CAIRIS vs KAVACH
CAIRIS
cairis.orgKAVACH
agnile.comSide by side
| Figure | CAIRIS | KAVACH |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 4 |
| Spec score · Threat Modeling Software | 8.2 (#2) | 7.7 (#8) |
| Deployment | CAIRIS can be installed using Docker or Vagrant, or from source on platforms supported by its open source dependencies; Ubuntu is the most tested platform. | Deployment options include a customer-controlled desktop workspace, on-premise deployment, and a customer-dedicated EU cloud VPC. |
| Integrations | The Persona Helper Chrome Extension can create document references from highlighted text on a web page and connect to a CAIRIS server. | The maker names DOORS, Polarion, Jira, and AUTOSAR ARXML as toolchain context or integration targets, where applicable. |
| Purpose | CAIRIS is an open source platform for eliciting, specifying, and validating secure and usable systems. | KAVACH is an automotive cybersecurity engineering workspace supporting ISO/SAE 21434 lifecycle workflows from vehicle architecture to traceable evidence. |
| Support | The maker asks users to report problems or feature requests by raising an issue on GitHub or getting in touch. | Program Deployment includes onboarding, training, governance setup, and Agnile engineering support across the programme. |
Plans
KAVACH
- Engineering Services AcceleratorPriced on request
- EvaluationPriced on request
- Program DeploymentPriced on request
- Scoped PilotPriced on request
In their own words
CAIRIS
CAIRIS is an open-source platform for specifying and checking systems with security and usability requirements in view. It brings together design information such as assets, countermeasures, factoids, personas, requirements, and architectural components. As a design develops, it can generate 12 views covering perspectives such as people, risks, requirements, architecture, and physical location, as well as threat models including Data Flow Diagrams. Its security analysis uses attack and architectural patterns to assess attack surface and check for known security problems and potential GDPR compliance issues. CAIRIS can produce Volere-compliant requirement specifications and GDPR DPIA documents. Its API supports design apps and connections to existing toolchains. It is free under the Apache Software License. Deployment options include Docker, Vagrant, or source installation on supported platforms; Ubuntu is the most tested. The web app supports modern browsers other than Internet Explorer, including Edge. A Chrome extension can turn highlighted webpage text into references linked to a CAIRIS server. The live demo is rebuilt nightly, and its data is visible to everyone.
KAVACH
KAVACH is an automotive cybersecurity engineering workspace connecting vehicle architecture to traceable cybersecurity evidence across ISO/SAE 21434 workflows. Its TARA process links assets, damage and threat scenarios, attack paths, risk assessment and treatment, security goals, controls, and evidence. The workspace includes architecture context, attack-tree editing, a traceability hub, vulnerability monitoring, a cybersecurity case, an R155 compliance matrix, and report generation. SBOM and vulnerability signals can connect affected components with assets, threats, and treatment decisions. The current release focuses on ISO/SAE 21434 Clauses 5–15, UNECE R155/R156 evidence, AIS 189/AIS 190 readiness, and post-production monitoring. Deployment choices are a customer-controlled desktop workspace, on-premise deployment, or a customer-dedicated EU cloud VPC. Manual engineering, deterministic automation, and optional private AI are available. Generated work products are structured drafts requiring engineer review and customer approval. Pricing is scoped per programme.