Crosscheck
Crosscheck is VSEC’s automated TARA reviewer. Upload an ISO/SAE 21434 TARA, a STRIDE/PASTA/OCTAVE/LINDDUN threat model, or another design-analysis report, and Crosscheck independently re-derives the same analysis from the document’s own system context, then diffs its findings against what the report actually contains — surfacing gaps in completeness, consistency, traceability, and control coverage.
Starting a Review
On the Crosscheck page, fill in:
- Review name (optional) — a label for the review; falls back to the uploaded file’s name if left blank.
- Review profile — the methodology to review against (see Review Profiles). Defaults to ISO/SAE 21434 TARA.
Click Upload & review, choose a file, and Crosscheck uploads it, queues a review job, and takes you straight to the review’s results page.
Supported file types: PDF, DOCX, XLSX/XLSM, CSV/TSV, Markdown, and plain text (.txt), up to 50 MB. A file with an unsupported extension is accepted at upload but fails when the review parses it.
Review Profiles
| Profile | What it reviews against |
|---|---|
| ISO/SAE 21434 TARA | ISO/SAE 21434 §15 work products and UN R155/R156 applicability |
| STRIDE — Embedded Device | STRIDE threat modeling tuned for embedded/IoT devices (debug ports, firmware, physical attack surface) |
| STRIDE — Web Application | STRIDE for web/SaaS applications, cross-referenced against OWASP ASVS/Top 10 |
| PASTA | The 7-stage Process for Attack Simulation and Threat Analysis |
| OCTAVE Allegro | Information-asset-driven organizational risk assessment |
| LINDDUN — Privacy Threat Modeling | Privacy threats using the LINDDUN category set |
| Attack Trees | Graph-based threat modeling (root goal → AND/OR branches → leaves) |
| Free-form / Methodology-Agnostic | Reports with no formal methodology; Crosscheck infers structure and may recommend adopting one |
Each profile defines its own required sections, scoring rubric, and pass/fail threshold, so the same report can score differently depending on which profile you review it against.
Recent Reviews
Below the upload controls, the landing page lists your Recent reviews — the latest 100, newest first — each showing its status, profile, and score once one has been computed. Click a review to open its results page. A review interrupted by a server restart is marked failed with a “Start a new review” prompt.
Review Progress
While a review is queued or running, the results page shows live progress: an Agents panel listing each pipeline stage (parsing, methodology detection, system-context extraction, independent threat re-derivation, a methodology-specific auditor, and gap synthesis, among others) with its current state, and a Live activity log streaming what the pipeline is doing in real time. The page updates automatically as the review advances and refreshes once it completes.
Review Results
Once a review completes, its results page shows an overall score (pass/fail against the profile’s threshold) and four tabs:
- Summary — methodologies detected in the report, a breakdown of findings by severity, and a list of top risks.
- Findings — every issue Crosscheck found, filterable by severity (critical/high/medium/low/info), each with a category, the agent that raised it, a description, and supporting evidence quoted from the report.
- Diff — a comparison between the threats Crosscheck independently re-derived from the report’s own system context and what the report’s threat list actually contains: Matched (both agree), Missed by report (Crosscheck found it, the report didn’t), and Extra in report (the report claims it, Crosscheck’s independent pass didn’t corroborate it).
- Recommendations — suggested fixes, filterable by priority (P0–P3), each with a title and a concrete action to take.
Click Export JSON on a completed review to download its full results.
Settings
Click Settings on the Crosscheck page to configure the Anthropic API key Crosscheck uses to run its review pipeline. The key is stored per workspace. The dialog shows whether a key is currently configured (masked to its last four characters) without ever displaying the full key. Saving a new key requires workspace admin access.
Permissions
When reachable, Crosscheck was gated by the Design permission block — see Design → Permissions. It is currently unavailable regardless of permissions; see the notice at the top of this page.