Claroty Product Security

Vulnerability Disclosure Guidelines

Security vulnerabilities in Claroty products and services will be assessed, mitigated, and/or remediated within the applicable timeframes, and as comprehensively as possible in order to ensure the safety and reliability of our products, and maintain the trust of our customers. 

Vulnerabilities, Products in Scope

Claroty’s Vulnerability Disclosure Policy covers Claroty xDome, Claroty xDome Secure Access, Claroty Continuous Threat Detection (CTD), and our web-based properties. 

We urge anyone reporting vulnerabilities to Claroty to submit comprehensive disclosure reports through secure channels. 

Submit reports directly to psirt@claroty.com. 

Existing customers may open a support ticket. 

Coordinated Disclosures

Claroty follows industry standard coordinated disclosure practices in order to transparently analyze, resolve, and report vulnerabilities discovered in our products and services. Vulnerability reporters and our customers can expect the following activities for any coordinated disclosure:

• Once a disclosure has been evaluated, we rate and prioritize vulnerabilities using CVSS, EPSS, and other industry-recognized best practices

• Work toward the assignment of a CVE for confirmed vulnerabilities

• Provide mitigations, updates or fixes for vulnerabilities in supported versions of our products or services

• Expedite updates for high-risk, high-impact vulnerabilities

• Notify customers of new vulnerabilities and remediation information

• Work with vulnerability reporters on public disclosures

• Acknowledge vulnerability reporters in any public vulnerability advisory