Cyber Resilience Act · Regulation (EU) 2024/2847
When a vulnerability is exploited, know which customers are affected.
Vulnward links every exploited vulnerability to the versions installed on your customers' systems, prepares your ENISA early warning within the Cyber Resilience Act deadlines, informs only the customers concerned, and has every key step timestamped by an eIDAS qualified provider.
Remote code execution in parsekit 2.4.1
Atlas Desktop 5.0 → 5.2 · 17 of 52 customers affected · FR, BE, LU, DE
Awareness record (Thu 12 Nov, 08:50, Paris) timestamped by a qualified provider. Advisory ready for the 17 customers concerned.
Preview of the product under construction · fictional data
The timeline
The reporting obligation already applies.
Since 11 September 2026, including for products sold before that date. Full compliance follows on 11 December 2027.
Products with digital elements placed on the EU market, with some exclusions.
Early warning within 24 h, notification within 72 h, final report.
Without compliance, a product can no longer be placed on the EU market.
What makes us different
Most tools talk about CVEs. Vulnward talks about your customers.
Plenty of tools generate SBOMs and watch CVEs. The day a vulnerability is exploited, the real questions are elsewhere: who is exposed, have you told them, and can you prove it?
Who is affected
Your installed base, imported from your systems: “17 of 52 customers affected”, with their versions and countries.
Customers informed
An advisory you review, sent only to the customers concerned, in their language. You see who read it and who applied the fix.
Timestamped evidence
Your awareness record, every notification and every customer advisory are timestamped by an eIDAS qualified provider: the date and time of the timestamp enjoy a presumption of accuracy throughout the EU.
CRA drill
We simulate a vulnerability exploited on a Friday at 6 pm. You measure your response times and keep a timestamped report.
How it works
Four steps, no one to hire.
Connect
Your CI sends an SBOM with every release. Your installed base is imported from your licence server, your CRM or a simple spreadsheet.
Link
Every exploited vulnerability is matched against installed versions: you see which customers are affected, not a list of CVEs.
Notify
Early warning, notification and final report prepared with countdowns. An advisory goes only to the customers concerned, in their language.
Timestamp
Awareness, decisions and notifications timestamped by an eIDAS qualified provider. Everything is archived for your 2027 file.
One step in your workflow.
The Vulnward action generates the SBOM in your CI with proven tools (Syft, cdxgen) or reuses yours, then sends it with GitHub's OIDC token. Only the SBOM and manifests leave; never your code.
Obligations
What the CRA requires, what Vulnward handles.
Every feature maps to an article or annex of the regulation. Nothing more.
| CRA obligation | Vulnward's answer |
|---|---|
| Component inventory (SBOM) | A CycloneDX or SPDX SBOM for every release, from your CI, with the tools you already use. |
| Vulnerability handling | Continuous monitoring of EUVD, OSV, NVD and the KEV catalogue, for every version still installed on your customers' systems. |
| Reporting: 24 h · 72 h · final report | An alert as soon as an exploited vulnerability hits an installed version; pre-filled notifications for ENISA's platform, Member States suggested from your installed base. |
| Informing users (Art. 14(8)) | An advisory sent only to the customers concerned, in their language, with read and fix-applied tracking. |
| Vulnerability prioritisation | A justified VEX status, approved by your teams; AI assistance and reachability analysis planned for 2027. |
| Technical documentation (Annex VII) | A compliance file that builds up release after release (planned for mid-2027). |
Our commitments
We will hold the list of your vulnerabilities and your customers. We will protect it accordingly.
Hosted in France
The product will be hosted by Scaleway in Paris. Subprocessors listed publicly.
Your customer list protected
Pseudonymous mode available; names and contacts encrypted, never sent to AI.
Your code stays with you
Only manifests and the SBOM leave your CI.
AI under control
AI suggests, your teams decide. Every suggestion is logged.
Pioneer programmeme · 10 vendors
Join the pioneer vendors.
Vulnward is being built with a small group of software vendors. First access: early 2027.
- A free 30-minute CRA assessment: we simulate a vulnerability exploited on a Friday at 6 pm, you leave with a written action plan
- Early access and a guaranteed founder price
- A direct line to the founder to shape the roadmap
Reply within one business day
Frequently asked questions
Vulnward is a tool; it does not replace legal advice.
Is my product covered by the CRA?
The CRA covers products with digital elements placed on the EU market: installed software, desktop and mobile applications, embedded software, connected devices, with some exclusions. A pure SaaS service is in principle not covered by the CRA; it may fall under the NIS2 directive depending on your sector and size. The assessment is there to settle it, product by product.
Does Vulnward read my source code?
No. The SBOM is generated in your own CI; only the SBOM, dependency manifests and release metadata are sent. Your code never leaves your infrastructure.
Do I need to install anything on my customers' systems?
No. Your installed base is imported from what you already have: licence or update server, CRM, spreadsheet. You can even use internal references only (pseudonymous mode).
What is a qualified timestamp?
A timestamp issued by a qualified trust service provider under the EU eIDAS Regulation. It attests that a document existed at a given date and time and has not been altered since; that date and time enjoy a presumption of accuracy throughout the EU. On its own, it does not vouch for the document's content. Vulnward only sends the provider a fingerprint of your documents, never their content.
Does Vulnward submit notifications on my behalf?
No. Vulnward prepares each notification (pre-filled fields, completeness check, export), then you submit it yourself on ENISA's single reporting platform. We archive the evidence. Nothing is ever sent to an authority without you.
What if I'm a small company?
Micro and small enterprises are not fined solely for missing the 24-hour early-warning deadline, but they must still report. Medium-sized and large enterprises fall under the full regime.
When will the product be available?
Vulnward is being built with a small group of pioneer vendors. First access is planned for early 2027, well ahead of the 11 December 2027 deadline.
Where will my data be hosted?
The product will be hosted in France, by Scaleway in Paris. Our subprocessors are listed on the Security page.