From CVE to Risk Decision: Integrated Vulnerability Management in Your TARA

New vulnerabilities from external sources such as CVE databases, vendor advisories, or internal security analyses can be imported on a per-project basis with the new vulnerability management feature and automatically mapped to the affected components in your own development.

A product-specific risk assessment of the new vulnerability can then be performed — a major advantage when it comes to making well-founded statements about its actual relevance.

As soon as a vulnerability is assigned to a component, CYMETRIS checks whether and how it affects existing attack paths. Relevant vulnerabilities can be fed into the attack path analysis as additional data points — either as a new entry point that did not exist before, or as a new way to circumvent an existing protection mechanism.

With this continuous update of the risk landscape across the entire product lifecycle, keeping the TARA up to date becomes intelligent and, above all, efficient: when the threat landscape shifts due to a newly discovered vulnerability, the TARA reflects this immediately — required mitigation measures can be triggered right away and forwarded with all relevant information attached. The feature is currently available to selected customers in a prototyping phase and will be rolled out globally in the near future.

Accompanying AI assistance functions, which will noticeably simplify day-to-day work in vulnerability management, are also ready to launch.