Always know where your product security stands.
Cyberismo builds security requirements, threat models and evidence into your development work and checks them continuously against EU CRA, IEC 62443-4-1, ISO/IEC 27001 and NIS2. Every status comes with the reason behind it, so you can show a customer or an auditor how you reached it.
CRA reporting obligations have applied since 11 September 2026. The rest of the Act applies from 11 December 2027. What the CRA requires →
End to end, from design to archiving
Cybersecurity work usually ends up spread across documents, tickets and spreadsheets, and pulled back together by hand whenever someone asks for the current state. Cyberismo keeps it in one linked model instead, covering the whole lifecycle of a product.
Your development process and your regulatory requirements are designed, implemented, verified and archived in that one model, rather than in a separate compliance project running alongside development.
- 01
Plan
Security policies, roles and regulatory obligations.
- 02
Design
Threat models and security requirements.
- 03
Implement
Requirements linked to issues and commits.
- 04
Verify
Reviews, tests and evidence in one place.
- 05
Release
Technical documentation, SBOM, conformity.
- 06
Maintain
Vulnerability handling and retained records.
Connectors keep the picture current
Connectors import data from the systems your teams already use and turn it into facts the reasoning engine can act on. Ticket status feeds an automatic check. SBOM vulnerabilities land beside the asset they affect. Compliance status, metrics and reports update as engineering work proceeds, so nothing has to be copied by hand into a compliance tool.
Your repository stays where it is. Content is plain text in Git, so it works with GitHub, GitLab, Azure DevOps, Bitbucket or a server of your own. It needs no connector and no migration.
Connectors pull data out of other systems. Jira and Dependency-Track now, Confluence, DefectDojo and Azure DevOps in development, and a published contract so you can write your own. Integrations →
Cyberismo also runs in your CI/CD pipeline, using the same executable against the same content repository, so checks, report generation and publishing happen on every build.
See it on a real project
The status page shows where the team stands, what still needs attention, and the reasoning behind each item.
The bar across the top is that same lifecycle, with a completion figure for each stage. Each project names the stages itself, because the stages are content rather than something built into the tool.
Working with AI assistants
AI assistants draft the work, and the logic engine checks it
Plenty of tools now offer to write your security documentation for you. The next question, which an auditor will also ask, is how you know any of it is right.
AI assistants connect to Cyberismo through its MCP server and do the tedious part: drafting documents, filling in evidence, building data flow models, chasing gaps. People stay in charge of the approvals and the decisions.
Then an Answer Set Programming engine checks the result against rules written as logic, and explains every verdict in a sentence. Nothing is marked compliant because a language model said so.
What the engine checks: structure and relationships, such as that required evidence is linked, that a reviewer is not also the document owner, that a control is in scope, and that a review happened inside its period. It does not judge whether a threat model is a good threat model. That is still your team's job.
Threat modelling that stays up to date
- Components, interfaces and trust boundaries are cards in the same repository as your requirements, controls and tests, instead of diagrams in a drawing tool that go stale.
- The diagrams are generated from the model, so they are never out of date with it.
- Risks, weaknesses and security requirements are created through the threat model, so they are linked to the right place.
- The output is usable evidence for EU CRA Annex I and IEC 62443-4-1, generated from the model rather than written up separately afterwards.
What you get
One source of truth
Policies, requirements, threat models, evidence and vulnerabilities in a single linked model.
Status without spreadsheets
The logic engine computes progress, metrics and reports, so there is no manual roll-up before an audit.
Fits how software engineers work
Security as code in Git, with connectors to the systems your teams already use.
Ready when a customer asks
Export technical documentation as a static site or a PDF whenever it is asked for.
No lock-in
An open-source tool and an open content format. Your content stays readable, and it belongs to you.
Room to grow
Start with the essentials and extend to EU CRA, IEC 62443-4-1 or ISO/IEC 27001 when you need to.
A customer running Cyberismo
“I know all the time that we've done things well enough, without having to gather evidence from multiple documents and tools. That's probably the biggest value, and it's a real selling point for our customers, too. We can tell them: you're welcome to audit us anytime.”
Juho Sirén, CEO, Steve the Clerk. He deployed and tailored Cyberismo himself, covering NIS2, ISO 27001, GDPR and DORA in one system.
Read the storyBuilt on certification projects we have run
The checklists, the templates and the logic rules in the content modules come out of the certification and audit projects our consultants ran with these organisations.
Kalmar
IEC 62443-4-1 certification for MyKalmar INSIGHT
Metso
ISO 27001 certification, ahead of schedule
Valmet
World-first web-based DCS to reach ISASecure SSA
Modulight
ISO 27001 management system
Dottir
Cybersecurity management audited two years running
Peer reviewed
The approach behind Cyberismo has been published at eSAAM '24.
Open source, with more when you need it
The tool and the essential content modules are free and open source. Run them on your own machines for as long as you like. If you would prefer not to run it yourselves, Cyberismo Cloud hosts the same application for you in the EU, with single sign-on.
Open source
- The Cyberismo app and command line tool, including static site and PDF export
- ISMS Essentials module
- Secure Development Essentials module, including threat modelling
- EU CRA Essentials module
Subscription
- Cyberismo Cloud: the hosted service in your own isolated tenant, working against your own Git repositories
- ISO/IEC 27001 and IEC 62443-4-1 modules
- Connectors for Jira and Dependency-Track, and Dependency-Track as a service
- Cyberismo learning: instructor-led and self-paced courses
Help getting started
Our consultants help teams adopt Cyberismo and tailor the content to how their organisation works, so that the capability stays in your own team. They also do the cybersecurity work behind the content: product security, secure development, threat modelling, security testing and management systems.
ServicesTraining for your team
Practical courses on secure software development, the EU Cyber Resilience Act and vulnerability management. Take them as self-paced online packages or as instructor-led classroom training. The material is the same our consultants use in customer engagements, and you can preview every course before you buy.
Learning
Contact
- 01
A short conversation
Thirty minutes on what you are trying to achieve and which standards apply.
- 02
A concrete proposal
Which modules, hosted or self-run, what adoption support you would want, and what it costs.
- 03
You try it first
We recommend that your team tries the open-source version before you buy anything.
Cyberismo is based in Tampere, Finland. We work smoothly with teams anywhere in the world.