Jaguar Land Rover (2025)
A cyberattack halted 5,000 suppliers, cost £1.9B and caused a five-week shutdown.
CYBERSECURITY SOFTWARE ESCROW
Castler's cybersecurity software escrow keeps your vendors' software in encrypted custody, inventories every component and proves the software can be rebuilt and run without the vendor. A named engineer signs the result.
Critical vendor
Cyber incident reported
Flagged in the release
Illustrative interface
Castler's incident tracker shows how a cyber event at a vendor reaches you:
A cyberattack halted 5,000 suppliers, cost £1.9B and caused a five-week shutdown.
A faulty update affected 7,000 Delta Air Lines flights and cost about $500M.
Most software estates are not tested for this:
40 to 60
critical vendors in a typical estate
2 to 3
covered by deep verification
98%
never independently verified
Castler's cybersecurity solutions for vendor software combine four controls:
Encrypted, isolated, versioned and tamper-evident.
An SBOM and CBOM for each verified release.
AI agents rebuild, deploy and replicate the software in a clean environment.
A named Castler engineer signs a numbered Proof of Recovery.
Encrypted: AES-256, in transit and at rest.
Sealed: a SHA-256 integrity seal on every deposit, held immutable.
Isolated: logically separated by customer, with role-based access.
Auditable: every deposit records the timestamp, commit hash, release identifier, depositor and source repository.
Regional: AWS, Google Cloud or Azure custody in India, the UK, the EU, the US, Singapore or the UAE, subject to your agreement.
Standard Verification adds an SBOM and CBOM to your software cybersecurity record.
Premium Recoverability adds hidden runtime dependencies, such as a vendor-hosted service or licence key.
Always-current source, configuration and scripts in secure custody.
AI agents rebuild, deploy and replicate the application.
A named Castler engineer reviews and signs.
A numbered pack for that exact release.
Verification takes 6 to 18 hours per codebase, at about 90% lower cost than current verification. With Premium Recoverability, each new release gets a new verification.
Every pack gives your cybersecurity risk management file:
Independent build evidence for the release.
A procedure your team can execute without the vendor.
Proof that the production architecture was recreated.
A release-specific inventory of components.
A current measure of verified recoverability.
A named engineer's signature.
Boards, regulators, auditors and insurers can examine the same pack.
Castler maps its evidence to 17 mandates across 9 jurisdictions, so your cybersecurity risk management records answer what regulators ask for. Examples:
An SBOM and an independently rebuilt artefact for every verified release
Supply-chain security and continuity of essential services
ICT third-party risk and exit planning
Cyber-resilience governance
Information and cyber-security governance
RBI IT §12(f) and RBI PSO §17(c)
Source code or software escrow for critical applications
Castler does not claim that software alone guarantees compliance. It supplies tested technical evidence for your own controls.
CISOs accountable for software cybersecurity and vendor risk
CIOs and heads of IT risk and third-party risk management
Compliance teams
Boards and risk committees that need current recovery evidence
Per application per year, with no setup fee:
$2,000
per application per year
With secure custody and a deposit report
$3,500
per application per year
With build verification, SBOM and CBOM
$7,500
per application per year
With rebuild, run and a signed Proof of Recovery
Bundles of up to 10 applications: $7,500, $15,000 and $45,000
Book a 15-min Demo100+
enterprise customers
150+
escrow agreements
FAQ
No. Castler's cybersecurity software escrow does not replace your security tools or incident plans. It adds secure custody, a component inventory and recovery evidence.
When a release condition in your agreement is met. Castler lists insolvency, acquisition, discontinuation, support failure and other negotiated conditions.
It is encrypted with AES-256, sealed with SHA-256, isolated by customer and recorded in a full audit trail.
Standard Verification and above include the SBOM and CBOM.
6 to 18 hours per codebase, against 2 to 4 weeks for traditional human-led verification.
Castler's artefacts are designed to map to CRA, NIS2, DORA, SEBI CSCRF, IRDAI and RBI requirements.
CYBERSECURITY SOFTWARE ESCROW
Book a 15-min Demo. We will walk your software estate, name the regulation that applies to you and show you a real signed Proof of Recovery.
Book a 15-min Demo