What is the primary goal of the CERTIFAI project?

The CERTIFAI project aims to create a cost-effective AI-driven framework for continuous assessment and certification of ICT products, processes, and services.

What approach does CERTIFAI take towards addressing cybersecurity challenges?

CERTIFAI leverages the EU Cybersecurity Act and established cybersecurity requirements to ensure that certified products maintain compliance throughout their life cycle.

How does CERTIFAI plan to assist manufacturers in preventing cyber threats?

CERTIFAI will provide tools for developing threat models, vulnerability testing, and detecting non-compliance, empowering manufacturers to counter and swiftly respond to cyber threats.

Why is there a need for continuous assessment of ICT products and services?

To mitigate the impact of evolving cyber threats and ensure conformity to security standards throughout their life cycle.

What's the challenge with the traditional certification process?

It’s predominantly static, costly, and not adaptable to agile product updates, leaving products vulnerable to cyber risks with each change.

How does the CERTIFAI project address cybersecurity challenges?

By developing an open software framework for AI-driven continuous assessment and (re-)certification, aligning with established standards to ensure ongoing compliance throughout a product’s life cycle.

Homepage - CERTIFAI

CERTIFAI Framework

CERTIFAI Integrated Framework

The open certification compliance platform of the project. It guides manufacturers and assessors through the whole process – from defining the subject of certification and building Security Assurance Cases to evidence collection, conformity assessment against the CRA and other standards, threat modelling and SBOM management.

Open The Platform Read The Documentation

Conformity Assessment
CRA and standards-aligned checks
Security Assurance Cases
Case–Argument–Evidence structures
Evidence Collection
Structured, audit-ready records
Threat Modelling & SBOM
Threat Spider and supply-chain visibility

Threat Modelling

Threat Spider

Describe a system component and Threat Spider automatically identifies the relevant threats, mitigations and cybersecurity requirements, drawing on MITRE ATT&CK, ATLAS, EMB3D and SPARTA. No registration needed and no data is retained.

Try Threat Spider

Vulnerability Testing

SimVul & LOGA

Open-source tools developed by Simula for vulnerability testing based on threat models: SimVul (Prova) for detecting vulnerabilities in products and LOGA for automated extraction of message templates from raw log files. Both are published with citable DOIs under BSD licences.

SimVul On Zenodo LOGA On Zenodo Source Code On GitLab

Training

Cyber Risk Management Training Modules

Self-paced e-learning modules on cyber risk management developed within CERTIFAI, complemented by an interactive MITRE ATLAS module on threats to AI-enabled systems. Free registration required for the training portal.

Enter The Training Portal Open The MITRE ATLAS Module

Open Science

Publications, Deliverables & Data On Zenodo

Public deliverables, scientific publications, datasets and software releases of the project are collected in the CERTIFAI community on Zenodo – openly accessible, permanently archived and citable.

Browse The Zenodo Community