跳到主要内容

无需网络安全基础，也能迈向合规就绪。

描述您的产品。Sytance 会识别威胁、评估并缓解风险、规划安全测试、建立可追溯性，并生成完整的合规资料包。

S
S
◇
⌂
□
▱
/ Product context

Product facts

Product name Industrial PLC Gateway
Description Secure remote access and data transfer for PLC systems.
Operating environment Factory floor, on-premise network
Data flows PLC <-> Gateway <-> Cloud
Interfaces Ethernet, Serial, HTTPS
Components Hardware, Firmware, Cloud Service
Trust boundaries Device, Network, Cloud
Assumptions Physically secured, IT managed network
S
S
◇
⌂
□
▱
/ Threat modeling
ThreatsAssetsData flowsInterfaces
Threat Category
Unauthorized remote access Access control
Firmware tampering Tampering
Eavesdropping on data in transit Information disclosure
Weak credential management Access control
Denial of service Availability

Showing 1 to 5 of 15 threats

S
S
◇
⌂
□
▱
/ Compliance documentation

Review-ready documentation

Package content Status
01 Product Context Summary DOCX Mapped
02 Threat Model Report DOCX Mapped
03 Risk Assessment XLSX Ready
04 Security Requirements DOCX Ready

Compliance output

Product context, threats, controls, and evidence stay linked to the final package.

NO SECURITY TEAM REQUIRED

Your product knowledge is enough.

安全框架与工作流已内置，无需从空白模板开始。

□

Describe Your Product

Answer simple questions using the product knowledge your team already has.

◇

Sytance Completes the Security Work

Threats are identified, risks are mitigated, and security tests are planned for you.

▱

Your Compliance Package Is Ready

Every required document and traceability record is generated together.

GUIDED PRODUCT SETUP

选择适合产品的选项，其余交给 Sytance。

只需选择少量产品信息，第一个安全模型就会随选择逐步形成。

◇   AI product setup 大多数问题只需点击选择即可回答。
PRODUCT TYPEWhat are you building? 1 selected
✓▦Industrial product
⌁IoT product
♡Medical device
</>Software product
OPERATING ENVIRONMENTWhere does it run? 2 selected
✓□Customer site
✓□Factory network
□Public cloud
□Mobile environment
AI builds
as you choose
●  Context→
●  Architecture→
●  Threats→
●  Risk→
●  Security design→
●  Tests→

LIVE RESULTS

Your security work is taking shape

□Field devices
→
□Industrial PLC Gateway
→
□MES
→
□Cloud service
◇ThreatsUnauthorized remote accessFirmware update channel tamperingOperational data disclosure
◇Risks & mitigationsRemote access · Strong authenticationUpdate tampering · Signed firmwareData disclosure · Encrypted transport
◇Security designEnforce signed firmware updatesRequire unique device credentialsEncrypt operational data in transit
◇Security testingReject unsigned update packagesVerify failed-login lockoutTest encrypted communications

无需先组建安全团队，也能完成专业安全工作。.

传统方式通常需要专业方法、跨团队交接、电子表格跟踪、文档编制和咨询项目。Sytance 将这些能力整合在同一个工作流中。

Sytance  /  Threat Modeling Industrial PLC Gateway

Data-flow diagram

Remote operator→PLC Gateway→Data store
Update server PLC Controller

GENERATED THREATS

T1  Remote access
T2  Update tampering
T3  Weak credentials
T4  Data disclosure
T5  Denial of service
T6  Firmware tampering
Sytance  /  Threat Modeling Industrial PLC Gateway
AI risk rationaleReview required
Why this matters

The update path can alter executable firmware and disrupt operation.

Key factors

External exposure, known techniques, full device impact.

Recommended action

Verify signed firmware and an authenticated update channel.

AI confidence

High

SECURITY OUTPUT

Requirements14
Design decisions18
Traceability links36
SECURITY REQUIREMENTS
SR-01Secure updates
SR-02Strong authentication
SR-03Encrypt in transit
Sytance  /  SBOM Triage Industrial PLC Gateway
SBOM
Components
Findings
Vulnerabilities
Licences
ComponentVersionReachable
linux kernel5.10.0Yes
openssl1.1.1uYes
busybox1.32.1Yes
dropbear2022.83Yes
u-boot2021.04No
musl1.2.2Yes
libmodbus3.1.6No
zlib1.2.11Yes

Showing 8 of 128 components

Vulnerability triage

CVE-2023-0464Reachable
CVE-2022-23801Exploitable
CVE-2021-42374Review
RISK DRIVERS
ReachabilityHigh
ExploitabilityHigh
ImpactHigh
Alex B.Just now

Agree with the risk and recommendation. Let's add monitoring for failed update attempts.

EVIDENCE SPINE
·Product context captured·Threats & risks reviewed·Controls implemented·Evidence verified·Decisions recorded·Traceability complete
Industrial PLC Gateway Documentation PackageDOCX · Review ready

SBOM 与漏洞情报

扫描出大量漏洞，明确哪些需要关注。

管理 SBOM，使用自研引擎扫描依赖，结合利用情报明确复核重点。

  1. SBOM 管理

    关联软件组件、版本与漏洞，保留清晰的依赖记录。

  2. 自研扫描引擎

    结合多源漏洞数据，匹配软件依赖中的已知漏洞。

  3. 基于证据的漏洞分析

    标出需要复核的发现，并提供分析原因和情报依据。

漏洞复核

评估示例
  1. 组件匹配
  2. 利用情报
  3. 人工复核

当前漏洞

示例依赖

版本 1.0

已确认组件与版本匹配

CISA KEV
已有利用记录
公开利用材料
已收录
EPSS
超过复核阈值

需要复核

确认受影响的功能、暴露情况和可达入口。

漏洞情报 → 评估结论 → 安全记录

多源漏洞情报

  • NVD
  • OSV

漏洞数据覆盖

  • CISA KEV
  • EPSS

利用情况与概率信号

  • Exploit Database
  • Metasploit

公开利用情报

DOCUMENTATION AND COMPLIANCE

一套完整的安全记录，满足每项适用要求。

详细安全文档统一生成，并按照每项适用要求进行结构化组织。

GENERATED SECURITY PACKAGE Generated together from the same reviewed record.
Threat model System context, assets, trust boundaries, attack paths, and threat scenarios
Risk assessment & CVSS Impact, likelihood, scoring rationale, treatment, and residual risk
Security requirements & design Security objectives, mitigations, design decisions, and assurance requirements
Verification & test plan Test methods, acceptance criteria, verification results, and supporting evidence
SBOM & vulnerability decisions Component inventory, supplier information, findings, and remediation decisions
Evidence & traceability Threat → Risk → Requirement → Test → Evidence
Technical documentation Architecture, secure configuration, operational guidance, and final compliance documentation
PACKAGED FOR
EU CRA•IEC 62443-4-1•Medical Device•Customer Assurance

Product Security Documentation

Table of contents
1Product and system context1
1.1Product scope and intended use2
1.2Architecture and trust boundaries4
1.3Assets, interfaces, and data flows6
2Threat modeling9
2.1Threat scenarios and assumptions10
2.2Attack paths and affected assets13
2.3Threat disposition17
3Risk assessment20
3.1Impact and likelihood analysis21
3.2CVSS vector and scoring rationale24
3.3Treatment and residual risk28
4Security requirements and design32
4.1Security objectives and requirements33
4.2Mitigation and design decisions38
5Verification and evidence44
5.1Test methods and acceptance criteria45
5.2Results, evidence, and traceability50
6SBOM and vulnerability management58
7Final technical documentation62

PRICING

从一个产品开始，扩展到每次发布。

从威胁建模、风险评估到安全要求、测试规划和 SBOM 漏洞审查，在同一工作流中建立产品安全证据。Evaluation 用于验证流程，Business 支持正式文档交付，Enterprise 扩展到组织治理和更大产品组合。

Evaluation

免费
14 天

适用于希望用真实产品验证安全与合规工作流的团队。

体验威胁建模、风险评估与证据就绪度检查。提供受限水印预览；个性化正式文档和完整资料包需升级。

开始 Evaluation
PLAN CAPABILITIES
✓1 个活跃产品，验证实际工作流
✓1 个产品版本
✓1 个标准框架
✓14 天内共 60 个 AI units，体验 AI 辅助分析
✓文档目录、证据追溯与就绪度检查
✓Threat Model PDF 水印预览，风险内容受限
✓完整个性化文档资料包：升级至 Business 后可导出

Business

RECOMMENDED
€8,999 €12,999
抢先体验价即将结束每年，不含适用税费

适用于需要持续交付产品安全文档与评审资料包的团队。

从试用预览升级为个性化正式输出：生成可编辑 DOCX、PDF 和完整资料包，支持多个产品与持续版本迭代。

在线选择 Business
PLAN CAPABILITIES
✓最多 5 个活跃产品，集中管理安全证据
✓每个活跃产品不限版本，支持持续迭代
✓每个产品最多 2 个标准框架
✓每月 1,000 个 AI units，支持日常分析与文档起草
✓1 个并发文档导出任务
✓个性化 HTML 预览、PDF、可编辑 DOCX 与完整资料包

Enterprise

定制报价
年度订阅

适用于需要组织治理与更大产品组合容量的企业。

包含 Business 全部文档输出能力，并提供 1 个治理工作区；产品与月度 AI 容量均为 Business 的 5 倍，支持更多并行导出。

联系 Enterprise 销售团队
PLAN CAPABILITIES
✓最多 25 个活跃产品，覆盖更大产品组合
✓每个活跃产品不限版本，支持持续迭代
✓每个产品最多 2 个标准框架
✓每月 5,000 个 AI units，为 Business 的 5 倍
✓3 个并发文档导出任务，支持批量交付
✓Business 全部文档输出能力 + 1 个治理工作区

Included with every plan

当前可在线购买：Business 年度订阅的抢先体验价限时为 €8,999（常规价格 €12,999）。Enterprise 采用定制合同。容量按照活跃产品数量和所含 AI 用量确定。

✓引导式产品设置
✓威胁建模与风险评估
✓安全要求与测试规划
✓SBOM 与漏洞审查
✓文档就绪度与可追溯性

从一个产品开始，在作出购买承诺前验证完整工作流。

建立真实产品证据，运行引导式工作流，并在平台内检查就绪度。需要个性化正式输出时再升级至 Business。

首个可评审资料包 约 15 分钟。 无需专职安全团队。