Cybellum

• LG Electronics could fold Cybellum into its Vehicle Solution division and retire the standalone brand, ending the independent-entity arrangement both companies described in 2021.
• The public record could stay dormant. With no press item since September 2024 and no blog post since May 2025, a buyer has no way to confirm the platform is still advancing.
• Application security and SBOM vendors that already hold a manufacturer's budget could add binary firmware analysis and take the account.
• Vehicle makers that have completed cybersecurity type approval could treat the evidence work as a finished project and cut the recurring spend to a maintenance line.
• The medical line could stall. Cybellum's automotive page names BMW, Jaguar Land Rover, Audi, Nissan, Denso, Faurecia and Mobileye where its medical page names Dräger, Siemens, Danaher and Supermicro.
• A rival that wins an analyst category placement could take the label, since no analyst firm in the reviewed record positions Cybellum against named rivals.

Cybellum sells to the people inside a manufacturer who have to answer for the security of what the company ships, not for the security of what it runs. Its own account of the founding says the team found dedicated tooling everywhere in the product lifecycle, from product lifecycle management to quality systems and continuous integration, and nothing purpose-built for cybersecurity, which was handled manually with general-purpose information security tools.

The demand behind that pitch is written into regulation, and the regulation is checkable. UN Regulation No 155 directs approval authorities to grant cybersecurity type approval only to vehicle types that satisfy it, and to refuse approval where a manufacturer has not put satisfactory arrangements in place. On the medical side the FDA asks manufacturers for cybersecurity design, labelling and documentation in premarket submissions. THE ELEC quoted an LG spokesperson saying the Cybellum purchase would prepare LG for the vehicle requirement.

The category is younger than the problem. Cybellum tells prospective partners that product security is a relatively new and evolving field in all three of its industries, which is the shape of a label a vendor still has to teach a buyer. Independent outlets reach for a narrower one and call the company an automotive cybersecurity firm. [s2, s16, s30, s29, s21, s19]

The engine works on compiled software rather than source code. Cybellum calls the output a Cyber Digital Twin, a replica extracted from a product's binary files that carries the software inventory, version history, licences, hardware architecture and operating system configuration. It says the analysis surfaces embedded frameworks such as AUTOSAR, and that the resulting data is matched against its own product vulnerability database.

Around that engine sits the workflow a product security team runs. The platform merges inventories from binary scanners, source code and uploaded SPDX or CycloneDX files, then fixes, validates and routes them for approval across business units. Vulnerabilities are triaged in the context of a specific product version, weaknesses are handed to engineering, and compliance evidence is assembled from templates for the FDA premarket guidance, ISO 21434, UN Regulation No 155 and the EU Cyber Resilience Act.

People are part of the delivery, not an afterthought. Cybellum sells managed SBOM analysis, vulnerability management and post-production incident response performed by its own staff, and its services page argues that software alone cannot make the judgement calls. Its partner programme describes the same combination of technology and professional services as what customers expect.

The most recent published release is version 3.7 of May 2025, which added a rebuilt vulnerability engine drawing on multiple public feeds, plus milestone tracking and penetration-test reporting. Custom performance metrics inside the milestone feature and the penetration-test reports each need their own licence, arranged through an account manager. [s4, s8, s9, s5, s10, s11, s16, s31, s34, s13]

The durable half of the product and the replicable half are easy to tell apart. Reading a product's firmware into a component-level replica without its source code is slow engineering to build. Mapping published standards into report templates is not, because the standards are public and the mapping is a content exercise a funded rival can repeat.

Ownership changes the competitive picture in two directions. LG Electronics and Cybellum announced the CSMS Cockpit for automotive manufacturers at CES 2024, and Cybellum describes it as designed in a collaborative effort between the two companies. Two of the three testimonials the site rotates come from parties tied to Cybellum. One is from an LG cybersecurity team leader, and one is from Christopher Gates, a product security director who also sits on Cybellum's advisory board. The third is from Supermicro's software security team.

No third-party assessment in the reviewed record places the platform against its rivals. S&P Global covers Cybellum's partnerships as news, and no analyst firm in the reviewed record positions it against named rivals in a market landscape. The awards it displays are a Frost and Sullivan managed-services award, a 2023 Cybersecurity Excellence listing and a 2022 Global Infosec listing, all conferred by third parties and all republished on Cybellum's own pages. [s4, s9, s32, s1, s2, s5]

The named-customer record has two grades. Cybellum states outright that Jaguar Land Rover, Audi, Faurecia, Supermicro, Danaher, Rolls Royce and Mobileye use the platform, it publishes customer stories on Hyundai, McLaren and ASUS, and TechCrunch independently reported Nissan using the technology. A second set, including BMW, Denso, Siemens, Dräger and the China Automotive Technology and Research Center, appears as logos with no accompanying statement of use.

Independent corroboration exists and is old. TechCrunch reported in 2021 that Jaguar Land Rover and Nissan were using the technology and that Harman, Toyota Tsusho and PTC were partners, and S&P Global's AutoTechInsight covered a 2022 tie-up under which Steelbird would take the platform to Indian manufacturers. Nothing after 2022 in the reviewed record corroborates traction from outside the company.

The motion runs through partners as well as direct sales. Cybellum operates a partner programme for solution providers and technology integrators, and its ecosystem covers product lifecycle, application lifecycle, threat analysis, continuous integration, testing and certification tooling. Buying starts with a demo request rather than a published price. [s12, s5, s4, s6, s32, s18, s25, s16]

The founders are still running the company they sold. Slava Bronfman and Michael Engstler are listed as chief executive and chief technology officer on the about page, ten years after founding, and Infosecurity Magazine and Calcalist both report that the pair served in Unit 81 of Israeli military intelligence. Independent outlets covered the LG deal, which is the exit on their record, and the reviewed sources describe no earlier build by either founder.

The board now reflects the ownership. Alongside the two founders it seats a senior vice president who is president of LG Electronics Vehicle Solution and the head of that division's research and development. The advisory board mixes buyers with the company's own side of the table. It seats a former head of car security at Daimler, a former automotive cybersecurity vice president at Harman and a medical device product security director, alongside the founder of a security vendor and a partner at Target Global, one of Cybellum's investors.

There is a public research record behind the product, and it is thin. Cybellum publishes a disclosure policy covering both its own products and embedded products built by other vendors, commits to initiating a CVE reservation within 72 hours, and has published vulnerability research on a widely used ultrasound machine. NVD lists the company as the assigning source on a command injection flaw in a Linksys router and on a hard-coded private key in Cybellum's own air-gapped distribution, which Cybellum disclosed and fixed. [s2, s22, s20, s19, s21, s14, s6, s27, s26]

Cybellum documents its vulnerability disclosure practice in detail. The company runs a published policy with committed response times, accepts reports about other vendors' embedded products as part of its research scope, and assigns CVE identifiers as a numbering authority. One of the identifiers NVD records under its name covers a flaw in its own distribution, which is what a working disclosure practice looks like from the outside. On the compliance side it publishes two credentials on its own pages, an ISO 27001 badge and a TISAX badge.

What the public record does not show is how much of the operation is still running. Cybellum's news index carries nothing after September 2024 and its blog nothing after May 2025, and the served careers page shows no listings under its Open Positions heading. [s1, s14, s26, s36, s13, s12]

Add analyzed competitors to compare them side by side with Cybellum.

Cybellum sells to one function across three industries. The buyer is the product security team inside a manufacturer, the group that answers for the software in what the company ships rather than for the software the company runs. Its own careers page puts the range plainly, naming Audi, Rolls Royce, Danaher and Mobileye as manufacturers whose teams use the platform.

Automotive is where the evidence concentrates. The automotive page names BMW, Jaguar Land Rover, Audi, Nissan, Denso, Faurecia, Mobileye and a national automotive research centre, the medical page names Dräger, Siemens, Danaher and Supermicro, and the customer stories the company publishes are led by vehicle makers. That skew matches the regulatory pressure: vehicle makers must hold cybersecurity type approval before they can sell a vehicle, while the FDA asks medical device makers for cybersecurity documentation in their premarket submissions.

The industrial line reads as the extension of the same engine to a third buyer rather than a separate business. Its page repeats the automotive and medical capability set, framed around downtime and safety risks where the medical page names costly recalls and delays.

The differentiating work is binary analysis. Cybellum extracts what it calls a Cyber Digital Twin from a product's firmware files without needing the source code, and says that replica carries the software inventory, version history, licences, hardware architecture, cryptographic characteristics and operating system configuration. It also says the analysis recovers embedded frameworks such as AUTOSAR and gives a system-of-systems view across components.

The matching layer is built on public feeds. The May 2025 release notes say the rebuilt vulnerability engine detects 33% more issues by correlating multiple sources the company lists as OSV, Red Hat, Debian, ExploitDB and others, and by combining CPE and PURL identifiers. Cybellum presents that multi-source design as resilience against a single point of truth, written against the funding lapse in the MITRE CVE programme.

AI appears as an assistant rather than as the product. The platform pages describe AI insights that auto-fix and validate inventories and a triage assistant the company calls VM CoPilot, and the professional services page argues that software alone cannot make the judgement calls a product security programme needs.

Buying starts with a demo request. There is no self-service entry point, no trial and no published price on any page in the reviewed record, so every path into the product runs through a sales conversation.

Partners carry part of the motion. Cybellum runs a programme for solution providers and for technology partners, and describes an ecosystem spanning product lifecycle, application lifecycle, threat analysis, continuous integration, testing and certification tooling. S&P Global's AutoTechInsight covered a 2022 arrangement under which Steelbird would take the platform to Indian manufacturers.

Ownership produced a joint product aimed at the same buyers. LG Electronics and Cybellum announced the CSMS Cockpit for automotive manufacturers at CES 2024, describing it as designed in a collaborative effort, and the reviewed record documents the collaboration but not what the product has sold. One of the three testimonials the site rotates is from the parent.

No price reaches the public record. Every path through the site ends at a demo request, and the reviewed pages carry no plan tiers, no unit of pricing and no published rate for the services.

Licensing is modular underneath. The May 2025 release notes gate custom performance metrics behind a Custom Metrics licence and penetration-test reporting behind a Penetration Testing licence, and tell the reader to contact a customer success manager to enable either. Features arriving behind their own named licences is a buyer-visible fact, and the reviewed record does not say what any of them cost.

The services are presented as their own offerings rather than as part of the platform. Managed SBOM analysis, vulnerability management and incident response each have their own page, and deployment and customisation work is a fourth engagement, but no source states how any of them is charged.

The platform is software the customer's team operates, and the customer chooses where it runs: the platform page offers it on public clouds or in the customer's own datacentre. Cybellum staff then operate parts of it for customers who want that, and the services page describes managed SBOM analysis, managed vulnerability management and managed post-production incident response, all performed by Cybellum's own experts.

Deployment is a structured engagement rather than a download. The company describes a four-stage method of discovery, concept plan, implementation and monitoring, tailored to each customer's product lifecycle, application lifecycle, continuous integration, ticketing and threat-feed tooling. It also publishes a measurement framework it calls the ProdSec KPI Model for tracking a team's performance over time.

At least one deployment form is built to run disconnected. The NVD record for CVE-2023-42419 names a QCOW air-gapped distribution and a China Edition of it, which is a packaging choice the reviewed record documents without saying who runs it.

Cybellum documents its vulnerability disclosure practice in detail. It publishes a policy with committed response times, accepts reports about embedded products built by other vendors as part of its research scope, and commits to initiating a CVE reservation within 72 hours. It is a CVE numbering authority, and NVD names it as the assigning source on the records it has published. On the compliance side it publishes two credentials on its own pages, an ISO 27001 badge and a TISAX badge.

One of those records is a flaw in Cybellum's own air-gapped distribution, a hard-coded private cryptographic key that the company disclosed and fixed in a later version. Publishing a defect in the product a customer buys is a costly kind of honesty.

The integration story is the platform claim. Cybellum argues the product is more useful the more it connects, and lists integrations across product lifecycle management, application lifecycle management, threat analysis, continuous integration, testing and certification, digital twin and safety tooling. The platform page names PTC, Polarion, GitLab and Jenkins among them.

Compliance content is the second ecosystem asset. The company says it maps pre-built requirement templates for more than 50 standards and regulations, naming ISO 21434, UN Regulation No 155, the Chinese ICV standard system, the FDA premarket guidance, IMDRF, EU MDR and IVDR, and the EU Cyber Resilience Act. Customers can also load their own frameworks.

The joint work with LG is where the ecosystem reaches beyond Cybellum's own product. The CSMS Cockpit was designed by both companies and announced for CES 2024, and the announcement describes it analysing vehicle components across a lifespan of roughly twenty years.

The founders sold the company and stayed. Slava Bronfman and Michael Engstler are listed as chief executive and chief technology officer a decade after founding, and Infosecurity Magazine and Calcalist both report that the pair served in Unit 81 of Israeli military intelligence. Calcalist put the company at 50 people with 35 in the Tel Aviv research and development centre at the time of the deal, and LG's own release gave the same headcount alongside operations in Japan, Germany and North America.

The board carries the ownership. Beside the two founders it seats a senior vice president who is president of LG Electronics Vehicle Solution and that division's head of research and development. The advisory board mixes buyers with the company's own side of the table. It seats a former head of car security at Daimler, a former automotive cybersecurity vice president at Harman and a medical device product security director, alongside the founder of a security vendor and a partner at Target Global, one of Cybellum's investors.

What the reviewed record cannot show is the shape of the team now. The careers page runs from its Open Positions heading straight to an invitation to reach out, and no source in the record gives a current headcount.