CVE, KEV and EPSS
Look up vulnerability details, known exploitation and exploit probability from the served feeds.
Product cybersecurity and regulated engineering
Turn the architecture into a threat model or TARA your team can review.
Describe the system in a guided run. Team and Company can also register architecture records as private evidence. Ansvar runs the structured workflow available on your plan, then grounds the report in served security sources, product law and standards evidence you hold a licence to use.
- Public CVE, KEV and EPSS research on Free
- Structured STRIDE runs start on Free
- TARA starts on Premium
- Architecture documents on Team and Company
The run
Keep the architecture and the decision in the same review.
The workflow asks for a system boundary before it scores a threat or risk. Your engineers confirm the model and challenge the proposed findings.
- Describe the system
Provide components, assets, data flows, trust boundaries and operating context.
- Confirm the model
Review the data-flow diagram or TARA scope before the server advances the run.
- Analyse and enrich
The workflow applies its method and fetches the served sources needed for each mapping.
- Approve the register
Engineers review threats, risk bands, treatments, citations and unresolved mappings.
Served evidence
Public security facts stay available for research.
Free and Solo include structured runs from the starter workflow set. Premium adds the wider interview-grounded catalog and deeper security enrichment. Public vulnerability facts remain available on Free.
ATT&CK and ATLAS
Ground threat behavior in served technique records instead of model recollection.
CWE, CAPEC and D3FEND
Premium opens the source families used for weakness, attack-pattern and countermeasure enrichment.
CRA, UN R155 and ISO/SAE 21434
Product-law provisions remain distinct from standards evidence. Selected ISO/SAE 21434 text requires a SIS entitlement for the person or machine identity.
- UN R156
- IEC 62443 references
- NIST SP 800-30
- Current ICS advisories
Work available now
Choose the decision the engineering review needs.
Free and Solo return complete structured reports for the workflows included with those plans. Premium adds the wider interview-grounded catalog. Team and Company add registered document evidence and unwatermarked exports.
STRIDE threat model
Confirm the data-flow diagram, review the threat list, score the accepted threats and map mitigations to served controls and regimes.
Review STRIDE →Threat Analysis and Risk Assessment
Run the shared risk spine for automotive, OT, rail, robotics or UAS, with sector-specific anchors fetched from served sources.
Review TARA →Vulnerability assessment and deferral
Supply a scanner export. The workflow rescores the findings with KEV, EPSS and your context, then prepares a ranked plan or deferral record.
Review vulnerability decisions →Evidence contract
Check each mapping or leave it open.
A plausible security label does not establish a requirement. The report needs the served record behind the claim.
Resolved evidence
A reviewer can open the CVE, threat record, legal provision or entitled clause used by the workflow and compare it with the finding.
Unresolved evidence
If no served source supports a factual mapping, the workflow records the gap for engineering or legal review. It does not fill the citation from model memory.
Bring one architecture and one decision to review.
Start with a STRIDE threat model, a TARA or a vulnerability decision. Keep your model and engineering tools; add the evidence and workflow contract.