Software

AI-assisted software for SME cybersecurity

Cyber Insight GmbH

A connected medical device runs largely on software that the manufacturer did not write itself. If a vulnerability is disclosed in one of these components, the manufacturer must determine whether its product is actually affected—and be able to provide evidence of this determination to regulatory authorities for ten years or more. Vulnerabilities can be detected using scanners. To this day, experts still assess manually what these vulnerabilities mean for a specific device.

Cyber Insight GmbH, based in Leipzig, automates precisely this step. Its product, Zylentix, evaluates reported vulnerabilities against a product’s actual architecture, configuration, and deployment environment, and records the result as a transparent decision: including the rationale, the underlying evidence, and the points that remain unresolved and must be reviewed by an expert. What is uncertain remains visible. The technical foundation is DARA, the reasoning architecture developed by Cyber Insight since 2023; selected features from it can also be embedded into software platforms from other providers.

The need arises from regulatory requirements: in medical technology, these include FDA Section 524B and the MDR/IVDR, as well as NIS2 and the EU Cyber Resilience Act. The software is being tested in a paid project with Siemens Healthineers and in evaluations with other medical technology manufacturers. Cyber Insight refers to this stage—between the identification of a security issue and the decision regarding it—as the “System of Decision for Product Security.”

TGFS has been involved with the company since 2023.