EU 2024/2847 (CRA) · Article 14 reporting has applied since 11 September 2026
Cyber resilience for connected products
Manage the software inventory, vulnerabilities and updates of your embedded devices in one place. The records the CRA asks for are created along the way.
Hover or tap a plate.
We cover product security in four modules
Each module works on its own. Used together, the output of one becomes the input of the next: a component in the SBOM, an event in the field and the patch that fixes it end up in the same record.
01 · Discovery
Dynamic SBOM Engine
Opens firmware images (SquashFS, uImage/sysupgrade, disk images, ESP32 (ESP-IDF) application images and full flash dumps, archives) and identifies the components inside. If a layer cannot be opened or a component cannot be identified, the SBOM is marked incomplete and says why.
- Firmware image and package manifest analysis
- CycloneDX 1.6 and SPDX 2.3 output
- Matching against OSV and NVD, prioritised with CISA KEV and EPSS
- VEX in CSAF 2.0 and OpenVEX; your analyst makes the final call
02 · Prioritization
Field Telemetry and Early Warning
Devices send signed telemetry and report their own security events. Vulnerabilities are ranked by whether they are known to be exploited (CISA KEV) and how likely exploitation is (EPSS), so the urgent ones come first.
- Telemetry signed with each device's own key
- Security events reported by the device: tampering and memory corruption
- Critical device events automatically open an assessment record; your team decides whether they must be reported
- Vulnerabilities ranked with CISA KEV and EPSS
03 · Reporting
CRA Reporting Assistant
The legal deadlines start when the manufacturer becomes aware of an actively exploited vulnerability or a severe incident. The platform records that moment, calculates the 24 hour, 72 hour and final report deadlines from it, alerts you before they expire and drafts the content of each report. You submit it in ENISA's Single Reporting Platform and the submission is recorded.
- Deadline tracking with alerts for the 24 h, 72 h and final reports
- Drafts for the early warning, notification, final report and user information (Art. 14(8))
- Affected products and firmware versions taken from the records
- Append-only audit trail
04 · Remediation
Secure OTA Manager
Signs the update with a key that belongs to your company only. Before installing, the device checks the signature, the image hash and the anti-rollback protection; the update is written to the inactive A/B slot.
- ECDSA P-256 signature and hash checks on the device
- A/B slots and anti-rollback protection
- Only firmware that passed CRA analysis can be released
- Every release and device result in the audit trail
Industries we focus on
From network equipment to home appliances, from industrial automation to meters: we explain, industry by industry, what the CRA means for manufacturers selling connected products into the EU.
What happens to a vulnerability
When a new CVE is published, this is what happens, in order.
Match
The CVE is matched to a component in your SBOM. You see which products and firmware versions contain it. Earlier SBOMs are re-checked as new vulnerability data arrives.
Prioritise
The CVE is checked against CISA's Known Exploited Vulnerabilities catalogue and EPSS. Known exploited ones move to the top of the list.
Notify
The legal deadline starts when you become aware of active exploitation. The platform records that moment, calculates the deadlines from it and prepares the report drafts. Your team reviews them and submits them in ENISA's portal.
Patch
The fixed version is signed and offered to the devices. Each device verifies the signature and version and reports the result. Every step is written to the audit trail.
Security in three layers
A turtle shell has bone underneath and keratin plates on top. We built our architecture the same way, layer by layer from hardware to cloud.
The timeline is moving
The Regulation covers most manufacturers placing products with digital elements on the EU market. Reporting obligations have started. All essential requirements become mandatory on 11 December 2027.
24 hours
Early warning deadline for an actively exploited vulnerability
10 years
Minimum retention for technical documentation
€15 million
or 2.5% of worldwide turnover. Maximum fine for breaching the essential requirements
SBOM scanner
Drop in your lock file or Yocto manifest and get the component list and known vulnerabilities. The file is read inside your browser. Only the package name and version leave your machine.
Supported files
- Embedded
- Yocto *.manifest, Yocto license.manifest, Buildroot manifest.csv
- JavaScript
- package-lock.json, package.json, yarn.lock, pnpm-lock.yaml
- Python
- requirements.txt, Pipfile.lock, poetry.lock
- Java, Rust, Go, PHP
- pom.xml, Cargo.lock, go.mod, composer.lock
- Existing SBOM
- CycloneDX JSON (bom.json, *.cdx.json), SPDX 2.x JSON (manifest.spdx.json, *.spdx.json)
Common questions
No. Files are parsed inside your browser in a Web Worker. If you leave the vulnerability check on, only the package name, version and ecosystem are sent to OSV.dev. The file itself never leaves your computer.
It is not. The SBOM is one part of the vulnerability handling requirements in Annex I. The CRA also requires fixing vulnerabilities, reporting active exploitation, distributing updates securely and keeping technical documentation.
On 11 September 2026. When you become aware of an actively exploited vulnerability you have 24 hours for an early warning and 72 hours for the notification. The final report is due no later than 14 days after a fix is available.
No. The EN 18031 series was written for the cybersecurity requirements of the Radio Equipment Directive (RED). Separate harmonised standards are being prepared for the CRA. See the EN 18031 guide.
We are built for embedded hardware. We analyse the firmware image itself, not only source manifests. Our C SDK runs on microcontrollers. The SBOM, Article 14 reporting and signed OTA updates share the same record.
Most products with digital elements are in the default category. Routers, modems, smart locks and security cameras are Class I. Our short class check shows the likely class; for examples by field, see our industry pages.
We start with a technical call, then run a free CRA pre-scan of a firmware you choose. After that we plan a pilot with scope and success criteria agreed in writing up front. See the pilot program.
Let's talk about your product
Tell us briefly about your product and how your devices connect. One of our engineers will read your message and get back to you.
- Address
- Teknopol Istanbul
- linkedin.com/company/tegmensoft
Programs we're part of
Infrastructure
© 2026 NVIDIA, the NVIDIA logo, and NVIDIA Inception are trademarks and/or registered trademarks of NVIDIA Corporation in the U.S. and other countries.
Amazon Web Services, AWS and the Powered by AWS logo are trademarks of Amazon.com, Inc. or its affiliates. Claude and Anthropic are trademarks of Anthropic PBC. Program memberships do not imply endorsement of TegmenSoft or its products by the respective companies.