Skip to content

Compliance with ISO 21434

Ensure compliance with the ISO 21434's validation and verification requirements using an AI-driven fuzz testing platform. 

ISO 21434 Compliance

Compliance with ISO 21434

Ensure compliance with the ISO 21434's validation and verification requirements using an AI-driven fuzz testing platform. 

ISO 21434 Compliance
TRUSTED BY
google-2015-3Deutsche_Telekom_2022 1-3bosch-logo-simple 1-2Secunet_Security_Networks_Logo-2Continental_AG_logo 1-2Cariad_Logo-2ETAS-Logo-2

The role of fuzz testing in ISO/SAE 21434

ISO/SAE 21434 'Road vehicles — Cybersecurity engineering' specifically recommends fuzz testing for cybersecurity validation and verification during product development.
 
ISO/SAE 21434 suggests fuzz testing as a method for uncovering software weaknesses. Additionally, ISO specifies that the sufficiency of tests should be assessed by evaluating code coverage.
  
Fuzz testing is also required for components rated Cybersecurity Assurance Levels (CAL) 2 or higher, with advanced fuzz testing recommended for CAL 3 and CAL 4.

How fuzzing helps automotive companies comply with ISO 21434

Download the white paper for free to discover:

  • How fuzz testing contributes to ISO 21434 compliance.
  • The specifics of cybersecurity validation and verification requirements.
  • How suppliers and OEMs comply with ISO.
  • The benefits of source code fuzz testing, aka white-box fuzzing.
15 (1)
“Using fuzz testing by Code Intelligence helped our team pass ASPICE for Cybersecurity assessments and obtain ISO 21434 certification. Our products are now more secure. We presented the OEM with the fuzzing results and received positive feedback.”
Eckart Heyne (quote)
Eckart HeyneProduct Cybersecurity and Privacy Officer, Continental AG
"Thanks to Code Intelligence fuzzing approaches, our security testing became significantly more effective. All our developers are now able to fix business critical bugs early in the development process, without false-positives."

 

Andreas Weichslgartner
Andreas WeichslgartnerSenior Technical Security Engineer, CARIAD
”Thanks to Code Intelligence we were able to remediate deeply hidden issues, allowing us to ensure our vehicular software’s optimal functionality and safety. Coming up with the right unit tests for these cases would have been super difficult. With Code Intelligence’s AI-powered tests, we had the first finding within hours!”
saleh-heydari
Saleh HeydariVP of Software Engineering, XOS Trucks
”Code Intelligence helps developers ship secure software by providing the necessary integrations to test their code at each pull request, without ever having to leave their favorite environment. It's like having an automated security expert always by your side.”
thomas-dohmke
Thomas DohmkeCEO, GitHub

Fuzz Testing with Code Intelligence

Automate and scale your software security testing without hardware dependencies with an AI-driven fuzzing platform. Ensure compliance with ISO 21434 testing requirements.
Detect critical bugs & vulnerabilities without false positives

Code Intelligence connects to the source code and, unlike static analysis (SAST), analyzes code when executed.

Every flagged issue represents an actual issue in the running code. Most are highly critical, e.g. buffer overflows, memory corruption, and leaks.

Blog 'From simulation to success' - Visual 'Identifying bugs'
Enable your engineers to reproduce & fix issues in minutes, not in weeks

All uncovered issues are pinpointed to the exact line of code in the repository and accompanied by inputs that triggered an issue and clear actions to remediate those. So you can quickly identify the root cause, start fixing them, and release features faster.

Blog 'From simulation to success' - Visual 'Identifying bugs'
Let AI automate the generation of test cases and mocks

CI Spark, a built-in AI assistant that leverages large language models (LLMs) and static code analysis, automatically writes thousands of test cases and generates inputs and mocks for all dependencies.

CI Spark is also helpful in identifying top candidates for fuzzing.  

Blog 'From simulation to success' - Visual 'Identifying bugs'
Achieve up to 100% code coverage

Code Intelligence leverages feedback about the software under test to achieve the highest code coverage. Subsequent executions automatically generate new test cases to detect additional paths, thereby increasing code coverage.

This ensures your development teams know how much of their code was actually executed during a test and which parts need additional testing.

Blog 'From simulation to success' - Visual 'Identifying bugs'
Easily integrate fuzzing in your CI/CD

Integrate Code Intelligence with your CI/CD pipeline to automatically test your software with every pull request. This ensures regressions and release blockers are identified long before reaching production.

Blog 'From simulation to success' - Visual 'Identifying bugs'
Detect critical bugs & vulnerabilities without false positives

Code Intelligence connects to the source code and, unlike static analysis (SAST), analyzes code when executed.

Every flagged issue represents an actual issue in the running code. Most are highly critical, e.g. buffer overflows, memory corruption, and leaks.

Blog 'From simulation to success' - Visual 'Identifying bugs'
Enable your engineers to reproduce & fix issues in minutes, not in weeks

All uncovered issues are pinpointed to the exact line of code in the repository and accompanied by inputs that triggered an issue and clear actions to remediate those. So you can quickly identify the root cause, start fixing them, and release features faster.

Enable your engineers to reproduce & fix issues in minutes, not in weeks
Let AI automate the generation of test cases and mocks

CI Spark, a built-in AI assistant that leverages large language models (LLMs) and static code analysis, automatically writes thousands of test cases and generates inputs and mocks for all dependencies.

CI Spark is also helpful in identifying top candidates for fuzzing.  

CI Spark C_C++
Achieve up to 100% code coverage

Code Intelligence leverages feedback about the software under test to achieve the highest code coverage. Subsequent executions automatically generate new test cases to detect additional paths, thereby increasing code coverage.

This ensures your development teams know how much of their code was actually executed during a test and which parts need additional testing.

Blog: From simulation to success - Visual: Code coverage
Easily integrate fuzzing in your CI/CD

Integrate Code Intelligence with your CI/CD pipeline to automatically test your software with every pull request. This ensures regressions and release blockers are identified long before reaching production.

Easily integrate fuzzing in your CI_CD

Get a free product demo

Interested in fuzz testing? Book a call with us to learn more on how you can:
 
  • Scale and automate your software testing without hardware dependencies.
  • Detect critical bugs & vulnerabilities early in the development.
  • Uncover only actual issues without false positives.
  • Enable developers to reproduce & fix issues in minutes, not weeks.
  • Ensure compliance with ISO 21434 testing requirements and ASPICE for cybersecurity.

Continental: Getting ISO 21434 compliant with fuzzing

Continental integrated instrumented fuzz testing into the development process and reached compliance with ISO/SAE 21434, Regulation (EU) 2019/2144, UN R155, and ASPICE for cybersecurity.
 
Watch the webinar to learn how Continental built an automated security testing process as part of scalable CI/CD infrastructure by applying fuzzing at the Software-in-the-Loop level (SiL).
Webinar - Continental and Fuzz Testing

Security resources

Vector

White paper - Fuzz testing in ISO/SAE 21434

Even though the recommendations for ISO/SAE 21434 are not legally binding in practice, automotive companies often find themselves obligated to comply. Learn in this white paper how fuzz testing can support you in achieving compliance.
Vector

The Role of CALs in ISO 21434

Integral to ISO 21434 are Cybersecurity Assurance Levels (CALs), which provide a structured approach to classify and communicate the required rigor for cybersecurity measures. Let's discuss the role of  CALs as outlined in ISO 21434.
Vector

ISO 21434 Checklist

ISO/SAE 21434 consists of 108 pages filled with requirements and recommendation. This checklist will help you comply with many of these requirements, while automating large parts of your software development process.