CRA reporting obligations apply nowMain obligations from 11 December 2027
Get CRA ready, from SBOM to security disclosure
Manage product security for every release you support. Generate SBOMs, monitor vulnerabilities, record what you decided and why, and tell your customers. All in one platform you can run in our cloud or on your own infrastructure.
The CRA doesn't stop when you ship. Neither should your security process.
Under the Cyber Resilience Act, handling vulnerabilities is a legal obligation for the whole support period of a product. An SBOM at release is only the start.
An illustrative product lifecycle under the CRA, from release to end of support.
Support period · at least 5 years
v2.0You shipSBOM generated, release recorded
CVE-2026-XXXXXA dependency is hitIn a release you still support
24 hReport if exploitedEarly warning through ENISA’s platform
v2.0.4Fix and disclosePatch shipped, advisory published
EOLEnd of supportCustomers told, records kept 10 years
to send an early warning of an actively exploited vulnerability
24 h
minimum support period, unless the product is expected to be used for less
5+ years
maximum fine, or 2.5% of global annual turnover if that is higher
€15M
sbomify gives you one connected workflow for all of it, from software composition to customer disclosure. See how it works
How it works
Know what's in your software. And which releases are affected.
Four steps that stay connected for as long as you support a product.
CycloneDX and SPDX from your pipelines or uploads, validated and never altered.
sbomify links the finding to the products and releases that ship it, so your team goes from an alert to a recorded decision, a tracked fix and a published advisory.
Which of your supported releases contain it?Three of four, straight from their SBOMs
Are you actually affected?v2.0 and v2.1 are; v1.2.1 is not, recorded with VEX
Does it need a patch?Fixed in 2.0.4, in progress for 2.1
What do you tell your customers?An advisory, on your Trust Center and as CSAF
CVE-2026-XXXXXCriticalin acme-parser 2.4.0
Supported releases of an example product and their status for one vulnerability
Release
Support
Status
v2.1
Until 2031
Affected · fix in progress
v2.0
Until 2030
Fixed in 2.0.4 · advisory published
v1.2.1
Until 2028
Not affected · VEX: code not reachable
v1.0
Ended 2026
End of life · customers notified
Illustrative example: one vulnerability across four releases of the same product.
Less time reconstructing your software history. More time fixing what matters. Vulnerability scanning
AI-enabled, not AI-powered
Your agents. Your data. Your decisions.
Your AI agents already know your codebase. sbomify gives them structured security data and an API built for them, with a token that can propose work but never approve it.
An illustrative agent session: the agent triages a critical vulnerability with sbomify and proposes a VEX statement, which a person approves in the review queue.
Investigate a CVEin the context of your own code, using the triage and fix prompts sbomify generates
Propose VEX statementsthat explain why a release is or isn't affected
Draft security advisoriesand propose updates to published ones
A person signs off. VEX statements from an agent wait in a review queue, and its changes to published advisories are shown to your team as a diff. sbomify doesn't bundle an AI model, so you choose which agents and model providers to use, and where your data goes.
Evidence · Compliance · Disclosure
Prove it. To auditors, regulators and customers.
The work you do in sbomify becomes the record you show.
Trust Center
Disclosure your customers can actually use
Send a link, not a call. Security questionnaires in minutes, not weeks.
Vulnerability disclosure policy.mdMarkdown · Published
security.txtText · /.well-known/
Article 14 notificationsFolder · 3 templates
Trusted By
“Using sbomify has hugely accelerated our work on NTIA compliance. Viktor has also been leading a group that’s creating standards for making SBOMs — this gives us confidence that sbomify will become a platform that follows industry practices as they emerge.”
Built by people who write the standards. Founder Viktor Petersson co-led the CISA working group on SBOM generation and is an invited expert to ECMA TC54. When the standards move, sbomify moves with them.
Ready when you are
Your CRA vulnerability-handling workflow starts here
Stop managing SBOMs, releases, vulnerabilities and security disclosures in separate systems. Bring them together with sbomify.
We would like to set analytics cookies to understand how the site is used. They are only set if you accept, and you can change your mind at any time via “Cookie settings” in the footer. Read our Privacy Policy.
Chris SwanEngineer, Atsign
Built by people who write the standards. Founder Viktor Petersson co-led the CISA working group on SBOM generation and is an invited expert to ECMA TC54. When the standards move, sbomify moves with them.
Viktor Petersson
Read
Compliance