What's free, and what isn't
The Cyberismo tool and the essential content modules are free and open source. You can run them in production, commercially, for as long as you like.
The hosted service, the standards-based modules, the connectors and the training are subscription. The full list is below.
Open source
Free, AGPL-3.0, yours to run and change.
-
Cyberismo app and command line tool
Security-as-code workflows, CI/CD integration, static site and PDF export.
-
Base module
The foundation every project imports.
-
ISMS Essentials module
Asset, risk and incident management.
-
Secure Development Essentials module
Threat modelling, security requirements, progress metrics.
-
EU CRA Essentials module
The Cyber Resilience Act essential requirements.
Subscription
Quoted for your situation.
-
Cyberismo Cloud
Hosted in your own isolated tenant, with single sign-on and EU hosting. Your content stays in your own Git repositories.
-
ISO/IEC 27001 module
Full control coverage for certification.
-
IEC 62443-4-1 module
Secure development lifecycle for industrial systems.
-
IEC 81001-5-1 module
Secure development lifecycle for health software. In development and not yet available.
-
Connectors
Jira and Dependency-Track available now, priced per connector.
-
Dependency-Track as a service
Hosted by us in the same environment as your Cloud tenant, on its own subscription.
-
Cyberismo learning
Instructor-led training and self-paced online courses.
Where do I start?
Three common starting points, depending on what you are trying to achieve.
A development team getting started
Secure Development Essentials
Free
Install the tool, import the module, and you have threat modelling, security requirements and progress metrics, without buying anything or talking to anyone.
See the module →A company that needs a management system
ISMS Essentials
Free
Asset, risk and incident management, with the process documentation an auditor expects. This is the path our customer Steve the Clerk took, covering NIS2, ISO 27001, GDPR and DORA in one system.
Read how that went →Preparing for a certification or the CRA
Essentials plus the relevant module
Subscription
EU CRA Essentials is free. ISO/IEC 27001 and IEC 62443-4-1 are subscription modules, and an IEC 81001-5-1 module is in development. The open-source layer underneath them is where you start either way.
Talk to us →What the open-source version includes
The open-source Cyberismo tool is not time-limited or feature-limited. The reasoning engine, the automated policy checks, threat modelling, report generation, static site and PDF export and the MCP server are all in it. So is the web app, which runs locally on your own machine. If you would rather your team used it with just a browser, with nothing to install or run, that is what Cyberismo Cloud adds.
You can run it in production, run it commercially and fork it. Nothing essential is held back to force an upgrade, and the content you create with it is unaffected by the licence of the tool.
How pricing works
We do not publish standard prices yet, because the packaging is still settling.
What it depends on: how many people need access, which modules you need, whether you want Cloud or run it yourself, and which connectors, as those are priced individually.
What happens when you get in touch
- 01
A short conversation
Thirty minutes on what you are trying to achieve and which standards apply.
- 02
A concrete proposal
Which modules, hosted or self-run, what adoption support you would want, and what it costs.
- 03
You try it first
We recommend that your team tries the open-source version before you buy anything.
Common questions
What happens to our content if we stop paying?
It remains yours and keeps working. Your content is AsciiDoc and JSON in your own Git repositories, and the open-source Cyberismo tool still opens it, including everything a subscription module has already put into your project. What stops is updates: as standards change and our reading of them develops, you would no longer receive new versions of the module. The work you have done with it is unaffected. This is the main practical reason the content format is open.
Can we start free and move to Cloud later?
Yes, and that is the common path. The content format is identical, so moving is a matter of pointing the hosted tenant at your repositories.
Are connectors included in Cloud?
No. Connectors are priced separately, per connector. Dependency-Track as a service is also its own subscription, though we host it in the same environment as your Cloud tenant.
What is missing from the open-source version?
Nothing that would stop you using it in production. The reasoning engine, the policy checks, threat modelling, report generation and the static site and PDF exports are all in the open-source tool. It also includes the web app, which runs locally on your own machine. What you pay for is a hosted web app your team uses with just a browser, with nothing to install or run, the standards-based content modules, the connectors and training.
How much does it cost?
We do not publish standard prices yet, because the packaging is still settling. Tell us your team size, which modules you need and whether you want it hosted or self-run, and we will come back with a figure.
Contact
Cyberismo is based in Tampere, Finland. We work smoothly with teams anywhere in the world.