SystemWeaver and VicOne Launch Live TARA, Connecting Continuous Vulnerability Intelligence Directly to Automotive Cybersecurity Engineering 

SystemWeaver and VicOne are introducing Live TARA, a native integration that connects vulnerability intelligence directly to cybersecurity engineering. The idea is straightforward: a TARA should not go stale the moment it is signed off. With Live TARA, it reflects the continuous vulnerability status of a vehicle’s software automatically, without the manual re-work that normally eats into a security team’s time. 

SystemWeaver is the platform where automotive teams define their E/E and software architecture, manage requirements, and perform TARA (threat scenarios, attack trees, risk treatment) all within a single source of truth. VicOne secures that architecture with xZETA, an automotive-grade vulnerability intelligence platform that analyzes Software Bills of Materials (SBOMs) against continuously updated vulnerability and threat intelligence to identify which CVEs actually affect the components in a given system. xZETA also draws on VicOne’s automotive threat intelligence to map potential attack paths, helping teams understand how relevant vulnerabilities could be exploited. 

With Live TARA, SBOMs are generated automatically from the system architecture in SystemWeaver, or imported in CycloneDX or SPDX format, and registered with xZETA. As VicOne identifiesnewly relevant CVEs, that intelligence flows back into SystemWeaver on a scheduled basis, with traceability down to individual attack steps in the TARA attack tree. 

From vulnerability to risk decision in minutes, not days 

Live TARA removes a lot of the manual effort that traditionally has separated vulnerability management from cybersecurity engineering. New findings arrive already mapped to the relevant components in the system architecture, so TARA teams can start assessing risk right away instead of spending time compiling and cross-referencing data by hand. 

Because each vulnerability is evaluated according to the attack path it could open within the customer’s own system, rather than by generic severity score alone, teams can put their effort where it actually matters: what can be attacked in their specific architecture. And because the risk assessment updates continuously as new vulnerabilities emerge, with supporting traceability evidence already attached, organizations stay audit-ready between milestones instead of scrambling to refresh a TARA that was only accurate on the day it was signed off. 

See it live at ELIV 

SystemWeaver and VicOne will be running live demos of Live TARA at ELIV 2026, October 14 in Baden-Baden, booth 47. Stop by to walk through an SBOM flowing into xZETA, a newly discovered CVE landing back in SystemWeaver, and the traceability down to the affected attack step, end-to-end. 

About SystemWeaver 

SystemWeaver provides the model-based systems engineering platform used by automotive OEMs and suppliers to manage requirements, architecture, and software within one connected, version-controlled product model. Founded in Gothenburg, Sweden, SystemWeaver is deployed at organizations including Volvo Cars, Volvo Group, Geely, NIO and BYD. 

About VicOne 

VicOne is a cybersecurity leader for Physical AI, built on proven automotive expertise. Its software and services protect the digital systems that shape how vehicles and robots see, decide, and act, helping maintain safe, reliable behavior across real-world deployments. VicOne is headquartered in Tokyo, Japan. For more information, visit vicone.com