ISO/SAE 21434 and IEC 62443 in Practice

The Threat Analysis and Risk Assessment (TARA) is the heart of ISO/SAE 21434. It identifies assets worth protecting, derives threat scenarios, assesses damage potential and attack probability, and prioritises the security measures from these.

In practice, TARA rarely fails at the concept level: it fails at scope and maintenance. Spreadsheet-based TARAs age quickly, quality varies depending on who carries them out, and every change effectively restarts the assessment from scratch.

itemis SECURE makes the TARA model-based: threats, attack paths and measures are anchored to a consistent model. AI Assistants propose threats and attack trees, and changes propagate through the model instead of being manually tracked. According to itemis, agentic automation reduces TARA effort by up to 80 %, with full human-in-the-loop control.

The same TARA methodology also underpins the Cyber Resilience Act: details in the spoke Cyber Resilience Act.

Where ISO/SAE 21434 addresses the vehicle, IEC 62443 covers operational technology: industrial controls, automation systems, energy supply and critical infrastructure. The standard series addresses all roles, from component manufacturer through system integrator to the asset owner who operates the plant.

Zones and conduits

The fundamental principle is segmentation. Assets with similar protection needs are grouped into zones; communication between zones runs via controlled conduits. This creates a defensible architecture instead of a flat network, often oriented around the Purdue model of manufacturing levels.

Security Level SL1 to SL4

• SL1: protection against accidental or unintentional misuse.
• SL2: protection against intentional attacks with simple means.
• SL3: protection against organised attackers with moderate resources.
• SL4: protection against state-level attackers with high effort.

Important: the security level is not a single value but a vector across seven foundational requirements. Each zone and each conduit receives its own protection level, derived from the risk, not imposed uniformly.

The relevant standard parts

• 62443-2-1: Security program requirements for the asset owner (Ed. 2, 2024).
• 62443-3-3: system security requirements and security level.
• 62443-4-1: secure product development lifecycle.
• 62443-4-2: technical requirements for individual components.

itemis SECURE is the model-based platform for both standards. Instead of fragmented spreadsheets, a living security model is created: TARA, risk assessment, measure tracking and reporting in one tool, with AI support for threat intelligence and attack trees, and with documentation that passes an audit.

The lever is reuse and maintenance. A TARA modelled once can be scaled across variants, new vulnerabilities flow into the model, and the compliance evidence is a by-product of the work, not a separate effort before the audit.

Agentic on a deterministic model

The AI support is not a bolted-on add-on. The agentic capabilities sit on a deterministic model layer, so the AI does not work in a vacuum but uses the complete TARA context. Via the Cybersecurity Lifecycle Integration, the system connects requirements, architecture components and software vulnerabilities with end-to-end traceability directly in the security model. The heavy lifting runs automated, the expert retains control, and every conclusion is grounded in real engineering data.

What the AI concretely handles

• Conversational TARA: create, edit and refine risk analyses via a natural language interface.
• Embedded TARA expert: an integrated assistant contributes domain knowledge and proactively suggests complex threat scenarios.
• Full context awareness: the engine knows requirements, SysML models and previous TARAs. All suggestions are anchored to the concrete architecture.
• Deterministic governance: every AI suggestion is checked against a model-based rule set and adheres to rule sets and industry standards.
• Human-in-the-loop: all suggestions are versioned and show where and when the AI made a proposal, verifiable, adjustable, rejectable.

Typical use cases

• TARA review and completeness check: comparison of the model against known threat patterns uncovers blind spots, missing assets and implausible attack paths.
• Agentic triage and vulnerability sync: assisted triage of SBOM vulnerabilities with automatically proposed TARA updates and extended attack trees based on new CVEs.
• Automatic item definition: accelerated generation from existing artefacts such as requirements, specifications and architecture diagrams.
• Interview mode: the agent asks targeted questions about the system and populates the model automatically, instead of sending the user through menus.

Architecture and business value

According to itemis, agentic automation reduces TARA effort by up to 80 %, with full human-in-the-loop control. This way even small teams maintain a living security posture and serve ISO/SAE 21434, IEC 62443 and CRA from one model.

itemis SECURE is used by cybersecurity teams in automotive and industry, including ZF, AVL and Sygic.