.png)
Cybellum provides a one-stop central management platform for product cybersecurity for today's most sought-after connected products, such as V2X, IVI, intelligent driving, and IoT, which require high levels of security. Cybellum leverages industry-leading Cyber Digital Twins and binary file analysis technology—without requiring source code!—to deliver comprehensive product security solutions spanning the entire lifecycle from design and development through post-production operations. Cybellum Product Security Assessment is used during the design and development phase (Pre-SOP) to provide automated vulnerability management, identifying cyber risks in the binary code of large software components. Cybellum Product Security Operations is used for post-production security operations, continuously monitoring all components and products after production to detect new vulnerabilities and threats in public, private, and dark web resources, and tracking changes in the severity of previously known vulnerabilities. Cybellum is now widely adopted in safety-critical industries such as automotive, industrial, and healthcare, meeting relevant cybersecurity compliance standards including ISO/SAE 21434, IEC 62443, and UL2900.
In the automotive sector, with the implementation and promotion of the ISO/SAE 21434 automotive cybersecurity standard, vehicle cybersecurity is bound to become a key focus. Cybellum provides automotive OEMs and suppliers with an integrated platform solution covering the entire automotive lifecycle, including security management, SBOM management, network compliance, vulnerability management and detection, security incident response, and license management. Cybellum automatically scans and analyzes embedded software components (such as ECUs and firmware) to accurately detect cybersecurity vulnerabilities and policy violations, and provides actionable remediation recommendations. Leveraging its core Cyber Digital Twins™ technology, Cybellum can precisely map the composition of automotive components, analyzing their structure and characteristics, including hardware architecture, operating systems, software bill of materials (SBOM), licenses, configurations, control flow, API calls, and more. The Cybellum Digital Twins™ platform provides comprehensive visibility and convenience for your vehicle cybersecurity, ensuring cybersecurity throughout the vehicle's lifecycle without interfering with design, development, or production speed.
Core Values
-
Centralized management of OEM and supply chain security
-
Providing complete visibility into product cybersecurity
-
Quickly meet product cybersecurity regulatory requirements
-
Automation reduces manual processes and safety inspection workload
-
Reduce product cybersecurity risks and accelerate product release
-
Continuously ensure product safety throughout the entire product lifecycle
Advantages and Highlights
-
Direct analysis of binary files without source code
-
Cybellum provides cybersecurity solutions specifically designed for automobiles.
-
Covering design, development, and post-production operations to continuously ensure network security
-
Accurately detect security vulnerabilities in open source components and custom code
-
Cybellum automatically classifies vulnerability priorities based on context awareness
-
Cybellum supports detection of open source components (OSS) from code snippets
-
Provide detailed repair recommendations and documentation
-
Cybellum implements unified cybersecurity standards and policies and provides continuous monitoring
-
Centrally manage security vulnerabilities in components provided by OEMs and suppliers
-
Cybellum provides comprehensive analysis and management of software bill of materials (SBOM)
-
Combining static and dynamic analysis technologies, false positives have been reduced by 80-90%
-
Comprehensive coverage of open source components, proprietary code, hardware configurations, operating systems, and other components
-
Cybellum seamlessly integrates CI/CD DevOps and common third-party management systems
-
Cybellum widely supports various operating systems and chip architecture platforms.
Key Features
-
Safety Management Center
-
SBOM Management
-
Cybersecurity Compliance
-
Vulnerability Management
-
Vulnerability Detection
-
Incident Response
-
Software License Management
-
Safety Management Center Cybellum discloses the most critical issues and makes more reasonable decisions through a centralized dashboard built specifically for product security managers.
Comprehensive risk coverage
Cybellum automatically detects, prioritizes, and mitigates software vulnerabilities, zero-day vulnerabilities, malware, and security vulnerabilities throughout the entire product development lifecycle.
Compliance verification
Ensure compliance with industry regulations, standards, and your own safety and licensing policies.
Customizable strategies
Use Cybellum's default settings or customize configurations based on your risk scoring logic, thresholds, security policies, automated workflows, and more.
-
SBOM Management
Cybellum automates the entire software bill of materials (SBOM) analysis process, from merging multiple SBOMs to verification and collaboration, for all business units and product lines.
Create and merge
Automatically create detailed SBOMs, extract SBOMs from numerous other sources, and aggregate them into a unified repository.
Verification, approval, and collaboration
Cybellum supports editing, validating, and approving SBOMs and vulnerability exploitability exchange (VEX) reports for any product or component, then generating reports to share with internal and external stakeholders.
Automated processes
Cybellum makes the entire process more controllable and visible by tracking the SBOM verification process across teams, business units, and product lines.
-
Cybersecurity Compliance
Cybellum quickly and easily meets regulatory requirements with over 50 built-in standard mappings and one-click compliance reporting.
Automated network compliance
Cybellum quickly identifies cybersecurity compliance gaps by comparing built-in regulatory requirements with vulnerability assessment results, and the entire process is automated.
Keep up with new standards
By automatically integrating new and existing regulations, standards, and best practices such as FDA Premarket Guidance, WP.29 R155, and IEC 62443 into your workflow, Cybellum enables you to stay on top of new regulatory requirements at all times.
Easy documentation
With a single click, you can create preliminary reports and retain records of all evidence and relevant regulatory data for each product line and business unit for historical and auditing purposes.
-
Vulnerability Management
Cybellum automatically detects and prioritizes security vulnerabilities in the context of your specific products, greatly accelerating the risk mitigation process.
Understand your actual risk
Create detailed vulnerability assessment results and compare them with Cybellum's proprietary product vulnerability database to identify the vulnerabilities most relevant to your products.
Provide mitigation recommendations
Understand how to accurately fix each vulnerability and share these insights with colleagues to accelerate the remediation process.
Continuously monitor risks
Cybellum automatically analyzes new software updates, component versions, and vulnerabilities in production devices.
-
Vulnerability Detection
Cybellum identifies and mitigates security vulnerabilities in proprietary and third-party code using a sophisticated, dynamically verified engine based on binary files.
Automated testing
Utilize the product security platform's rich risk assessment data and automate most of the vulnerability detection process to save resources and reduce detection time.
Reduce false positives
Cybellum's dynamic verification analysis technology ensures that you find the most relevant security vulnerabilities in your devices, accelerating vulnerability detection and remediation and speeding up time to market.
Platform-independent
Cybellum supports a wide range of CPUs and MCUs, enabling you to quickly analyze security vulnerabilities in various products and components.
-
Incident Response
Cybellum receives contextual alerts and facilitates comprehensive investigations, enabling you to remain secure long after product release.
Accurately identify affected products
Accurately identify which products or components are affected by new vulnerabilities or regulations, filter out distracting information on a centralized platform, and facilitate detailed investigations.
Automated PSIRT Work
Eliminate noise to identify the most critical vulnerabilities in your products. Cybellum integrates seamlessly with your SIEM, SOAR, and other operational systems to quickly remediate incidents.
Promote the entire investigation
Cybellum provides a workbench for creating and managing investigations, including the entire process from collecting relevant information to formulating analyses and opening relevant tickets. Finally, customized reports are generated for each stakeholder.
-
Software License Management
Cybellum automatically verifies software licenses and enforces license policies, reducing open source legal risks.
Use built-in policies
Quickly identify license legal violations using Cybellum's out-of-the-box built-in license policies or customize them on demand.
Automatic verification policy
Quickly identify and resolve license discrepancies using detailed SBOM and product system data to significantly reduce legal risk.
Document
With documented evidence to support audits and litigation, Cybellum makes the legal licensing process easier.
Supported Environment
File formats supported by Cybellum SBOM detection:
File system and image files | • ext2/3/4 • ISO 9660 / UDF (.iso) • JFS, JFFS2, YAFFS • Macintosh HFS, APFS, .dmg • QNX—EFS, IFS • UBIFS • Windows Imaging (WIC) • btrfs • CramFS • DOS MBR • minix • reiserfs • SquashFS • xfs |
Compress and archive files | • 7-Zip (.7z) • AR archive • ARJ (.arj) • bzip2 (.bz2) • Compress (.Z) • cpio (.cpio) • Gzip (.gz) • lrzip • LZ4 (.lz4) • LZH (.lzh) • lzip • LZMA (.lz) • lzop • PLF Parrot • RAR (.rar) • rzip Cybellum Platform 1 • TAR (.tar) • XAR (.xar) • XZ (.xz) • ZIP (.zip, .jar, .apk, others) • StuffIt • xStandard (.zst) |
Installation files | • Self extracting .exe • Debian package (.deb) • Red Hat RPM (.rpm) • Windows installers (.exe, .msi, .cab, .mzz) • InstallAnyware • Install4J • InstallShield • InnoSetup • Nullsoft Scriptable Install System (NSIS) • WiX installer • FreeBSD UFS • InstallAware • Citrix• TAP (ZX Spectrum) • ZPAQ • ACE • ZOO • UBIQ • Advanced Installer • IPMI firmware • Compact DEX • CBFS Coreboot • HikVision DAV • DLINK SHR • SIEMENS LAD • PyInstaller • QtInstaller • SWFL (BIN/HAR) • CAB Install Shiled |
Firmware file | • Android OTA file Cybellum Platform 2 • Dahua • DJI • Intel HEX SREC (SRECORD, S19, S28, S37) • ODX • U-Boot Ambarella (.a9s, .a9h, romfs) • TPLink WR702n image • TRX UEFI firmware • VBF • VxWorks ROS • Xerox DLM • ELF Executable and Linkable Format • PDB |
Mobile application files | • Android (boot, sparse image, backup file) • Android APK • IPA (iOS App Store Package) |
Virtual file | •QEMU Copy-On-Write (.qcow2) • VMware VMDK (.vmdk, .ova) • VirtualBox (.vdi) |
Microcontroller files | • .bin • .hex • .s19 • .s • .s1 • .s2 • .s3 • .sx • .srec • .elf |
Languages, architectures, and operating systems supported by Cybellum SBOM detection: (Since SBOM detection based on binary files does not heavily rely on these environments, the actual scope of support exceeds the list below.)
Supported languages | • Assembly • BASIC • C • C++ • Delphi • Go • Haskell • Java • JavaScript • Lisp • OCaml • Objective-C • Python • Qt • Rust • Swift |
Supported operating systems | • Standard Linux distributions (Ubuntu, RHEL, SuSE) • Automotive Grade Linux (AGL) • Android • QNX • Windows server and client OSes (XP, 2016, 2019) • iPhone iOS • VxWorks • Zephyr • Thread-X |
Supported architectures | • Intel x86/x64 • ARM Cortex-M, -A, -R • PowerPC, PowerPC VLE • NVIDIA AGX Xavier • Renesas RH850, V850, SuperH • Infineon TriCore • MIPS • NXP |
Related
