The living CSMS backbone for automotive.

ThreatZ is an AI-powered automotive cybersecurity platform that provides end-to-end CSMS (Cybersecurity Management System) capabilities for OEMs and Tier-1 suppliers. It covers TARA analysis, SBOM management, vulnerability tracking, compliance reporting, and security operations — all unified in a single platform with a knowledge graph backbone.

ThreatZ uses AI to automatically identify assets, generate threat scenarios using STRIDE methodology, assess attack feasibility, calculate risk levels per ISO/SAE 21434, and suggest risk treatment options. What traditionally takes weeks of manual effort can be completed in hours, with full traceability from assets to cybersecurity goals.

ThreatZ supports ISO/SAE 21434, UNECE R155 (WP.29), GB 44495 (China), and the EU Cyber Resilience Act (CRA). The platform generates standard-specific work products, evidence packages for type approval, and audit-ready reports. Enterprise plans also support STIX and AUTOSAR export formats.

The SBOM module provides a complete software bill of materials lifecycle — from ingestion of CycloneDX and SPDX formats, through continuous vulnerability monitoring against NVD, CNVD, and OSV databases, to automated risk scoring with CVSS and EPSS metrics. It tracks components across ECU variants and generates VEX (Vulnerability Exploitability Exchange) documents for supply chain communication.

Yes. ThreatZ provides REST API access, webhooks, and native integrations with Jira, Azure DevOps, and common ALM tools. It supports OpenXSAM and STIX export formats for interoperability with other security tools. SSO via SAML 2.0 and OpenID Connect is available on Professional and Enterprise plans.

ThreatZ's knowledge graph is a connected data model that links every entity in your cybersecurity program — from vehicle architectures and ECU components to threat scenarios, vulnerabilities, and compliance evidence. This enables powerful traceability queries (e.g., “show all threats affecting components with known CVEs”) and ensures no gaps in your security analysis.

Absolutely. ThreatZ was designed specifically for the needs of Tier-1 and Tier-2 suppliers who must demonstrate ISO/SAE 21434 compliance to multiple OEMs simultaneously. The multi-project architecture lets suppliers manage separate TARA analyses per OEM program while sharing common component libraries and threat intelligence across projects.

ThreatZ deploys as private cloud or on-premise — air-gapped supported. Dedicated infrastructure, EU / China / US data residency options, and AWS Marketplace as a procurement channel for authoring and pilots. Same ThreatZ, two deployment modes.