EU CCAT Project Develops Open-Source Tools for Continuous Security Assessment
The EU-funded CCAT project is building an open-source toolchain to help organisations assess digital product security continuously and navigate evolving EU cybersecurity requirements.
The EU-funded Cybersecurity Certification and Assessment Tools project, known as CCAT, is developing an open-source toolchain for continuous security assessment of digital products and services. Coordinated by Masaryk University under Horizon Europe, the project aims to help producers, consumers and regulators assess cybersecurity in the context of evolving EU rules, including the Cybersecurity Act and Cyber Resilience Act.
The central idea is practical: security assessment should not end when a product receives a certification. Digital products, software dependencies and threat landscapes change over time. CCAT is adapting four existing open-source tools for real-world use across transport security, cryptographic implementations, embedded hardware and certification information. The project's official CCAT project website describes this work as a route to more transparent and repeatable cybersecurity assessment.
What the CCAT toolchain covers
CCAT brings together tools that address different parts of the security-assessment process. They are not a single scanner or a one-click compliance product. Instead, the tools target distinct technical questions that can arise when building, buying or operating digital products.
- TLS-Scanner analyses the security of TLS clients and servers. Built on TLS-Attacker, it can help identify issues in the protocol configurations used to protect communications.
- SCRUTINY analyses cryptographic implementations in hardware and software. Its intended evaluation environments include smartcards, Trusted Platform Modules and embedded libraries.
- ALVIE automates security evaluation for embedded hardware architectures by bridging formal verification and vulnerability research. The project plans support for FPGA and RISC-V environments.
- sec-certs collects and structures certification artefacts from Common Criteria, EUCC and FIPS 140. It also exposes links to known CVEs, improving visibility into the certification landscape.
| CCAT tool | Primary focus | Practical assessment value |
|---|---|---|
| TLS-Scanner | TLS client and server security | Examines the security of protected network communications. |
| SCRUTINY | Cryptographic implementations | Supports evaluation of cryptography in hardware and software environments. |
| ALVIE | Embedded hardware architectures | Automates evaluation using formal verification and vulnerability research approaches. |
| sec-certs | Security certification artefacts | Structures certification records and connects them with CVE information. |
This division matters because a company may need very different evidence depending on its product. A web service operator may focus on TLS configuration, while a manufacturer of connected equipment may need insight into embedded hardware and cryptographic components. Teams evaluating suppliers can also use structured certification information to better understand the security context around a product.
Why continuous assessment matters for businesses
The Cybersecurity Act and Cyber Resilience Act are part of a changing European cybersecurity environment. CCAT is designed to support assessment and alignment with related regulatory guidance, but it does not replace a legal determination, a certification decision or an organisation's own security work.
For businesses, the potential value is in making security evidence more repeatable. Rather than treating a security review as a one-time procurement or release activity, teams can use relevant assessment tools during product development, technical due diligence and ongoing maintenance. That can make it easier to identify issues earlier and create a clearer record of what was reviewed.
Open-source availability can also lower the barrier to evaluating suitable tools before committing to proprietary software. It does not make implementation cost-free. Teams still need the technical capability to run assessments, interpret results, prioritise remediation and document decisions. The supplied project information identifies all four tools as open source, while specifically noting public GitHub availability for TLS-Scanner. Organisations should review the licensing and usage terms for each tool or repository before adopting it in a commercial workflow.
The most useful starting point is to match the tool to a concrete risk. For example, a business can determine whether it needs to review internet-facing TLS services, validate cryptographic code, assess an embedded architecture or investigate the certifications and CVEs associated with a component. This avoids treating security tooling as a generic compliance checklist.
Security assessment delivers more value when findings reach the people and systems that can act on them. Scalevise can help teams integrate security assessment data with operational systems, reducing manual handoffs between technical reviews, issue tracking and internal reporting. A focused integration can make recurring checks easier to manage while preserving the evidence needed for product and service decisions. Discuss an integration project with Scalevise.
Frequently Asked Questions
What is the EU CCAT project?
CCAT is the EU-funded Cybersecurity Certification and Assessment Tools project. It is a Horizon Europe Innovation Action coordinated by Masaryk University that is developing an open-source toolchain for continuous security assessment of digital products and services.
Which tools are included in CCAT?
CCAT centres on TLS-Scanner, SCRUTINY, ALVIE and sec-certs. They cover TLS security, cryptographic implementations, embedded hardware assessment, and structured security certification information respectively.
Does CCAT guarantee compliance with EU cybersecurity rules?
No. CCAT is designed to aid security assessment and support alignment with evolving EU cybersecurity guidance. It does not itself guarantee legal compliance or replace a certification decision.
Are CCAT tools available as open source?
The project describes all four tools as open source. TLS-Scanner is specifically noted as having a public GitHub codebase. Businesses should check the applicable licensing and usage terms for each tool before deployment.
Conclusion
CCAT's significance lies in combining several open-source assessment approaches around a continuous-security model. Its tools address different technical layers of a digital product, from TLS and cryptography to embedded hardware and certification records. For organisations navigating changing EU cybersecurity expectations, the project offers useful building blocks, but practical value will depend on selecting the relevant tools and incorporating their findings into ongoing security work.