tailored connection methods and scalable deployment.^[1][2][4][5]

Dispel Zero Trust Engine replaces jump servers, VPNs, and IT PAM tools. Dispel says every connection with Dispel Zero Trust Engine takes under 30 seconds. Dispel says its remote access supports all 65,000+ TCP/IP protocols and OT systems. Dispel says vendor onboarding needs no IT ticket and no persistent credentials, and scales to a 100-vendor surge. Dispel delivers a tiered connection suite with Browser Connect, Virtual Desktop, and Local Application options tailored to every user. Dispel Zero Trust Engine includes a lightweight app with pre-connect posture checking. Dispel says one connection option is OEM compatible, including ABB, Rockwell, Mitsubishi, and more.^[5]

Dispel says its infrastructure rotates between every session, leaving AI-driven attacks nothing to map or return to. Dispel Zero Trust Engine uses single-use pathways that are destroyed at disconnect. Dispel Zero Trust Engine can be deployed in cloud, on-prem, and hybrid models. Dispel says a deployment can go live in 3 hours and scale to 100 sites in 90 days. Dispel offers full local deployment via Dispel Site Console. Dispel provides the flexibility of customer-cloud and fully on-premises deployments.^[18]

The Dispel Wicket is the edge gateway installed on-premises that connects an installation to the Dispel Zero Trust Engine and enforces local security controls. Wickets enable secure zero trust remote access, while also allowing data collection and streaming from multiple IIoT and equipment assets to cloud services and servers, all within a single unit. Wickets can be installed at an OT DMZ, in the cloud, and on IT systems. Dispel Wickets are industrial fanless edge gateways deployable in a server racks, cabinets, VESA, and DIN mounts. Wickets can run on Ubuntu environments deployed in VMWare. Dispel also offers hardware for Wickets. Wickets are fully integrated with Mitsubishi Electric industrial devices including the iQ-R Series WinCPU R102WCPU-W. Dispel has tested the SEL-3350 line for Wicket deployments.^{[7][11][19][20]}

Session Forensics and Dynamic Risk Scoring are built into the same remote access session. Dispel tracks AAL at every login, with 11-signal risk scoring that surfaces anomalies in real time. Dispel Intelligence pulls existing Nozomi or Dragos device risk data directly into the access decision. Dispel delivers a 24/7 OT SOC as a service that monitors every connection and session. Dispel's OT-aware analysts watch every remote session, escalating alerts to your existing SIEM or SOAR.^[8]

Dispel Identity adds IAL2 through government ID validation and a biometric match. Dispel Identity extends in-person-grade verification to remote sessions, confirming a real, verified person is behind every third-party connection. Dispel says identity verification fires only when the risk warrants it, by user type, asset risk score, behavioral threshold, or geography. Dispel Identity works with Microsoft Entra, Okta, PingIdentity, SAML, OIDC, and hybrid environments. Clients choose US or EU processing for identity verification, and both meet GDPR, BIPA, and eIDAS requirements.^[9]

Dispel Compliance scores live configuration against NERC CIP, NIST, IEC 62443, and NIS2 simultaneously. Dispel exports timestamped evidence as an OSCAL Component Definition, plus CSV and PDF summaries. Dispel lists supported frameworks as NIST SP 800-53 Rev 5, NERC CIP, IEC 62443-3-3, NIS2 (EU 2024/2690), NIST CSF 2.0, and SANS ICS 5 Critical Controls. Dispel says Industrial Data Streaming enables secure, real-time transfer and industrial data integration across operational, diagnostic, and system-level sources. Dispel OTFusion is a patented OT consolidation solution that unifies applications, operating systems, and services into a single secure environment. Dispel says customers can start with a single application or data stream and scale as results come in.^{[5][10][11][12]}

Dispel names manufacturing, utilities, and energy. With Dispel's Secure Remote Access, Seadrill employees no longer have to fly out to their vessels. Dispel describes Watercare, which supplies drinking water and wastewater services to over 4 million people in New Zealand. Dispel says it adheres to SOC 2 Type 2 and ISO 27001. The company states its features are designed against NIST 800-52, 800-82, NERC CIP, and IEC 62443. Dispel includes 24/7 global support.^{[3][4][5][10][11][12][18]}

About ThreatLocker

ThreatLocker sells an Application Control suite that includes Application Allowlisting, Ringfencing and Privileged Access Management, forming the core of its deny-by-default approach to cybersecurity.

ThreatLocker lets customers define which files agents can read or modify, which applications they can launch, and where they can connect. The boundaries ThreatLocker sets for AI agents remain in force as agents invoke PowerShell, Office, browsers and other tools. ThreatLocker uses deny-by-default application control to prevent unsanctioned applications and executables from operating inside a customer environment.^[2]

Once a ThreatLocker environment is locked in, no apps, scripts or libraries can execute without the customer's explicit permission. ThreatLocker applies deny-by-default execution to unknown binaries, scripts and libraries. ThreatLocker Learning Mode automatically catalogs all apps and dependencies and recognizes over 17,000 pre-built apps. When a customer evaluates an unknown app, ThreatLocker data shows how often the app has been used, in how many environments it runs, and whether other admins have allowed or blocked it. ThreatLocker lets customers publish pre-approved applications with predefined allowlisting, application containment and elevation policies.^[3][4][5][6]

Ringfencing lets customers restrict how applications interact with files, memory, networks, scripts, cloud platforms and sensitive systems. ThreatLocker lets Word open documents but not spawn PowerShell, and lets PowerShell execute approved scripts but not initiate outbound internet connections. For privileged access, ThreatLocker grants admin rights to specific approved applications, not entire user accounts. ThreatLocker restricts elevated applications from launching other applications, creating scheduled tasks, modifying registry keys or accessing credential stores like LSASS.^[2][4][6]

On the network side, ThreatLocker enforces device-level validation across the network so that only explicitly approved devices can communicate. ThreatLocker uses dynamic ACLs that update automatically as IP addresses change, so only validated devices reach protected systems. ThreatLocker restricts administrative protocols such as RDP, SMB, WinRM and SSH to hardened, approved source devices only. ThreatLocker supports micro-segmentation to create fewer pathways for attackers to move. ThreatLocker routes all cloud traffic through a ThreatLocker-managed gateway, and cloud connections originate only from an authorized network. ThreatLocker routes every connection to SaaS applications through a ThreatLocker-managed network and allows only approved devices through. Customers catalog approved endpoints and mobile devices and specify which SaaS services and internal resources those devices may access. With ThreatLocker, the endpoint and the server establish secure outbound connections, with no need to open inbound firewall ports or deploy and maintain a VPN infrastructure.^[4][7][8]

ThreatLocker Endpoint Detection and Response (EDR) analyzes telemetry, behavioral patterns and Indicators of Compromise (IoCs). When suspicious behavior occurs, ThreatLocker automatically isolates compromised machines to cut off lateral movement. ThreatLocker detects abnormal file activity, blocks excessive file writes, restricts share access and triggers device-level lockdown. ThreatLocker detects excessive file reads or writes, triggers automatic device isolation and shuts down suspicious processes. ThreatLocker Cyber Hero Team provides hands-on technical help, strategic consulting, project management and involvement in security events, and is based in Orlando, FL.^[3][4][9]

ThreatLocker is on the FedRamp marketplace. ThreatLocker lists support for security frameworks including CIS Controls, CMMC, GDPR, HIPAA, ISO IEC 27001, NIST 800-53 and PCI DSS. ThreatLocker continuously assesses configuration posture against NIST, CIS, CMMC, Essential 8 and other benchmarks, and performs daily validation at the endpoint level to address configuration drift. ThreatLocker flags risky settings, highlights dormant admin rights and maps gaps against compliance standards. ThreatLocker logs and indexes all executable activity, file access events and network communications, and keeps them searchable. ThreatLocker develops a price quote for a plan tailored to the needs of each customer environment.^{[5][8][9][10]}