Careers Form

" " indicates required fields

First name* 
Last name* 
This field is hidden when viewing the form
Max. file size: 256 MB.
Max. file size: 256 MB.
Untitled
Using your personal data 

We're committed to protect your privacy. C2A Security uses the information you provide to us to contact you about our products and services. You may unsubscribe from these communications at any time. For information on how to unsubscribe, as well as our privacy practices and commitment to protecting your privacy, please review our Privacy Policy .

Office Administrator

CRA compliance begins Sept 11. Are you ready? We'll show you how.
Schedule a Demo
Use Case: SBOM Creation and Management

Your SBOM is not a document.

It's a living system.

Static SBOM tools generate a snapshot and stop. EVSec creates a living bill of materials that updates automatically as your product changes, CVEs land, and regulations evolve.

Schedule a Demo
Speak to an Expert
0
Features in EVSec BOM and Vuln Management alone

4 BOM Types
SBOM + HBOM + AIBOM + CBOM in one unified view
0 +
CVE repositories scanned, enriched, and curated continuously

0
Manual steps when a new CVE maps to your components
The Challenge

Every software update makes your SBOM wrong

SBOMs are stale within days

OTA updates, new dependencies, and supplier component changes invalidate your SBOM before the ink is dry.

CVE mapping is manual and slow

When a new vulnerability lands, teams manually cross-reference CVE databases against component lists. It takes days. EVSec does it instantly.

Hardware and crypto components are invisible

Most tools only cover software. HBOMs, CBOMs, and AIBOMs are built separately, in spreadsheets, by different teams.

Regulatory formats multiply the burden

FDA VDR, ISO/SAE 21434, VEX, CycloneDX, SPDX. Each format requires a separate export process with no shared source of truth.

Why Traditional Approaches Fail

Competitors generate static artifacts
EVSec maintains a living BOM

Capability
Traditional
EVSec
BOM coverage
Software only (SBOM)
SBOM, HBOM, AIBOM, and CBOM in one unified view, with trusted accuracy, combining as-designed and as-declared analysis from both source code and binary
CVE response
Manual lookup after disclosure
Automatic mapping to affected components
Format support
One or two export formats
CycloneDX, SPDX, AUTOSAR, VEX, VDR, and more
BOM lifecycle
Point-in-time snapshot
Continuous update with versioning and policy enforcement
Regulatory output
Manual document assembly
Auto-generated FDA VDR, ISO/SAE 21434, and VEX reports
How It Works

From component ingestion to a living compliance package

1. Ingest
2. Compose
3. Scan
4. Triage
5. Report
Binaries, source code, container images, supplier BOMs imported automatically.
SBOM, HBOM, AIBOM, and CBOM assembled in an accurate, unified multi-layer view.
250+ CVE repositories scanned continuously against all components.
Vulnerabilities mapped to product context. Risk score calculated automatically.
VEX, VDR, CycloneDX, SPDX, and regulatory outputs generated on demand.
Key Capabilities

Every BOM type, every format, one living source of truth

SBOM, HBOM, AIBOM & CBOM
Software, hardware, and cryptographic components managed in one accurate, unified view. No more siloed spreadsheets.
Module:EVSec BOM & Vulnerability Management
Continuous vulnerability scanning
250+ CVE repositories scanned automatically. New vulnerability? Components identified and triage triggered instantly.
Module:EVSec BOM & Vulnerability Management
Multi-format export
CycloneDX, SPDX, AUTOSAR, VEX, VDR. Generate any regulatory format from one source of truth.
Module:EVSec BOM & Vulnerability Management
Binary SBOM extraction
Extract a complete SBOM directly from binary files. No source code required. Supports Linux, Windows, QNX, Android, AUTOSAR, and much more.
Module:EVSec Binary Analysis
AI component identification
AI auto-corrects library names and identifies components that manual processes miss.
Module:EVSec AutoSynth AI & MCP Services
Remediation workflows
Vulnerabilities assigned automatically with audit trails. Track status from discovery to closure.
Module:EVSec BOM & Vulnerability Management
Frameworks

FDA 524B

ISO/SAE 21434

EU CRA

UN R155

IEC 62443

NIST SSDF

VEX

VDR

CycloneDX

SPDX

IEC 81001-5-1

AIS 189

CISA SBOM Minimum Elements

“C2A Security probably has the best threat analysis tool in the market, which also allows for streamlined collaboration between internal and external stakeholders.”

Risk Management Lead, Product Security
Fortune100 Consultancy Firm

"The method of integration between the BOM information and the TARA is a unique differentiator of EVSec, something we haven’t seen with other vendors."

Fortune100 Consultancy Firm
US Tier 1 Supplier

"At Elekta, we’re committed to providing safe, resilient solutions to our customers. Our collaboration with C2A Security will enable us to integrate cybersecurity throughout our product portfolio, helping us meet compliance requirements while keeping our systems secure."

John Chenoweth
Chief Product Security Officer, Elekta

"We believe this integration with C2A Security will be a milestone in product cybersecurity automation and vulnerability management, aiming to better comply with UN Regulation No. 155, ISO/SAE 21434 standards, among others."

Tin N.
Director

"Thank you for this great product and your work!"

Joachim Bozler
Senior Security Expert

"That's a very cool risk management product you've got there, exactly what we need, and I haven't seen that before."

European OEM
CISO

"This is a powerful tool for any company to have, and we’re excited about the collaboration with C2A Security and the value it can bring to our customers."

Piyush Karkare​
Global Director, Automotive Solutions​

"C2A Security shares the same vision as MIH, in offering a seamless and holistic approach to automotive cybersecurity over the entire lifecycle."

Jack Cheng
CEO

"Fuzz testing, with C2A Security's solution, enables early discovery of vulnerabilities hence reducing the time needed to deliver SW and products."

Cosimo Senni Guidotti Magnani
Global Product Cyber Security Manager

"We want to apply our expertise in cybersecurity to the connected car sector. Thanks to our global Automotive Security Test Center and to our collaboration with C2A Security, NTT DATA will be an international reference point to protect connected cars from cyber-attacks and ensure the drivers' safety."

Marco Garelli
Head of Automotive

"We have deeply felt the growth of the intelligent connected vehicle business and cybersecurity is an indispensable part of the intelligent connected vehicle. The cooperation with C2A Security provides cybersecurity solutions for the whole lifecycle of connected vehicles in China. We look forward to expanding the cooperation globally and bringing the vehicle industry to a safer future."

Wenguang Wu
Executive President

"C2A Security is the future of cybersecurity, and with their technologies to automate security, together we will go further in monitoring, preventing risk, identifying and mitigating vulnerabilities."

Geoffrey Bouquot
Group Chief Technology Officer & Senior Vice President Strategy

"Our compliance package is a living system, not a static snapshot. When a CVE lands, we already know which products are affected."

VP Product Security

Tier 1 Automotive Supplier

GET STARTED

See your SBOM as a living system

Continuous BOM management. Every component, every format, every regulation.
Schedule a Demo
Talk to an Expert

Speaker Profile

Geoffrey Mann

Senior Physical Threat Analyst

Health-ISAC

Speaker Profile

John Auld

CRO

C2A Security

John Auld serves as Chief Revenue Officer at C2A Security, where he leads the company’s expansion into healthcare following the strategic acquisition of Vigilant Ops. With 20 years of experience bringing together complementary technologies across regulated industries, John specializes in helping manufacturers turn cybersecurity from a compliance burden into a competitive advantage. A mechanical engineer by training with deep expertise in product lifecycle management, John champions Dynamic Risk Management as the bridge between component visibility and actionable intelligence. His mission: enable medical device manufacturers to innovate safely without sacrificing speed or patient safety.

Speaker Profile

Ken Zalevsky

VP and GM, Medical Technology

C2A Security

Ken Zalevsky brings over 20 years of medical device cybersecurity experience to his role at C2A Security, where he serves as VP and GM, Medical Technology, following the acquisition of Vigilant Ops in October 2025. A former Bayer executive, Ken founded Vigilant Ops in 2019 after witnessing the consequences of inadequate technical preparation in the healthcare industry. He is an active contributor to CISA’s SBOM working groups and a frequent speaker on software supply chain security. Ken’s mission: transform SBOM from a compliance checkbox into operational intelligence that keeps patients safe while streamlining regulatory processes.