Facts

AutoST at a glance.

The same plain statements we give to search engines and AI assistants, so you get the facts from the source, including what AutoST does not do.

What is AutoST?: AutoST is an automated security testing suite for automotive ECUs. A test agent on your bench talks to the ECU over CAN, CAN FD or Ethernet; a web dashboard plans the tests, shows the findings and produces the evidence. Built by Zyberum GmbH, Hannover, Germany.
Who is it for?: Security and test teams at OEMs, Tier-1 and Tier-2 suppliers, engineering service providers and test labs that have to test ECUs for security weaknesses repeatedly and show the results for ISO/SAE 21434 and UN R155.
What does AutoST do?: UDS enumeration of sessions, services, sub-functions and data identifiers (DIDs); ODX and CDD driven DID naming and routine (RID) scanning including write probing; SecurityAccess (0x27) seed/key checks; reproducible UDS and CAN fuzzing with crash detection; UDS over DoIP, DoIP gateway and SOME/IP service testing; Android IVI hardening checks over ADB; a weighted risk score; PDF reports and SARIF export; a Fix Plan that turns findings into ranked tasks; CI/CD integration (Atlassian Bamboo plugin, REST API).
What does AutoST not do?: AutoST is not a penetration test and does not replace one; it automates the repeatable part. It does not test FlexRay, LIN or HSFZ. It has no plugins for Jenkins, GitLab or GitHub (REST API and Bamboo only) and no connectors to DOORS, Polarion or codebeamer. It does not issue certificates and is not an ISO/SAE 21434 certification.
What do I need?: A test bench with the ECU and a supported interface: SocketCAN adapters on Linux (for example PEAK, Kvaser or any socketcan driver) or Vector hardware on Windows through the XL driver library, and Ethernet for DoIP, SOME/IP and ADB. The test agent runs on Windows or Linux; the dashboard runs in a browser.
How is it deployed?: Hosted by Zyberum in the EU, or installed on your own servers. In both cases the test agent on your bench is the only component that touches the ECU.
What does it cost?: Licensing is per tested component and quoted on request after a demo; there is no public price list. A pilot on your own ECU is the usual first step.
Who is behind it?: Zyberum GmbH, Jägerstieg 12, 30657 Hannover, Germany, an automotive security firm founded in 2019 by Tom Zaubermann, former lead of the InCar Security Testing Lab at Volkswagen AG. The same team does ECU and vehicle penetration tests, which is where the test content comes from.
Contact: automotive@zyberum.com, +49 176 439 17074. Live demo: https://auto-st.com/contact