Cybellum

Cybellum is a product-security software company focused on the embedded and connected-device lifecycle. Its current platform brings together product asset and SBOM management, assurance and vulnerability management, product-risk governance, cyber-compliance workflows, product security incident response, and software-license analysis. The central problem is that a manufacturer often has incomplete visibility into the software shipped in a product: source code may be distributed across business units, suppliers may provide inconsistent SBOMs, and legacy binaries may be the only practical evidence available. Cybellum positions its platform as a way to merge binaries, source code, and uploaded SBOMs into a higher-fidelity view of the product and its components, then connect that view to risk and remediation work.

The target customer is a manufacturer with many products, versions, suppliers, and regulatory obligations rather than a small software team securing a single cloud application. Cybellum names automotive, medical-device, industrial, and other connected-product use cases, where vulnerabilities can remain in fielded devices for years and where a fix has to be coordinated with engineering, quality, legal, compliance, and product-security teams. Its platform and services pages also describe integrations with ALM and PLM systems, CI/CD tooling, ticketing systems, threat-model inputs, software-update processes, and vulnerability sources. That workflow orientation is commercially important: an SBOM alone is an inventory artifact, while the buyer needs evidence, ownership, prioritization, approval, and incident response across product versions.

The technology has a credible differentiator in handling software that is not conveniently available as clean source code. Binary analysis, component identification, SBOM reconciliation, deduplication, validation, and contextual risk analysis can improve coverage for proprietary, third-party, and legacy components. Cybellum also describes a Cyber Digital Twin concept that maintains a live representation of software components and product risk. Those claims should be diligence-tested against detection coverage, false-positive rates, supported architectures, update latency, and the quality of remediation recommendations; the public material establishes the product direction, not independent performance proof. The company also offers expert-led managed services, which may accelerate adoption but can make gross-margin and repeatability questions more important.

Cybellum was founded in Tel Aviv in 2016 and was acquired by LG Electronics, which announced a 64 percent stake valued at approximately $140 million in 2021 and a further investment commitment. The company continues to maintain its own product website and public company presence, while the acquisition gives LG a strategic interest in automotive and connected-product cybersecurity. Public company materials reference manufacturers including Jaguar Land Rover, Supermicro, Arthrex, and Faurecia, and a later Cybellum case-study page references ASUS and Hyundai; these are useful traction signals but do not establish contract size, renewal rates, or current deployment scope. The record should therefore treat Cybellum as a mature acquired platform rather than an independent venture financing opportunity.

The national-security relevance is real but bounded. Defense platforms, vehicles, communications equipment, industrial controls, and other mission systems also depend on long-lived embedded software, supplier components, vulnerability response, and auditable configuration knowledge. Cybellum could support software supply-chain assessment, sustainment prioritization, and fleet-level product assurance in those environments. No public evidence reviewed here establishes a defense customer, government contract, or defense certification, so the dual-use case rests on technology and workflow transferability rather than demonstrated defense revenue. Competition remains strong across software composition analysis, automotive cybersecurity, firmware analysis, and product-security governance; Cybellum's breadth and source-code-independent workflow are meaningful advantages only if it can maintain coverage, integrate deeply into engineering operations, and convert regulatory urgency into durable platform adoption.