CAIRIS vs CYMETRIS

CAIRIS is an open-source platform for specifying and checking systems with security and usability requirements in view. It brings together design information such as assets, countermeasures, factoids, personas, requirements, and architectural components. As a design develops, it can generate 12 views covering perspectives such as people, risks, requirements, architecture, and physical location, as well as threat models including Data Flow Diagrams. Its security analysis uses attack and architectural patterns to assess attack surface and check for known security problems and potential GDPR compliance issues. CAIRIS can produce Volere-compliant requirement specifications and GDPR DPIA documents. Its API supports design apps and connections to existing toolchains. It is free under the Apache Software License. Deployment options include Docker, Vagrant, or source installation on supported platforms; Ubuntu is the most tested. The web app supports modern browsers other than Internet Explorer, including Edge. A Chrome extension can turn highlighted webpage text into references linked to a CAIRIS server. The live demo is rebuilt nightly, and its data is visible to everyone.

CYMETRIS is a cyber risk analysis and TARA platform for work across a product lifecycle. Its guided workflow follows ISO/SAE 21434 and applies automated consistency and logic checks. Teams can inspect attack paths interactively and map risks to components in system architecture, with risk prioritization, collaborative review, templates, frameworks, and multiple modeling methods. CYMETRIS Lite generates audit-ready reports for ISO/SAE 21434 and UN R155. The maker describes AI assistance through MCP for importing architectures, identifying assets, developing attack vectors, and querying TARA datasets in natural language. A public API is intended to connect requirements, architecture, PLM, ticketing, ALM, and reporting systems. Vulnerabilities can be imported from CVE databases, vendor advisories, or internal analyses and mapped to affected components; this capability is described as a selected-customer prototype. Access is available through web, API, or self-hosted deployment. Lite costs €99.00 per month, includes one full TARA project, and allows up to five active projects.