Automotive cybersecurity, backed by real hardware depth.
The full ISO 21434 lifecycle
TARA workshops, cybersecurity concept, secure development guidance, and post-production monitoring — the whole road-vehicle cybersecurity engineering lifecycle, aligned to UNECE WP.29 type-approval expectations.
Consultants who can open the ECU
Our automotive work rests on real [hardware security](@/services/hardware-security.md) depth — side-channel, fault injection, firmware extraction — so a threat analysis reflects what an attacker can actually do to the electronics, not a paper exercise.
Project or retainer
Engage us for a focused piece of work — a TARA, a concept review — or as an ongoing retainer across a vehicle programme, from concept through post-production monitoring.
The problem: WP.29 turned cybersecurity into a type-approval gate
For new vehicle types, cybersecurity is no longer optional engineering hygiene — under UNECE WP.29 it is a condition of type approval, and ISO 21434 is the standard that shows you did the work. That means a defensible threat analysis and risk assessment, a cybersecurity concept traced to real requirements, secure development evidence, and monitoring that continues after the vehicle is on the road. Getting there is hard when the standard is broad and the deadline is fixed.
This is the automotive-cybersecurity practice at the offensive-security side of KnytX. What sets it apart is depth: the same team runs our hardware security engagements and can attack an ECU on the bench, so the lifecycle work reflects real attacks rather than a checklist. It shares the offensive-security foundation of our application penetration testing, and incident response is there for the day something goes wrong in the field. Browse the services hub for how the engagements fit together, or approach it from the problem side at find and fix vulnerabilities.
Engagement scope
ISO 21434 support is scoped to your programme and your stage in the lifecycle. A typical engagement covers one or more of:
- TARA workshops — threat analysis and risk assessment, facilitated with your engineers, producing the damage scenarios, attack paths, and risk ratings the standard requires.
- Cybersecurity concept — turning the TARA into cybersecurity goals and claims, and tracing them into requirements your teams can build against.
- Secure development guidance — reviewing your development and supplier interfaces against ISO 21434 work products, and closing the gaps before an assessor finds them.
- Post-production monitoring — the vulnerability-management and incident-handling process that keeps the vehicle compliant after launch.
Methodology
We work from your item definition and the WP.29 deadline backward: establish the boundary of the item, run the TARA with your engineers, derive the cybersecurity concept and requirements, and check the development interfaces produce the ISO 21434 work products an assessor will ask for. Because our team also tests ECUs and firmware directly, the risk ratings are grounded in what is actually exploitable on the hardware — not a generic library of threats.
Deliverables
You receive the work products your programme needs for its stage — TARA documentation, a cybersecurity concept and requirement set, development-interface and gap reviews, and a post-production monitoring process — each in a form your engineers and your assessor can use. Retainer engagements add ongoing review across milestones.
Timeline
ISO 21434 engagements run from a focused three-month project to a multi-month retainer across a vehicle programme, scoped to your stage and deadline. Because this is consulting, the path to start is a scoping conversation, not a checkout — request a quote and we’ll propose a scope and price within one week.