A fresh CVE lands, and a product security team has minutes to answer an awkward question: does this one actually touch our car? VicOne and CYMETRIS have wired their tools together to answer it automatically.
CYMETRIS supplies the system-level risk model built by the Munich-based cyber risk engineering firm. VicOne feeds it automotive vulnerability and software bill of materials intelligence gathered by its xZETA platform, including a proprietary impact rating and zero-day data from Trend Micro’s ZDI programme. A bidirectional API carries findings between the two, mapping them onto assets and ECUs, testing whether existing controls could be circumvented and recording every treatment decision. Architecture context travels back the other way, so a finding is judged against a system model rather than a flat component list.
The companies call the result Live TARA: threat analysis and risk assessment that stays current as software and threats shift.
Volume is the reason. An Epoch AI analysis cited by VicOne counted roughly 2,500 high and critical CVEs disclosed by 21 major technology organisations in July 2026, about 60% above June’s figure and five times the monthly high recorded before April 2026.
“Do not send us more alerts” is the message VicOne chief executive Max Cheng gives, arguing teams need to know which findings can affect a specific vehicle and what to do next.
VicOne says the workflow produces evidence for ISO/SAE 21434 and UN R155 work. Live demonstrations are scheduled for Baden-Baden’s ELIV 2026 on October 14 and 15, and for Nuremberg’s it-sa show from October 27 to 29.
