Product security evidence platform EU Cyber Resilience Act
From vulnerability findings to Product-Version evidence.
Connect SBOMs, vulnerability findings, engineering reviews and remediation decisions to the Product Versions you ship. Keep a traceable evidence record for security reviews and CRA readiness.
Demo Product Version
Industrial Gateway
Product Version
Industrial Gateway · 2.4.1
Primary SBOM
Linked to version
Findings
In review scope
Finding review
Example component finding
Human decision
Applicability, rationale and response
Evidence record
Product-Version Evidence Pack
After release
Product security doesn't stop at release.
When a new vulnerability finding appears, teams need to understand the Product Version context, assess applicability, record the response and retain the evidence.
Built to complement your tools
Your scanner finds the issue. CRA Ledger keeps the response connected.
Existing security tools
- Identify component vulnerabilities
- Generate findings and alerts
- Support investigation
CRA Ledger
- Connect findings to Product Versions
- Record human decisions and rationale
- Track remediation decisions
- Retain Product-Version Evidence Packs
Keep your existing security tools. Add a traceable evidence record around the work that follows a finding.
Product proof
See the Product-Version evidence workflow.
The application brings a linked SBOM, finding reviews, decisions, release sign-off and Evidence Pack history into the Product-Version Evidence Record. Explore the product workflow and its outputs.
CRA relevance
Keep CRA reporting assessments connected to product evidence.
CRA Ledger links vulnerability handling, human assessment and reporting milestones to retained Product-Version evidence. Teams remain responsible for legal reportability decisions.
Bring one Product Version. See how the evidence connects.
Start with a 20-minute walkthrough. If there is a fit, discuss a no-cost guided pilot using one to three Product Versions or SBOMs.