Careers Form

" " indicates required fields

First name* 
Last name* 
This field is hidden when viewing the form
Max. file size: 256 MB.
Max. file size: 256 MB.
Untitled
Using your personal data 

We're committed to protect your privacy. C2A Security uses the information you provide to us to contact you about our products and services. You may unsubscribe from these communications at any time. For information on how to unsubscribe, as well as our privacy practices and commitment to protecting your privacy, please review our Privacy Policy .

Office Administrator

CRA compliance begins Sept 11. Are you ready? We'll show you how.
Schedule a Demo
Use Case: Design to Postmarket Traceability

Every decision. Every change. Human or AI.

Traceable from design to field.

Regulators do not just want your final compliance package. They want to see the full chain of evidence from design intent to postmarket surveillance. EVSec maintains that chain automatically, across your entire product lifecycle, for both human and AI-driven decisions.

Schedule a Demo
Speak to an Expert

End to end
Traceability from architecture requirement to postmarket surveillance event – human or AI

Automated
Audit trail maintained without manual documentation effort

0
Evidence gaps when a regulator requests full change history

Real-time
Traceability links updated as product and security data changes
The Challenge

You can prove what you built
You cannot prove why every decision was made

Traceability links break across tools and teams

Security requirements live in one tool. Test evidence in another. SBOM in a third. AI-driven decisions in none of them. No system connects them into a single auditable chain.

Audit preparation takes weeks of manual reconstruction

When a regulator requests evidence, teams spend weeks pulling records from disconnected systems and assembling them by hand.

Product updates orphan existing evidence

Each new version creates new traceability requirements. Linking updated controls and tests back to original design intent is done manually, if at all.

Postmarket events cannot be traced back to design

When a field vulnerability surfaces, teams cannot quickly show which design decision, control, or test should have caught it. The investigation starts from scratch.

Why Traditional Approaches Fail

Point solutions track artifacts
EVSec traces the full chain of evidence

Capability
Traditional
EVSec
Traceability scope
Within a single tool or phase
End to end across design, development, testing, and postmarket
Audit trail
Manual documentation effort
Maintained automatically with every product change
Cross-tool linkage
Spreadsheet or custom integration
Native connections across threat model, SBOM, vulnerabilities, controls, and AI decisions
Version history
Stored per file, not per decision
Full change history linked to security rationale and evidence
Postmarket traceability
Reactive, rebuilt from records
Live connection from field event back to design decision
How It Works

One unbroken chain from first requirement to last field event

1. Capture
2. Connect
3. Track
4. Monitor
5. Report
Security requirements, architecture decisions, and design rationale linked at the point of entry.
Threat analysis, controls, tests, SBOM data, and AI-driven decisions linked automatically as the product is built.
Every change versioned and traced. Updated controls linked back to originating requirements.
Postmarket surveillance events, CVEs, and field findings mapped back through the full evidence chain.
Complete traceability matrix generated on demand. Regulator-ready with full audit trail intact.
Key Capabilities

Full lifecycle visibility
Zero evidence gaps

End-to-end traceability
Requirements to controls to tests to field events. Every link maintained automatically across the full product lifecycle.
Module:EVSec Base
Cross-module evidence chain
Threat analysis, SBOM, vulnerability data, AI decisions, and compliance evidence connected natively. No custom integrations required.
Module:EVSec Base
Full version history
Every change tracked with security rationale and linked evidence. Complete audit trail from day one to end of life.
Module:EVSec Base
Postmarket surveillance integration
Field events and postmarket CVEs mapped back through the evidence chain to design decisions. Investigation time cut from weeks to minutes.
Module:EVSec Threat Intelligence
On-demand traceability matrix
Regulator-ready traceability reports generated instantly. Full chain of evidence assembled automatically, not by hand.
Module:EVSec Compliance Center
PLM and QMS integration
EVSec connects to existing PLM, ERP, and QMS systems. Traceability embedded into the workflows your teams already use.
Module:EVSec Base
Frameworks

FDA 524B

ISO/SAE 21434

UN R155

IEC 62443

ISO 14971

EU CRA

NIST SSDF

Auto-ISAC ATM

AIS 189

DORA

IEC 81001-5-1

ASPICE

“C2A Security probably has the best threat analysis tool in the market, which also allows for streamlined collaboration between internal and external stakeholders.”

Risk Management Lead, Product Security
Fortune100 Consultancy Firm

"The method of integration between the BOM information and the TARA is a unique differentiator of EVSec, something we haven’t seen with other vendors."

Fortune100 Consultancy Firm
US Tier 1 Supplier

"At Elekta, we’re committed to providing safe, resilient solutions to our customers. Our collaboration with C2A Security will enable us to integrate cybersecurity throughout our product portfolio, helping us meet compliance requirements while keeping our systems secure."

John Chenoweth
Chief Product Security Officer, Elekta

"We believe this integration with C2A Security will be a milestone in product cybersecurity automation and vulnerability management, aiming to better comply with UN Regulation No. 155, ISO/SAE 21434 standards, among others."

Tin N.
Director

"Thank you for this great product and your work!"

Joachim Bozler
Senior Security Expert

"That's a very cool risk management product you've got there, exactly what we need, and I haven't seen that before."

European OEM
CISO

"This is a powerful tool for any company to have, and we’re excited about the collaboration with C2A Security and the value it can bring to our customers."

Piyush Karkare​
Global Director, Automotive Solutions​

"C2A Security shares the same vision as MIH, in offering a seamless and holistic approach to automotive cybersecurity over the entire lifecycle."

Jack Cheng
CEO

"Fuzz testing, with C2A Security's solution, enables early discovery of vulnerabilities hence reducing the time needed to deliver SW and products."

Cosimo Senni Guidotti Magnani
Global Product Cyber Security Manager

"We want to apply our expertise in cybersecurity to the connected car sector. Thanks to our global Automotive Security Test Center and to our collaboration with C2A Security, NTT DATA will be an international reference point to protect connected cars from cyber-attacks and ensure the drivers' safety."

Marco Garelli
Head of Automotive

"We have deeply felt the growth of the intelligent connected vehicle business and cybersecurity is an indispensable part of the intelligent connected vehicle. The cooperation with C2A Security provides cybersecurity solutions for the whole lifecycle of connected vehicles in China. We look forward to expanding the cooperation globally and bringing the vehicle industry to a safer future."

Wenguang Wu
Executive President

"C2A Security is the future of cybersecurity, and with their technologies to automate security, together we will go further in monitoring, preventing risk, identifying and mitigating vulnerabilities."

Geoffrey Bouquot
Group Chief Technology Officer & Senior Vice President Strategy

"When the FDA requested our full change history, we pulled the complete traceability report in minutes. That used to take us three weeks."

VP Quality and Compliance

Medical Device Manufacturer

GET STARTED

See your full product lifecycle in one traceable system

From first design decision to last field event. Always audit-ready.
Schedule a Demo
Talk to an Expert

Speaker Profile

Geoffrey Mann

Senior Physical Threat Analyst

Health-ISAC

Speaker Profile

John Auld

CRO

C2A Security

John Auld serves as Chief Revenue Officer at C2A Security, where he leads the company’s expansion into healthcare following the strategic acquisition of Vigilant Ops. With 20 years of experience bringing together complementary technologies across regulated industries, John specializes in helping manufacturers turn cybersecurity from a compliance burden into a competitive advantage. A mechanical engineer by training with deep expertise in product lifecycle management, John champions Dynamic Risk Management as the bridge between component visibility and actionable intelligence. His mission: enable medical device manufacturers to innovate safely without sacrificing speed or patient safety.

Speaker Profile

Ken Zalevsky

VP and GM, Medical Technology

C2A Security

Ken Zalevsky brings over 20 years of medical device cybersecurity experience to his role at C2A Security, where he serves as VP and GM, Medical Technology, following the acquisition of Vigilant Ops in October 2025. A former Bayer executive, Ken founded Vigilant Ops in 2019 after witnessing the consequences of inadequate technical preparation in the healthcare industry. He is an active contributor to CISA’s SBOM working groups and a frequent speaker on software supply chain security. Ken’s mission: transform SBOM from a compliance checkbox into operational intelligence that keeps patients safe while streamlining regulatory processes.