Blog
Cyber Security
The TARA Arrives, Its References Don't
Why a TARA loses its references on the way from supplier to OEM, what openXSAM gets back, and why that takes a model.
Read Article
Jens Bühl
8 min readInsights on our Products
Every insight with a product reference at a glance — filterable by itemis ANALYZE, itemis CREATE and itemis SECURE.
Product
Format
Jens Bühl
8 min read
Blog
Cyber Security
Threat Scenarios and Attack Paths: The What and the How of an Attack
Threat scenario, attack path and attack feasibility belong together: what makes a scenario, why the path gets rated, and how the method shifts the result.
Read Article
Jens Bühl
13 min read
Blog
Model-Driven Software Development
Model state machines instead of hand-coding them: using existing C, C++ and Java code directly in the model
The statechart sketch gets implemented by hand, and then the two drift apart. How itemis CREATE pulls existing C, C++ and Java code straight into the model.
Read Article
Axel Terfloth
10 min read
Blog
Model-Driven Software Development
Statechart Tools Compared: MathWorks Stateflow vs. IBM Rhapsody vs. itemis CREATE
An honest, detailed comparison of three leading statechart tools — MathWorks Stateflow, IBM Rhapsody, and itemis CREATE — covering features, pricing, and which tool fits which team.
Read Article
Axel Terfloth
8 min read
Blog
Requirements Traceability
Sit, Stay, Fetch: How to Train Your AI for ASPICE
Six guardrails for AI agents in ASPICE assessments: scripts over prompts, persisted results and progress, batching, closed questions, prohibitions, flagging.
Read Article
Pierre Dammé
6 min read
Blog
Cyber Security
Asset Identification and Impact Rating: Whose Damage Are You Actually Counting?
Asset identification and impact rating supply one half of the risk value: when an element of the item becomes an asset, whose damage a damage scenario describes, why the safety rating is not security's to set alone, and what keeps ratings comparable across projects.
Read Article
Jens Bühl
15 min read
Blog
Requirements Traceability
Link Coverage 100%, ASPICE Assessment Still at Risk.
100% link coverage does not mean ASPICE compliance. How a type check, a consistency check and a consistency score expose semantic inconsistencies with LLMs.
Read Article
Pierre Dammé
7 min read
Blog
Cyber Security
Item Definition: Why the First TARA Step Decides All the Others
The Item Definition sets the quality ceiling for the whole TARA — what abstraction level is right, why SBOM mapping forces a minimum resolution, and why a living model is the foundation for API and MCP integrations.
Read Article
Jens Bühl
9 min read
Whitepapers
Functional Safety
Unabhängigkeit als prüfbare Eigenschaft
Independence is assessed once in a DFA workshop and never revisited. This whitepaper shows how the independence premise in ASIL decompositions can be verified continuously and machine-executed using graph theory.
Download Whitepaper
German
Blog
Cyber Resilience Act
Living TARA: Why the Cyber Resilience Act Changes Your Engineering Process, Not Your Documentation
The CRA doesn't ask for a one-time risk analysis — it demands a permanently demonstrable security engineering process. How a Living TARA and the Security Digital Thread keep your risk picture continuously current and audit-ready.
Read Article
Dirk Leopold
6 min read
Blog
Cyber Resilience Act
CRA Risk Analysis in Excel: Start, Import, Scale
Excel template for CRA risk analysis: TARA in line with ISO/SAE 21434 and IEC 62443 — how to start methodically, what you can import, and when Excel becomes the bottleneck.
Read Article
Jens Bühl
6 min read
Blog
Cyber Resilience Act
CRA Reporting Obligations: Anatomy of a Notification, from Hour 0 to the Final Report
CRA Article 14 reporting obligations take effect on 11 September 2026. This article walks through the complete notification process chronologically — from the initial assessment to the final report — and identifies the points where reporting processes break down in practice.
Read Article
Dirk Leopold
12 min read
Blog
Cyber Security
What Is a TARA? And Why a Spreadsheet Eventually Stops Being Enough
A TARA is not a threat catalogue — it is an auditable record of risk decisions: what it involves, how the process works, and when Excel reaches its limits.
Read Article
Jens Bühl
6 min read
Blog
Requirements Traceability
Compliance Was Never About the Document
AI can now produce TARAs, traceability matrices, and safety cases that are structurally complete and terminologically correct. That surfaces a question worth asking: what, exactly, is being verified? The problem is not AI-generated documentation. It is compliance processes that optimize for artifacts instead of the properties those artifacts were supposed to encode.
Read Article
Florian Antony
6 min read
Blog
Model-Driven Software Development
Formal Error Detection on State Machines: What Works and What Doesn't
An unreachable transition, an unsatisfiable guard, a numeric overflow: these bugs hide in the model long before any test reveals them. A results report from two master's theses on formal error detection for state machines using symbolic execution and SMT solvers.
Read Article
Andreas Mülder
9 min read
Webinar
Cyber Security
itemis SECURE AI-Powered TARA: From Compliance to Competitive Advantage
How AI assistants reduce TARA creation from weeks to hours — and turn your threat analysis into a real competitive advantage.
Watch Webinar
Jens Bühl
Webinar
Cyber Security
TARA Automation for Automotive Cybersecurity
Learn how TARA automation with itemis SECURE (formerly YAKINDU Security Analyst) makes cybersecurity processes in the automotive industry fundamentally more efficient.
Watch Webinar
Jonathan Mohring
Webinar
Functional Safety
itemis ANALYZE ASPICE in 5 Hours instead of 5 Weeks
Forget high-stress assessments with massive teams and mountains of manual documentation. Discover how to make a leap from five weeks to five hours.
Watch Webinar
Webinar
Functional Safety
itemis ANALYZE Goes Cloud: Agentic Engineering Intelligence
itemis ANALYZE moves to the cloud — unlocking a new era of Agentic Engineering where your Knowledge Graph becomes the governance layer for your AI.
Watch Webinar
Whitepapers
Cyber Security
itemis SECURE Lifecycle Integrations
Your TARA is a compliance document. It should be the operational brain of your CSMS. This whitepaper shows how a Living Digital Thread transforms static security artifacts into a continuous, data-driven lifecycle operation.
Download Whitepaper
Whitepapers
Functional Safety
Cohesion Without Disruption
How leading OEMs and Tier-1 suppliers unite Functional Safety and Cyber Security enterprise-wide — without disrupting proven engineering environments.
Download Whitepaper
Blog
Cyber Resilience Act
The 7-Step Guide to the EU Cyber Resilience Act (CRA)
Will your product still be legally sellable in Europe after December 2027? This guide shows manufacturers how to approach CRA compliance in 7 structured steps and secure EU market access.
Read Article
Dirk Leopold
5 min read
Webinar
Cyber Security
itemis SECURE Goes Cloud
itemis SECURE is now available on the web — collaborate on cybersecurity projects simultaneously from any device, just like Google Docs.
Watch Webinar
Webinar
Model-Driven Software Development
Rapid State Machine Development and Unit Testing for Embedded Systems
See how itemis CREATE streamlines state machine development and testing in embedded systems — illustrated with a practical Turn Signal Control case study.
Watch Webinar
Axel Terfloth
Webinar
Model-Driven Software Development
Rapid State Machine Development in the Cloud with AI Co-Piloting
See how itemis CREATE enables fast statechart development in the cloud, with AI-assisted model generation and seamless Git-based version control.
Watch Webinar
Blog
Requirements Traceability
What Is Traceability? Benefits and Challenges in Software Development
Traceability is more than a compliance checkbox. Learn what it means in software and systems engineering, what insights it unlocks, and what challenges come with it.
Read Article
Florian Antony
5 min read
Blog
Cyber Security
Security by Design in the Automotive Development Process
In the automotive domain, security is becoming more and more important – especially for the new generations of connected, (semi-)autonomous vehicles. Learn how to develop a secure system design and which additional security challenges may arise.
Read Article
Dirk Leopold
9 min read
Blog
Custom Tool Development
State Machine Origami
How Franca IDL and itemis CREATE can be integrated to validate embedded software components against interface contracts interactively during development.
Read Article
Dr. Klaus Birken
9 min read
Blog
Model-Driven Software Development
Taking SCXML to the next level
How itemis CREATE adds higher-level modeling, simulation and unit testing on top of the SCXML standard.
Read Article
Andreas Mülder
5 min read
Blog
Cyber Security
Why security is one of the biggest engineering challenges ahead
In times of Spectre and Meltdown it's totally clear that security is a big engineering challenge. Learn more about safety and security in this post.
Read Article
Dirk Leopold
8 min read
Blog
Cyber Security
Secure is Secure?! Automotive Security in the Age of Connected Vehicles
The increased share of software solutions places high demands on Automotive Security. But what changes are coming for the industry and manufacturers?
Read Article
Dirk Leopold
5 min read
Blog
Model-Driven Software Development
Model-Driven Software Development meets Test-Driven Development
How to apply Test-Driven Development to model-driven software development using SCTUnit, itemis CREATE's unit testing framework for statechart models.
Read Article
Axel Terfloth
6 min read
Blog
Requirements Traceability
5 + 1 Questions a Requirements Traceability Matrix Answers
A requirements traceability matrix is not just a bookkeeping tool. Learn the five key questions it answers in day-to-day project work — plus one bonus question.
Read Article
Florian Antony
6 min read
Blog
Requirements Traceability
What Is Requirements Coverage and How Can It Be Analyzed?
Requirements coverage is demanded by process standards like Automotive SPICE, yet remains poorly defined. Learn what it really means and how to measure it properly.
Read Article
Florian Antony
6 min read
Blog
Model-Driven Software Development
Modeling with State Machines – Part 5: The State Pattern
State machines can not only be modeled. In part 5 we present the State Pattern as an implementation variant.
Read Article
Rainer Klute
11 min read
Blog
Model-Driven Software Development
How to Program a MSP430 with State Machines in 5 Minutes
Learn how to program an MSP430 microcontroller with state machines using itemis CREATE, fully integrated in Code Composer Studio – with automatic code generation and a graphical editor.
Read Article
Robin Herrmann
3 min read
Blog
Requirements Traceability
How to Create a Requirements Traceability Matrix
A requirements traceability matrix (RTM) is a simple table that establishes bidirectional traceability across your project. Learn what it is and how to build one in four steps.
Read Article
Florian Antony
5 min read
Blog
Requirements Traceability
Requirements Traceability When Maintaining Software: Measured Benefits
An empirical study with 71 subjects shows that requirements traceability leads to 24% faster task completion and 50% more correct solutions during software maintenance.
Read Article
Florian Antony
4 min read
Blog
Model-Driven Software Development
Modeling with State Machines – Part 4: The State Machine as a Table
State machines can be modeled – but how can they actually be implemented? For example with the help of state tables.
Read Article
Rainer Klute
8 min read
Blog
Model-Driven Software Development
Modeling with State Machines – Part 3: The Big Switch Statement
How do modeled state machines become program code? For example with the help of a switch statement. We show how the implementation works.
Read Article
Rainer Klute
6 min read
Blog
Model-Driven Software Development
How to Ensure Traceability for itemis CREATE
Learn how to ensure traceability for your itemis CREATE statechart models – with tool support that scales beyond manual trace links.
Read Article
Andreas Mülder
5 min read
Blog
Model-Driven Software Development
Modeling with State Machines – Part 2: Time-Controlled Triggering of State Transitions
In part 2 of the series we cover time-controlled triggering of state transitions, orthogonal regions, and composite states with subdiagrams.
Read Article
Rainer Klute
8 min read
Blog
Model-Driven Software Development
Modeling with State Machines – Part 1
How do state machines work and why should you use them? This post illustrates the modeling of a finite state machine using the example of a blind controller.
Read Article
Rainer Klute
6 min read
Blog
Model-Driven Software Development
Finite State Machine Modeling With Entry, Exit & Final States
How to use entry points, exit points, and final states in state machine modeling with itemis CREATE.
Read Article
Axel Terfloth
5 min read