Automotive
The automotive sector faces strict cybersecurity requirements for connected and autonomous vehicles. ARIANNA enables manufacturers and tier suppliers to build complete SBOMs/HBOMs, continuously monitor vulnerabilities, and manage them according to defined policies throughout the product lifecycle.
How ARIANNA is Used
- Automates generation and maintenance of SBOM/HBOM for vehicle software and hardware.
- Supports vulnerability prioritization using exploit intelligence and industry risk profiles.
- Generates machine-readable reports (SPDX, CycloneDX, VEX) for regulatory submissions and audits.
Relevant Certifications & Standards
- ISO/SAE 21434 – Automotive Cybersecurity Standard
- UNECE WP.29 / R155 & R156 – Cybersecurity and Software Updates Regulations
Industrial Automation
Industrial automation systems such as PLCs, SCADA, and control networks require robust vulnerability management and compliance with operational technology cybersecurity standards. ARIANNA’s platform helps by providing precise component inventories and continual risk assessment.
How ARIANNA is Used
- Creates accurate SBOM/HBOMs for embedded control systems and field devices.
- Monitors and tracks vulnerabilities with exploitability data for industrial impacts.
- Facilitates evidence generation for audit and compliance workflow automation.
Relevant Certifications & Standards
- IEC 62443 Series – Industrial Automation and Control Systems Security
- ISA/IEC 62443-4-1 – Secure Product Development Lifecycle
Medical Devices
Medical device manufacturers must ensure device security and comply with regional medical regulations where cybersecurity evidence (such as SBOMs) plays a critical role in submissions. ARIANNA supports the inventory, vulnerability management, and reporting that regulators expect.
How ARIANNA is Used
- Produces detailed SBOM/HBOMs aligned with build processes to minimize false positives.
- Prioritizes vulnerabilities based on clinical risk and exploit evidence.
- Supports integration with threat modeling, penetration testing, and risk assessments.
Relevant Certifications & Regulations
- FDA Pre-Market Submissions (510(k), PMA) – Cybersecurity Documentation
- EU MDR – Medical Device Regulation with cybersecurity expectations
- IEC TR 60601-4-5 – Security Requirements for Medical Electrical Equipment
Consumer Electronics & IoT
Connected consumer devices must adhere to best practices and emerging consumer cybersecurity guidelines. ARIANNA can generate and maintain component inventories and provide compliance artifacts for regulators and partners alike.
How ARIANNA is Used
- Builds continuous SBOM and HBOM tracking for smart home devices and wearables.
- Highlights actively exploited vulnerabilities and supports remediation planning.
- Exports compliance reports for internal quality assurance and external audits.
Relevant Certifications & Standards
- ETSI EN 303 645 – Consumer IoT Security Baseline Requirements
- RED (Radio Equipment Directive) – Cybersecurity Requirements
- CRA (Cyber Resilience Act) – EU Cybersecurity Regulation for Hardware/Software Products
Defense & Aerospace
Defense and aerospace systems require strict supply chain control, long lifecycle maintenance, and vulnerability traceability across software and hardware components. ARIANNA helps teams maintain trusted inventories and continuously assess risk for mission-critical products.
How ARIANNA is Used
- Maintains end-to-end SBOM and HBOM visibility across embedded avionics, control systems, and support platforms.
- Prioritizes vulnerabilities using exploit intelligence and operational criticality to support risk-based remediation.
- Provides auditable reporting workflows for supplier assurance, authority reviews, and ongoing security governance.
Relevant Certifications & Standards
- NIST SP 800-53 / RMF – Security and Privacy Controls for Federal Information Systems and Organizations
- NIST SP 800-161 – Cybersecurity Supply Chain Risk Management Practices
- DO-326A / ED-202A – Airworthiness Security Process Specification
Energy & Utilities
Energy generation, transmission, and utility infrastructure depend on resilient operational technology and connected control systems. ARIANNA helps operators and suppliers maintain component transparency and continuously manage vulnerabilities across critical assets.
How ARIANNA is Used
- Builds and maintains SBOM/HBOM inventories for grid control, monitoring, and field equipment ecosystems.
- Tracks vulnerabilities and prioritizes remediation based on exploitability and operational impact.
- Supports compliance evidence generation for security audits, supplier assurance, and regulatory reporting.
Relevant Certifications & Standards
- NERC CIP Standards – Critical Infrastructure Protection for Bulk Electric Systems
- IEC 62443 Series – Security for Industrial Automation and Control Systems
- NIST Cybersecurity Framework (CSF) – Risk-Based Cybersecurity Management
Transportation & Logistics
Transportation and logistics platforms rely on connected vehicles, fleet systems, and digital infrastructure that must stay secure and available. ARIANNA enables operators and suppliers to manage software and hardware exposure across distributed transport environments.
How ARIANNA is Used
- Maintains current SBOM and HBOM visibility for fleet devices, telematics units, and logistics control platforms.
- Prioritizes vulnerabilities based on exploit intelligence, business criticality, and operational continuity impact.
- Delivers structured reporting for supplier risk management, customer assurance, and regulatory readiness.
Relevant Certifications & Standards
- ISO/SAE 21434 – Road Vehicle Cybersecurity Engineering
- IEC 62443 Series – Security for Industrial and Transport Control Environments
- NIST Cybersecurity Framework (CSF) – Cyber Risk Governance and Improvement
Cross-Industry Compliance & Reporting
Across all industries, ARIANNA accelerates compliance preparedness and demonstrates sound cybersecurity practices by combining automated SBOM/HBOM generation with continuous vulnerability management.
Key Compliance Capabilities
- Export SBOMs in SPDX, CycloneDX and CSV formats ready for regulatory submission.
- Produce VEX reports for transparent vulnerability status reporting.
- Manage policies tied to internal requirements or external standards.