From the CRA obligation to audit-ready documentation — here's exactly what we do and why it satisfies regulatory requirements.
The EU Cyber Resilience Act (Regulation 2024/2847) requires manufacturers of products with digital elements to exercise due diligence on every third-party component they integrate — including open-source software.
Market surveillance authorities and notified bodies will expect documented evidence of your due diligence process. They want to see:
Raw scanner output alone does not satisfy the "due diligence" standard. Auditors expect professional review and expert opinion.
Free resource: Use our CRA Due Diligence Checklist to see every requirement mapped to specific evidence — and identify where your current process has gaps.
The CRA is already in force. Key deadlines are approaching.
Dec 2024
CRA entered
into force
Sep 2026
Reporting obligations
begin
Dec 2027
Full enforcement
& penalties
Project Health
OpenSSF Scorecard & maintainer analysis
Vulnerability Intelligence
Multi-database CVE analysis
Static Analysis
SAST with AI-augmented review
Secret Detection
Credential & key scanning across history
SBOM Generation
CycloneDX software bill of materials
Threat Modelling
AI-driven risk & attack surface analysis
Reachability & VEX
Vulnerability reachability analysis
Binary Hardening
PIE, NX, RELRO & stack canary checks
Malware Scanning
Multi-engine malware & reputation analysis
CI/CD Pipeline Audit
Dangerous workflow & supply-chain checks
Cryptography & CBOM
Algorithm inventory & weakness detection
Anomaly Detection
AI-driven backdoor & intent analysis
Every report concludes with a formal assertion signed by a Principal-level security professional with 25+ years of experience. This assertion maps findings to specific CRA Annex I sections and provides the professional judgment that separates our reports from raw tool output. The assertion is what makes the report audit-ready.
Upload an SPDX or CycloneDX file, paste a list of dependencies, or just tell us what you use. We accept any format.
We map your components against our library. For in-library components, reports can be delivered immediately. For new assessments, we scope the work and send pricing within 24 hours.
After invoice payment, reports are delivered via email as they're completed. Each is a signed PDF ready to include in your CRA technical documentation.
Include reports in your technical documentation (Annex VII). Your compliance team has exactly what auditors will ask for.
Reports are timestamped and valid as of the date of issue. We recommend re-assessment within 12 months or upon major version/security patch.
If a Critical/High CVE is published for an assessed component, we notify customers within 48 hours.
Full refresh available at 50% of the original price. Keeps your documentation current for ongoing compliance.
When a component releases a new version, we assess the delta at 30–50% of new assessment price.
Not every component will meet CRA requirements. When issues are found, our reports include prioritised remediation guidance with specific, actionable recommendations. For components requiring hands-on fixes, we connect you with vetted remediation partners from our security network — keeping assessment and remediation independent, exactly as auditors expect.
Tell us about your stack and we'll send a proposal within 24 hours.
Assess My Stack