Shreyansh writes about automotive cybersecurity, safety-critical engineering, ISO/SAE 21434, embedded systems, and the practical engineering decisions behind critical vehicle programmes.
Founder & CTO of Agnile Technologies, where he leads the company's automotive cybersecurity engineering practice. His focus is the intersection of systematic threat analysis and machine-readable work products.
He is certified for ISO/SAE 21434 and works day-to-day on TARA methodology, STRIDE-style threat modeling for vehicle E/E architectures, and the UNECE R155 CSMS evidence package. His technical interests span AUTOSAR Classic and Adaptive platforms, HSM-backed secure communication, and how AI-assisted tooling structures the cybersecurity workflow without eroding engineer-in-the-loop review.
Areas of Expertise
- ISO/SAE 21434
- Automotive Cybersecurity
- Threat Analysis and Risk Assessment (TARA)
- UNECE R155 CSMS
- AUTOSAR
- ISO 26262 Functional Safety
Articles by Shreyansh
- Cybersecurity12 min
NIS2UmsuCG Checklist for Automotive Suppliers: 12 Steps to Compliance
A 12-step NIS2UmsuCG checklist for German automotive suppliers — scope, BSI registration, §30 measures, §32 reporting, management duties — with the legal hook and evidence for each, plus what ISO 27001 and a CSMS cover.
- Cybersecurity11 min
Cybersecurity Interface Agreements with German OEMs: The Supplier’s Evidence Checklist
What German and EU OEMs commonly request from suppliers under ISO/SAE 21434 Clause 7 and UNECE R155 — TARA extracts, CAL, pentest reports, SBOM, end of support, TISAX — and what to deliver for each.
- ISO/SAE 2143410 min
ISO/SAE 21434 Explained: Scope, Clauses and What Auditors Read
What ISO/SAE 21434 is, who it applies to, Clauses 5–15 in one table, what assessors read first, and the common misreadings — certification, R155, R156 and AIS 189.
- ISO/SAE 2143410 min
ISO 21434 Consulting: What a Programme Buys and What Drives the Cost
What an ISO/SAE 21434 engagement delivers, the eight drivers behind the quote, typical durations from gap analysis to assessment readiness, what a quote should itemise, and red flags.
- Cybersecurity11 min
KBA Type Approval for Cybersecurity: How Technical Services Assess R155 and R156
How KBA and its technical services assess UNECE R155 and R156: CSMS and SUMS certificates, vehicle-type evidence, what KBA says about testing, how Tier-1 evidence flows in, and an OEM checklist.
- Cybersecurity11 min
TISAX for Automotive Suppliers: Assessment Levels, Labels and Development Data
TISAX for automotive suppliers: ENX and the VDA ISA, assessment levels AL1–AL3, every current label and its level, validity and ISA2027, the process, and how it differs from ISO/IEC 27001 and ISO/SAE 21434.
- Cybersecurity10 min
Two-Wheeler and EV Cybersecurity Before UNECE R155's 2027 L-Category Deadline
R155 reaches two- and three-wheelers in the EU from 11 December 2027. What changes for L-category OEMs and exporters, where these platforms differ from cars, and a back-planned roadmap to the first submission.
- Cybersecurity9 min
Automotive Penetration Testing Cost and Duration: What Drives the Quote
The seven drivers behind every automotive pentest quote, typical durations from component to vehicle level, what a fixed-price quote should itemise, and the levers that cut cost without cutting evidence.
- Cybersecurity10 min
AIS 189 Cybersecurity Testing: What ARAI and iCAT Expect from Penetration-Test Evidence
How penetration testing fits an AIS 189 submission: what the CMVR test agencies look for, how the evidence mirrors UNECE R155, what Indian Tier-1s owe global OEM customers, and how to write one report for both.
- Cybersecurity11 min
UNECE R155 Annex 5 Penetration Testing Checklist: Turning 69 Threat Examples into Test Cases
A practical checklist mapping the seven Annex 5 threat categories to penetration-test cases, evidence artefacts and ISO/SAE 21434 clauses — so the test report reads as type-approval evidence.
- Cybersecurity10 min
What Is a CSMS? The Cybersecurity Management System Explained
CSMS stands for Cybersecurity Management System — the organizational capability UNECE R155 requires before any Vehicle Type Approval. What auditors examine, how long the certificate lasts, and how it maps to ISO/SAE 21434 Work Products.
- Embedded Software14 min
System Integration Testing in Automotive: MIL, SIL, and HIL Explained
Where System Integration Testing sits in the automotive V-model — the MIL/SIL/PIL/HIL fidelity ladder, integration strategies, entry and exit criteria, and how ISO 26262 and ISO/SAE 21434 shape the work.
- Cybersecurity11 min
NIS2 for Automotive Suppliers: What Germany’s NIS2UmsuCG Means for Tier-1s and Tier-2s
Germany’s NIS2 law puts automotive suppliers under BSI supervision — who must register, the lapsed deadlines, §30 and §32 duties, and how much of an ISO/SAE 21434 CSMS can be reused.
- Cybersecurity10 min
The EU Cyber Resilience Act and Automotive: What Is Actually in Scope
Type-approved vehicles are exempt from the EU Cyber Resilience Act — a precise read of Article 2(2)(c), the six automotive product groups still in scope, and why the same component can be exempt in one sales channel and regulated in another.
- ISO/SAE 214349 min
ISO/SAE 8475: Cybersecurity Assurance Levels (CAL) and Targeted Attack Feasibility Explained
ISO/SAE 8475 turns the CAL concept from ISO/SAE 21434 Annex E into a prescriptive scheme — three assurance levels plus Targeted Attack Feasibility as a design target, and how CAL assignment flows from TARA outputs.
- ISO/SAE 214347 min
ISO/SAE 21434 Second Edition: What Is Changing and When
ISO/SAE 21434 entered systematic review in 2026, and in October 2026 ISO registered the second-edition project (ISO/SAE AWI 21434). What is known about scope and timing — and why your CSMS cannot wait.
- Cybersecurity10 min
UNECE R155 Compliance Roadmap: From CSMS Audit to Type Approval
A practical 12–18 month UNECE R155 compliance roadmap for vehicle programmes — CSMS audit, Annex 5 threats, Type Approval, and post-2024 enforcement reality.
- Cybersecurity12 min
The ROI of Automated TARA: When Does Automation Pay Back?
A practical model for the 3-year TCO of manual versus automated TARA, payback-period sensitivity by program count, and where automation actually changes programme economics.
- Cybersecurity12 min
Automotive Penetration Testing: A Methodology for ECUs, Gateways, and V2X
An architect-grade penetration testing methodology for ECUs, gateways, and V2X — scope pyramid, tool categories, and the test patterns that catch real vulnerabilities.
- Cybersecurity11 min
HSM Integration for Automotive ECUs: From EVITA Light to Full
How to size, integrate, and verify a Hardware Security Module for automotive ECUs — EVITA Light/Medium/Full, host-HSM interaction, and rollout patterns.
- Cybersecurity11 min
Secure Boot Implementation for Automotive ECUs: Chain of Trust from ROM to Application
Designing a verifiable chain of trust from BootROM through bootloader to application — signature schemes, rollback protection, and recovery patterns.
- Embedded Software10 min
SecOC in AUTOSAR Classic: Message Authentication at Bus Level
Secure Onboard Communication in AUTOSAR Classic — frame format, freshness counters, MAC truncation tradeoffs, and integration patterns at bus level.
- Embedded Software11 min
AUTOSAR Crypto Stack: Csm, CryIf, KeyM — Implementation Guide for Automotive ECUs
Architecture and integration patterns for the AUTOSAR Crypto Stack — Csm, CryIf, Crypto Driver, and KeyM — with the job-API call sequence and pitfalls to avoid.
- Cybersecurity9 min
Cybersecurity Interface Agreements (CIA) Under ISO/SAE 21434 Clause 7: Template and Negotiation Guide
How to draft and negotiate a Cybersecurity Interface Agreement under ISO/SAE 21434 Clause 7 — RASIC matrix, clause checklist, and the patterns that hold up under audit.
- Embedded Software10 min
Secure Automotive Device Driver Development: From MCAL to Complex Device Drivers
Cybersecurity patterns for MCAL and Complex Device Driver development — the ISR security checklist, requirements by driver layer, and the integration tradeoffs.
- Cybersecurity13 min
Every ISO/SAE 21434 Work Product, Demystified
ISO/SAE 21434 defines work products across the cybersecurity engineering lifecycle (Clauses 5–15). The complete checklist with review priorities and UNECE R155 mapping.
- Functional Safety12 min
What Is ISO 26262? A Complete Guide to Automotive Functional Safety
ISO 26262:2018 is the 12-part automotive functional safety standard. Complete breakdown of HARA, ASIL derivation, decomposition, and the FuSa + Cyber convergence.
- ISO/SAE 214346 min
ISO/SAE 21434 vs UNECE R155: What’s the Difference?
Engineering standard vs regulation — understanding how ISO/SAE 21434 and UNECE R155 work together for Automotive Cybersecurity compliance.
- Functional Safety5 min
ISO 26262 ASIL Levels Explained: A to D
Understanding Automotive Safety Integrity Levels — how ASIL is determined and what each level means for development.
- Cybersecurity8 min
What Is TARA in Automotive Cybersecurity? A Practical Guide
The systematic Cybersecurity analysis methodology defined in ISO/SAE 21434 Clause 15 — from Threat Identification to Risk Treatment.
- Cybersecurity6 min
STRIDE Threat Modeling for Automotive ECUs
Adapting Microsoft’s STRIDE framework for vehicle architectures — ECUs, CAN buses, V2X interfaces, and data flows.
- Cybersecurity7 min
Manual TARA vs Automated TARA: Why Spreadsheets Don’t Scale
Why spreadsheet TARA struggles to scale, and how structured TARA tooling keeps Risk Scoring consistent and Work Products traceable.
Contact Us
Agnile supports safety, security, and mission critical engineering programmes across automotive, aerospace, embedded, IoT, enterprise software, cybersecurity, safety, V&V, and digital engineering.