What is Cybellum?
Cybellum enables manufacturers to develop and maintain secure connected products. Their cybersecurity management platform lets product security teams control risk throughout the product lifespan. By generating a Cyber Digital Twin, an identical replica of each device component used for security analysis, Cybellum enables risk assessment and vulnerability management without accessing the device hardware or source code.
The current landscape
With devices becoming more software driven and hyper connected, there is a growing risk of software vulnerabilities being introduced and exploited by malicious actors. This is further aggravated by the complexity of device software, with its blend of software components of proprietary, open-source and commercial nature. Cybellum can see that the risks are very real - they've seen this with critical infrastructure via the Colonial Pipeline cyber security breach, the dramatic increase in IoT-centric attacks within the healthcare space and smart/connect vehicles, that are essentially connected data-centers on wheels, are just as susceptible to cyber attacks. Policy makers and regulators are responding to these concerns via cybersecurity-centric initiatives, regulations and standards intended to firm-up software supply chain security (e.g. the Cybersecurity Executive Order EO 14028), and make cybersecurity a top priority just as functional safety is (for example, the FDA's pre-market assessment guidelines for medical devices or the UNECE WP29 R155 regulations for vehicle cybersecurity).
Device manufacturers in the medical, automotive and industrial space are realizing that a reactive approach to cybersecurity is no longer possible (in part due to the above mentioned regulatory requirements), and are baking in security development processes and cyber risk assessment procedures throughout the entire product lifecycle (from design and development to post-production security monitoring and incident response).
The founders of Cybellum
Cybellum was founded in 2016 by Slava Bronfman (CEO) and Michael Engstler (CTO), both ex-military (Israel Defence Forces) cybersecurity experts. Their vast experience in embedded systems and vulnerability assessment led them to build a platform that researches and analyzes the closed binaries of device software components to discover vulnerabilities and propose applicable remediations, without ever accessing the source code of these software components.
How Cybellum works
Cybellum's mission is to transform product security at scale, bringing the visibility and accountability needed for board-level governance and the accuracy and agility required to proactively secure connected devices. The Cybellum Cyber Digital Twins™ platform eliminates cyber risk and facilitates compliance from the earliest stages of design and development all the way through integration and post-production. At the heart of the offering lies the Cyber Digital Twin - a detailed representation of a product's software components make-up including the software bill of materials, versions, licenses, hardware architecture, OS’s configurations, encryption mechanisms and keys, control flow, API calls, and more.
Once generated, Cyber Digital Twins are continuously assessed for the presence of vulnerabilities and zero-days using constantly updated threat intelligence aggregated from multiple private and public sources. Each vulnerability is evaluated for relevance and the risk it poses to the specific component and device involved (be it a vehicle, medical device or connected industrial equipment), presenting any resulting attack chains that could impact overall security. The Cybellum platform enables product security teams to assure that the devices they develop reach the market as securely as they can be, while complying with any relevant regulations, standard and internal policies.
But that's not enough - products that are secure now, won't stay secure over time, as new threats, exploits and attack techniques are constantly discovered. In the post-production phase, Cybellum uses a real-time threat intelligence feed to assess the Cyber Digital Twins for new vulnerabilities, severity-level increases to existing threats and new attack methods, presenting a full impact assessment on all products and providing mitigation recommendations.
The company today
Today Cybellum is a 50 person company, HQed in Israel (Tel-Aviv) and offices across the world - US, Germany, Japan and China. Cybellum is proud to serve some of the leading device manufacturers in the world, including Nissan, Harman, Audi, Jaguar-Landrover, IAI-Elta and many others. Cybellum was recently acquired by LG Electronics.
Customer story
APAC-based Automotive Component Manufacturer - Case Study Customer:
"Cybellum’s highly accurate assessments and automation enable us to meet deadlines and regain control over our own supply chain… we are also able to consistently track and advance our company's cyber security posture.”
Security Manager, Automotive Tier-1 Supplier Challenges:
There are highly manual and inaccurate analysis of software vulnerabilities, inconsistent security validation of a diverse product portfolio, minimal visibility to the security status of engineering programs, and an inability to validate adherence to internal policies. The solution is with Cybellum, a centralized vulnerability management platform for all development programs. Cybellum has automated security validation of 1st party code and supplier deliverables, policy compliance validation (coding standards, privacy leaks, security standards etc.) context-based prioritization focuses resources on the most relevant issues, remediation guidelines assist in resolving vulnerabilities quickly and efficient BI Dashboards track the security status of different product lines supporting both management and product security teams. This results in -60% reduction in false positives x15 faster vulnerability assessments, and detects previously unseen "false negatives." There is continuous overall improvement in the cybersecurity status of the organization and the products it develops
The team culture
Cybellum builds the technology that powers a safer, more secure future for connected devices. Putting the best minds and coolest technology together, they are driving product security into the future. Cybellum's core cybersecurity experts obtained their experience with the technical intelligence units of the Israeli Defense Forces. True innovation requires full autonomy, so each member of the team is given control over their own project so they can own everything they do. But they do so with the full backing and support of the entire team. Cybellum also believes transparency is essential to visionary work. They are fully open about the state of the business, potential investments and upcoming marketing strategies. This way, teams aren’t just learning about technology, they’re also experiencing first-hand how the business of startups works. Last, but not least, the Cybellum team truly likes to work and have fun together. They take lightheartedness seriously (if you can’t have a beer and play Settlers of Catan with your boss, what’s the point, right?).
check them out: https://cybellum.com/