CARTA: AI-Driven Adaptive Cybersecurity as a Continuous Adaptive Communications Assessment Solution

Continuous Risk and Trust Assessment – The rise of XDR in Cybersecurity

The Extended Detection and Response (XDR) market is growing rapidly, with annual growth rates exceeding 30%. This reflects a major shift in cybersecurity strategy, as organizations move away from isolated security tools toward integrated platforms.

Traditional security models, based on static trust and simple “allow or deny” decisions, are no longer effective against today’s evolving threats. At the same time, 2024 saw a fourfold increase in ransomware attacks, fueled by the rise of Ransomware-as-a-Service (RaaS). Financial institutions and healthcare providers have been among the hardest hit, suffering operational disruption and severe reputational damage as a result of security breaches.

To address this changing landscape, Gartner introduced the CARTA (Continuous Adaptive Risk and Trust Assessment) framework in 2017 as an evolution of Adaptive Security Architecture. CARTA replaces the traditional “trust but verify” model with a dynamic approach that continuously evaluates risk and trust in real time, adapting security policies according to the context and behavior of each user, device, and application.

Meanwhile, hybrid work, cloud adoption, industrial IoT, and highly distributed infrastructures have significantly expanded the attack surface. Organizations now need solutions capable of correlating telemetry across endpoints, networks, cloud platforms, and identities to detect sophisticated multi-vector attacks. According to Gartner, an integrated XDR approach has become essential as modern attacks increasingly cross multiple domains.

What are the important points related to Adaptive Risk and Trust Assessment – CARTA

AI-Powered Zero-Day Threat Detection

Machine learning (ML) algorithms analyze network traffic to detect anomalous behavior linked to unknown malware. Instead of relying on signatures, detection is based on deviations from normal activity patterns.

Unified multi-domain visibility

XDR correlates telemetry from endpoints, networks, cloud environments, and identities within a single platform. This unified visibility helps detect sophisticated multi-vector attacks that might otherwise remain unnoticed.

Understanding CARTA and Adaptive Security

1. Endpoints: Computers, servers, and mobile devices.
2. Network: WAN, LAN, perimeter, and lateral traffic activity.
3. Cloud: SaaS applications and IaaS/PaaS infrastructures.
4. Identities: Authentication systems, directories, and privileges.

Key capabilities of an XDR/CARTA solution include:

– Behavior-based detection: Machine learning algorithms identify anomalous activity without relying on known signatures, making them highly effective at detecting zero-day threats.
– Event correlation: Connecting seemingly unrelated alerts to reconstruct the full context of a multi-vector attack.
– Automated response: Containment actions such as endpoint isolation, IP blocking, and session revocation can be executed automatically or triggered with a single click.
– Threat intelligence: Enriching alerts with global threat intelligence to provide context and help prioritize incidents more effectively.
– Forensic analysis: The ability to investigate historical events in order to determine the scope and entry point of an attack.

The adoption of XDR is being driven by several factors, including the shortage of cybersecurity professionals, which is increasing the need for automation; the consolidation of security tools, helping reduce alert fatigue and the costs associated with traditional SIEM platforms; and the growing need to respond to attacks that, according to Gartner, span multiple domains 84% of the time. Gartner also predicts that XDR will become the standard cybersecurity approach for organizations of all sizes.

Continuous Adaptive Risk and Trust Assessment – CARTA’s Use cases

Protection for converged OT/IT environments, with threat detection across SCADA systems, industrial IoT, and supply chain networks.

Financial services and banking

Challenge

Cybercriminals increasingly target financial institutions. In 2024, 65% of organizations in  the  sector were affected by ransomware, making financial services one of the most heavily impacted industries by cybersecurity breaches. Groups such as ALPHV/BlackCat and LockBit have targeted banks, credit unions, and mortgage providers, causing operational disruptions lasting days or even weeks.

In addition to ransomware, financial institutions must defend against transaction fraud, credential theft, and insider threats. Regulations such as PCI-DSS, DORA, and banking supervisory guidelines require advanced detection, response, and auditing capabilities that traditional SIEM platforms often struggle to provide efficiently. At the same time,  the shortage of cybersecurity professionals makes it difficult to maintain a fully staffed 24/7 Security Operations Center (SOC).

Solution

Teldat’s CARTA solution continuously monitors network traffic to detect anomalous behavior associated with ransomware, data exfiltration, and lateral movement. be.Safe XDR analyzes transaction patterns in real time to identify fraudulent activity. When a threat is detected, Cloud Net Manager (CNM) can automatically isolate the affected network segment by dynamically adapting the SD-WAN topology, containing the incident within seconds. Integration with be.Analyzer enables the generation of audit reports required for regulatory compliance, while REST APIs allow alerts to be forwarded to existing SIEM platforms.

Why Teldat?

Teldat delivers an XDR solution fully integrated with the SD-WAN infrastructure, enabling automated threat isolation through dynamic network adaptation. Its SaaS-based model requires no additional hardware and combines machine learning-based zero-day detection with support for financial regulatory compliance.

Healthcare and hospitals

Challenge

The healthcare sector has become one of the primary targets for cyberattacks, with 92% of organizations experiencing at least one security incident in 2024, making it the industry with the highest economic impact from security breaches. Hospitals are especially vulnerable because ransomware attacks can disrupt patient care, turning cybersecurity into a matter of life and death. The rapid growth of connected medical devices (IoMT), telemedicine platforms, and cloud-based electronic health records has significantly expanded the attack surface. In addition, many medical devices still rely on legacy operating systems that cannot be easily patched. Regulations such as HIPAA and GDPR require strict protection of patient data, with severe penalties for non-compliance.

Solution

Teldat’s CARTA solution continuously monitors all network traffic, including traffic generated by IoMT medical devices. be.Safe XDR detects anomalous behavior associated with ransomware attacks or patient data exfiltration without relying on signatures that legacy systems are unable to generate. CloudWall identifies compromised devices in real time, while Cloud Net Manager (CNM) can automatically isolate them from critical clinical networks, containing threats without interrupting hospital operations. The SaaS-based architecture also enables deployment without additional hardware in healthcare environments already saturated with equipment.

Why Teldat?

Teldat protects healthcare environments containing legacy medical devices through behavior-based threat detection without requiring agents on endpoints. Its integrated SD-WAN response automatically isolates threats while ensuring continuity of patient care, with built-in HIPAA and GDPR compliance support.

Industry and OT environments

Challenge

The industrial sector accounted for 18.6% of all ransomware incidents in 2025, making it one of the most heavily targeted industries. The convergence of OT (Operational Technology) and IT networks has exposed SCADA systems and PLCs originally designed decades ago without modern cybersecurity protections. Attackers exploit the combination of legacy OT infrastructure and poorly secured IIoT devices to disrupt production, steal intellectual property, or carry out extortion campaigns. A successful attack can halt manufacturing operations for days, causing severe operational and reputational damage.

The digitally connected supply chain further increases the risk, as a compromised supplier can become an entry point into the manufacturing network. Critical dependence on uptime also pressures many organizations into paying ransoms to restore operations quickly.

Solution

Teldat’s CARTA solution continuously monitors OT/IT traffic to detect anomalous communications involving SCADA systems or PLCs that may indicate an ongoing attack. be.Safe XDR identifies industrial malware patterns without requiring agents on legacy OT equipment. When suspicious activity is detected, Cloud Net Manager (CNM) can automatically isolate the affected OT network from the Internet and corporate environments, allowing production to continue operating in isolation while the incident is investigated. CloudWall provides full visibility into connected IIoT devices.

Why Teldat?

Teldat delivers agentless OT threat detection designed for legacy SCADA environments. Its automated SD-WAN response can isolate production networks while maintaining uptime. CloudWall provides full visibility into IIoT assets and supports compliance with industrial cybersecurity regulations.