Blog
Cyber Security
The TARA Arrives, Its References Don't
Why a TARA loses its references on the way from supplier to OEM, what openXSAM gets back, and why that takes a model.
Read Article
Jens Bühl
8 min readitemis SECURE
Mastering cybersecurity risk
Create individual, consistent threat and risk analyses with minimal effort and adapt them within seconds. Threat modelling and risk assessment – verifiable and efficient – thanks to intelligent AI integration.
itemis references
Analyze. Assess. Prove. Secure.
itemis SECURE is an AI-powered platform for threat analysis and risk assessment (TARA). It lets you model systems, identify threats and assess cybersecurity risks to ISO/SAE 21434, IEC 62443 and CRA. The results are available as consistent, audit-proof documentation.
Changes to the system can be carried into the analysis within seconds, and AI assistants speed up recurring tasks.
Book a demo
Compliance
Multi-standard support
itemis SECURE supports you in meeting the central cybersecurity standards – efficiently, verifiably and at scale.
ISO/SAE 21434
The automotive industry must demonstrate cybersecurity under ISO/SAE 21434 and UNECE R155. The challenge is time-consuming, fragmented and error-prone manual TARAs across multiple product lines and versions.
IEC 62443
IEC 62443 requires translating risk-based cybersecurity requirements into consistent, architecture-driven technical controls for complex industrial systems, while maintaining conformity and documentation.
EU Cyber Resilience Act (CRA)
The EU Cyber Resilience Act demands continuous cybersecurity across the entire product lifecycle: secure-by-design development, vulnerability management and regulatory documentation are all part of it.
DIN CLC/TS 50701
DIN CLC/TS 50701 governs cybersecurity in the railway sector and builds on IEC 62443. The challenge is to demonstrate threats and requirements consistently for the zones and conduits of railway-specific systems.
IEC 81001-5-1
Manufacturers must demonstrate the cybersecurity of medical devices under IEC 81001-5-1 and FDA requirements. This includes a documented threat and risk analysis across the entire product lifecycle.
Highly configurable
Your standard is not listed? Methods, assessment models and reports can be adapted to further standards and company-specific requirements. Get in touch, and we will set it up together with you.
Features
Features at a glance
Editions
The three editions
itemis SECURE Classic
The desktop app for threat analysis and risk assessment compliant with ISO/SAE 21434, with interactive attack tree modeling and analysis.
itemis SECURE Cloud
The hybrid approach with real-time collaboration: work on multiple TARAs in parallel and automate collaboration and processes.
itemis SECURE Lifecycle Integration
Full V model coverage from requirements to start of production, with data from existing systems in a knowledge graph.
Feature matrix
What is in which edition?
Compare the scope of itemis SECURE Classic, Cloud and Lifecycle Integration.
| Feature | itemis SECURE Classic | itemis SECURE Cloud | itemis SECURE Lifecycle Integration |
|---|---|---|---|
| Analysis & modeling | |||
| Threat analysis and risk assessment compliant to ISO/SAE 21434 | |||
| Interactive attack tree modeling and analysis | |||
| Collaboration & automation | |||
| Hybrid approach and real-time collaboration | |||
| Working on multiple TARAs | |||
| Collaboration and automation of processes | |||
| Lifecycle Integration | |||
| Full V model coverage from requirements to start of production | |||
| Integration of data and information from existing systems into a knowledge graph | |||
| Risk-based decision-making considering multiple layers of dependencies | |||
Customer success
Rely on proven TARA expertise
Insights
Insights on itemis SECURE
Jens Bühl
8 min read
Blog
Cyber Security
Threat Scenarios and Attack Paths: The What and the How of an Attack
Threat scenario, attack path and attack feasibility belong together: what makes a scenario, why the path gets rated, and how the method shifts the result.
Read Article
Jens Bühl
13 min read
Blog
Cyber Security
Asset Identification and Impact Rating: Whose Damage Are You Actually Counting?
Asset identification and impact rating supply one half of the risk value: when an element of the item becomes an asset, whose damage a damage scenario describes, why the safety rating is not security's to set alone, and what keeps ratings comparable across projects.
Read Article
Jens Bühl
15 min read
Blog
Cyber Security
Item Definition: Why the First TARA Step Decides All the Others
The Item Definition sets the quality ceiling for the whole TARA — what abstraction level is right, why SBOM mapping forces a minimum resolution, and why a living model is the foundation for API and MCP integrations.
Read Article
Jens Bühl
9 min read
Blog
Cyber Resilience Act
Living TARA: Why the Cyber Resilience Act Changes Your Engineering Process, Not Your Documentation
The CRA doesn't ask for a one-time risk analysis — it demands a permanently demonstrable security engineering process. How a Living TARA and the Security Digital Thread keep your risk picture continuously current and audit-ready.
Read Article
Dirk Leopold
6 min read
Blog
Cyber Resilience Act
CRA Risk Analysis in Excel: Start, Import, Scale
Excel template for CRA risk analysis: TARA in line with ISO/SAE 21434 and IEC 62443 — how to start methodically, what you can import, and when Excel becomes the bottleneck.
Read Article
Jens Bühl
6 min readFAQ
Frequently asked questions about itemis SECURE
What is itemis SECURE?
itemis SECURE is an AI-powered platform for threat analysis and risk assessment (TARA). Systems are modeled, threats identified and cybersecurity risks assessed. The results are available as consistent, audit-proof documentation.
Which standards are supported?
ISO/SAE 21434, IEC 62443, the EU Cyber Resilience Act, DIN CLC/TS 50701 and IEC 81001-5-1. Methods, assessment models and reports can be adapted to further standards and company-specific requirements.
Which editions are available?
Three: itemis SECURE Classic (desktop app with interactive attack tree modeling), itemis SECURE Cloud (hybrid approach with real-time collaboration) and itemis SECURE Lifecycle Integration (V model coverage with data from existing systems in a knowledge graph). The feature matrix shows the differences.
How does AI support the analysis?
AI assistants speed up the initial analysis and its maintenance, from drafting new threat scenarios to revising existing assessments. Through an MCP interface, any MCP-capable agent can work directly on the TARA model. The AI provider can be stored for the organization or for individual projects.
Can I take my TARA into other tools?
Yes. itemis SECURE exports the complete analysis and assessment model as XML via XSAM. The open exchange format openXSAM grew out of this format, and the Automotive Security Research Group (ASRG) maintains its specification publicly. In the browser, you can also download the TARA data as JSON. Reports in Excel, DOCX and PDF come on top.
Where can I find the documentation and release notes?
The user guide covers installation, licensing, method configuration and the TARA itself, up to reports and project migration. The release notes show what changed in each version.