Web dashboard
Define ECUs, configure and launch scans, watch progress live and read findings. Role-based access, groups and multi-tenant.
How it works
A dashboard in the browser, an agent on the bench.
AutoST splits into three parts: the web dashboard you work in, a backend that orchestrates scans and stores results, and Carbyne, the agent that sits next to your ECU and talks to the bus.
In short
AutoST has three parts. The web dashboard is where you define ECUs (components), configure scans and read results. The backend orchestrates jobs, stores findings and issues API tokens. Carbyne is a bench agent that runs on Windows or Linux, connects to the ECU over CAN, CAN FD, DoIP or SOME/IP, and executes the scans, reporting progress and results back over HTTPS. Several agents can test several ECUs in parallel.
The setup
What the bench looks like
One ECU, one interface, one tester running Carbyne, and the AutoST backend. Nothing exotic.
- ECUThe target on your bench
- Vector interfaceCAN, CAN FD or DoIP
- Carbyne agentOn a Windows or Linux tester
- AutoST backendDashboard in the browser
The three parts
Dashboard, backend, bench agent
Backend
Orchestrates the job queue, stores scans and findings, scores risk and issues the API tokens that drive CI/CD.
Carbyne agent
Runs on your bench on Windows or Linux, connects to the ECU over the bus or IP, executes scans and streams results back over HTTPS.
The scan flow
From a wired ECU to a fix plan
- 01
Define the component
Create the ECU in the dashboard: its interfaces (CAN bus, Ethernet) and protocols (CAN, CAN FD, UDS, DoIP). A 3-step wizard walks you through it.
- 02
Pair the agent
Install Carbyne on the bench machine and pair it with an API token. It reports an agent ID and shows up as an available target.
- 03
Configure the scan
Pick the engine and mode, the adapter and bitrate, keep-alive, and any ODX/CDD or DBC files. The wizard previews the whole configuration.
- 04
Run and watch
The agent executes the scan and streams progress: iterations, findings, requests per second. Several agents can run in parallel.
- 05
Review and export
Read the findings, accept or comment on risks, and export a PDF report plus the fix plan as SARIF, CSV or JSON.
Built for test benches
It fits how you already work
AutoST does not need a lab full of security tools. One container runs the dashboard and backend; the Carbyne agent runs next to the ECU on hardware you already have.
Comments and risk acceptance carry over when you re-run a scan, so a fix shows up as resolved and the noise does not come back. Scan history per component gives you a record over the life of the ECU.
FAQ
Frequently asked questions
Where does the testing actually happen?
On the Carbyne agent, next to the ECU. The backend orchestrates and stores; the agent does the bus and IP communication. Nothing is tested from the backend directly.
Can several ECUs be tested at once?
Yes. Each bench runs its own agent, and the backend schedules scans across all of them in parallel.
Does the bench need to be reachable from outside?
No. The agent polls the backend over HTTPS and pulls its jobs, so no inbound ports are opened on the bench.
See it on your ECU
See AutoST run against your kind of ECU
Book a one-hour live demo. We scan a real target, walk through the findings and the Fix Plan, and answer whatever you throw at us.
- A security engineer runs it, not a sales rep
- Bring your own protocol and hardware questions
- Free, and a clear next step afterwards
Your demo is withTom ZaubermannFounder of Zyberum, ex-lead of the VW InCar Security Testing Lab
Already trusted by Tier 1, Tier 2 suppliers and OEMs. References on request.
Or send us a message
We reply within one business day.