Cyrus User Guide

Introducing Cyrus for Jira — comprehensive security guidance, right where your team works

Cyrus embeds the OWASP ASVS into every user-story discussion, automatically surfacing the controls you may have overlooked and letting you push them straight into the ticket. Here’s a soup-to-nuts walkthrough so anyone on your team can be up and running in minutes—completely table-free.

1. Install Cyrus from the Atlassian Marketplace

In Jira’s top navigation bar, choose Apps → Explore more apps (you’ll need Jira Administrator rights for this step).
In the Marketplace search box, type “Cyrus”.
Click Cyrus in the results list, then hit Install.
Follow Atlassian’s prompts until you see “Cyrus successfully installed.”
You only have to install Cyrus once per Jira site.

2. Add your workspace API key

Inside the Jira project where you plan to use Cyrus, open App settings.
In the sidebar, click Cyrus —a new item added during installation.
Paste the API key you received when you registered with Cyrus.
Click Save.
Your project is now linked to the Cyrus analysis engine.

3. Run your first analysis—no code required

Open any user story (issue type Story or Task).
In the right-hand issue glance, click Analyze with Cyrus.
Wait a few seconds while Cyrus reads the summary, description, acceptance criteria, and technical notes.
A Security Requirements panel appears, listing every ASVS control that applies but isn’t yet addressed.

4. Review & select requirements

Each control appears as a checkbox prefixed with its ASVS clause (e.g., V2.1 — Verify all authentication controls are enforced server-side).
Hover to see a concise rationale or click the info icon for the full ASVS text.
Check the items you agree should be implemented for this story.

5. Push the requirements into the conversation

Scroll to the bottom of the list and click Comment selected to issue.
Cyrus posts a single Jira comment that enumerates every checked requirement—perfect for developers, testers, and reviewers to track.
Because they land in a normal comment thread, teammates can reply, edit, or convert them into subtasks as needed.

6. Iterate with confidence

Whenever the story changes—new scope, updated acceptance criteria—just hit Analyze again. Cyrus refreshes the checklist so security stays in lock-step with agile refinement.

Why teams love Cyrus

ASVS-backed – Mapping to an industry standard removes guesswork and audit anxiety.
Friction-free – One click surfaces a curated checklist right inside the issue.
Actionable – Checkboxes + “Comment” turns guidance into documented commitments.
Early & Continuous – Catch gaps before code is written and re-evaluate after every tweak.