.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
The CRA is already in force. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities within 24 hours, including for products already on the market. From 11 December 2027, every product placed on the EU market must meet the full requirements: secure development, an SBOM, vulnerability handling and security updates.
Typically, compliance starts with a consultant's gap report. The fixes are then handed to a development team that wasn't part of the assessment, or squeezed between feature work. The report ages, the pipeline doesn't change, and the evidence is rebuilt by hand before every audit.
We do it as one team. The engineers who assess your product are the ones who build the fixes: security checks in your pipeline, an SBOM on every build, a working disclosure process. From the first sprint, you get one plan, one backlog and evidence that stays current as your product changes.
We confirm whether the CRA applies, your role and your product's category.
Code, dependency and secrets scanning in the pipeline you already run.
A software bill of materials generated on every build, in CycloneDX or SPDX.
A public channel for reports, triage rules and a patch process.
Security checks added to your existing QA, plus independent penetration testing.
One team for new vulnerabilities, patches, incident reports and documentation after release.
.webp)
.svg)
.svg)
.webp)
It applies to almost every product with digital elements sold in the EU, including standalone software. Pure SaaS is generally outside the CRA, but cloud functions a product needs to work are in scope, and SaaS providers may fall under NIS2. We confirm your case in the first days of the review.
Yes. The reporting obligations that started in September 2026 cover products already on the market. The full requirements apply to products placed on the market from December 2027 and to products that are substantially modified.
Most products can be assessed by the manufacturer itself. Some "important" and "critical" categories need a third-party assessment. We tell you which route applies; we don't issue certificates ourselves.
The review takes 2 weeks. Remediation typically runs 6-12 weeks, planned around your releases.
Yes. We review the code and pipeline as they are, and remediation can be done by your team, by ours or together.
You do. Pipeline configuration, SBOMs, the risk register and technical documentation stay in your repositories and are handed over in full.
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.webp)
.webp)
