EVSec Product Security Platform

C2A Security is a product security software company headquartered in Jerusalem, Israel, founded in 2016 by NDS/Cisco veteran Michael Dick. It helps makers of vehicles, medical devices, robots and industrial IoT products manage cyber risk and prove compliance with ISO/SAE 21434, UN R155, the EU Cyber Resilience Act, FDA rules and IEC 62443.

EVSec is a risk-driven DevSecOps platform built on a shared cyber model of each product. Modules cover dynamic threat modeling and attack trees, SBOM and vulnerability management with VEX and CSAF reporting, binary and source code analysis, fuzzing in CI/CD, CAN and Ethernet intrusion detection, fleet-wide risk quantification and a compliance center that produces conformity declarations. An AI layer with MCP servers automates analysis. Users include OEMs, Tier-1 suppliers and medical device makers.

• EVSec Analysis: Dynamic threat modeling, attack trees and live risk calculation.
• BOM and vulnerability management: Triage with VEX, VDR and CSAF reporting.
• Binary and source code analysis: Detects components, secrets and CWE-mapped weaknesses.
• EVSec Attacker: Runs fuzzing and test generation inside CI/CD pipelines.
• Network and endpoint protection: Intrusion detection for CAN and Ethernet plus ECU protection.
• Compliance Center: Multi-framework reporting and conformity declarations.

A Vietnamese motorcycle or EV maker can run TARA and build a UN R155 cybersecurity management system in EVSec. A component supplier can manage SBOMs and vulnerabilities for ECUs delivered to foreign OEMs. A medical device exporter can generate FDA and CRA compliance packages from the same product model.

Teams manage threat analysis, vulnerabilities and compliance evidence in one model instead of spreadsheets and separate tools. The company states up to 70% reduction in lifecycle effort and 98-99% vulnerability noise reduction. Prebuilt regulatory workflows cover several frameworks at once, and Triumph Motorcycles adopted the platform after a proof of concept for UN R155 obligations.

UN R155 now extends to motorcycles, with deadlines for new types from December 2027, and the EU CRA adds reporting duties for connected products from 2026. Vehicle, motorcycle and electronics makers in Vietnam and Southeast Asia that export or join global supply chains need a cybersecurity management system and evidence trail that auditors accept.

Founded in 2016 by Michael Dick; headquartered in Jerusalem, Israel. Partners include Deloitte (including an alliance with Deloitte Taiwan), NVIDIA, Siemens and NTT DATA. Customer and testimonial logos include BMW, Stellantis, Aptiv, Marelli, Forvia Hella, Valeo, Harman, Elekta and Triumph Motorcycles. Shows TISAX, ISMS and GDPR badges.