From thousands of CVE matches to the ones that apply — with evidence, signed
Send one Linux firmware image. Within 10 working days you get an SBOM, a triaged vulnerability list, VEX, a CSAF advisory and a report, reviewed and signed off by an analyst. €390 per image.
Coming soon: we are not taking orders yet.
Read the sample reportFor businesses only
Triage from the image alone
3.2% decided
247 not affected, 0 affected, 7,426 need review
With your kernel .config
70.5% decided
4,887 not affected, 526 affected, 2,260 need review
- Not affected, with evidence
- Affected
- Needs review
The Cyber Resilience Act clock is already running
Under Regulation (EU) 2024/2847, a manufacturer has to know which components are in each product and which known vulnerabilities affect them. That starts with the firmware you already ship.
Summary of Articles 14, 64, 69 and 71 and Annex I of the regulation text on EUR-Lex. Not legal advice.
11 September 2026
Reporting obligations apply, including for products already on the market. An actively exploited vulnerability needs an early warning to the coordinating CSIRT and ENISA within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix being available.
11 December 2027
The whole regulation applies. Annex I Part II requires you to identify and document the vulnerabilities and components in your product, including a machine-readable software bill of materials. Breaches of these requirements can be fined up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.
What you get for one image
- Software bill of materialsCycloneDX 1.6
- Every package, the kernel and file hashes found in the shipped image, not in your build tree.
- Triaged vulnerability listin the report
- Each CVE match marked affected, fixed, not affected or needs review, with the rule and the artefact behind the decision.
- VEX statementCycloneDX VEX
- Machine-readable exploitability for each finding, ready to share with your customers.
- Security advisoryCSAF 2.0, VEX profile
- The same decisions as a CSAF document, the OASIS standard format for security advisories.
- ReportHTML and PDF
- Summary, known exploited vulnerabilities first, the evidence for every decision, and the limits of the analysis.
How it works
1
Buy
Pay €390 by card. Checkout asks for your business name and VAT or tax ID, and you receive an invoice with no VAT added.
2
Upload
You get a private upload link by email. Add the image, and your kernel
.configif you have it.3
Get the report
Within 10 working days of the upload you get a download link for the signed-off bundle.
See a full report before you buy
The sample is the real output for the public OpenWrt 21.02.0 image for the TP-Link Archer C7 v2: 7,775 findings, 16 of them in CISA's catalogue of known exploited vulnerabilities, each with its evidence.
One firmware image
€390
Net price, for businesses. No VAT added: EU customers account for VAT by reverse charge.
- All five deliverables, reviewed and signed off
- Delivered within 10 working days of your upload
- Files deleted 30 days after delivery
Full refund if we can't extract your image or we miss the 10-day deadline.
Coming soon: we are not taking orders yet.
For businesses only
Questions
Why not a free scanner or an AI chatbot?
A scanner matches version numbers. On the OpenWrt image above that gives 7,775 CVE matches and no decision about which ones apply. A chatbot can write a plausible answer, but it can't show why, and asking twice can give two answers.
Here every decision comes from a fixed rule, and every “not affected” or “fixed” points to its evidence: a file hash, a line of your kernel configuration or a recorded backport. The same image and data give the same result. No language model sets a verdict.
What happens to my firmware?
You upload it to private storage through a one-time link. We copy it to our analysis workstation and delete the cloud copy. 30 days after delivery the firmware and the deliverables are deleted. We keep only the sign-off record and the list of file hashes in the bundle, so we can confirm later what we delivered.
Which firmware is supported?
Linux-based images, up to 512 MB. If we can't extract a Linux file system from it (for example an RTOS or an encrypted image), you get a full refund. Adding your kernel .config lets far more kernel CVEs be decided, as the chart above shows.
What does “signed” mean?
A named analyst reviews the triage and signs it off. The sign-off records the SHA-256 of the reviewed triage, and every deliverable is generated from exactly that file. It is a recorded sign-off, not a qualified electronic signature.
How are invoicing and VAT handled?
The seller is the business named in our imprint. We sell to businesses only, and the price is charged in EUR: €390 net, with no VAT added.
After payment, Stripe emails you the invoice. It shows your business name, address and tax ID and the reverse-charge mention: if you are in the EU, you account for the VAT yourself under the reverse-charge rule.
Does this make my product CRA compliant?
No single report does. This gives you the component inventory and the documented vulnerability decisions that Annex I Part II asks for, for one image at one point in time. Conformity assessment and your other obligations stay with you.