SBOM & vulnerability viewer
Explore a product's components, filter its CVEs, and mark what's actually exploitable with VEX.
Aperto demo → InteractiveProntezza CRA score
Tick off the essential requirements and watch a deterministic readiness score move in real time.
Aperto demo → InteractiveWhich CRA class are you?
Answer three questions about your product and see whether the CRA treats it as default, important, or critica — and what that means.
Aperto demo → WalkthroughGenerating a CRA dossier
How SBOMs, scans, and decisions compile into audit-ready technical documentation.
Aperto demo → WalkthroughThe CRA incident-reporting clock
24 hours, 72 hours, 14 giorni — the early-warning and notification deadlines when an exploited flaw is found, and what each one needs.
Aperto demo → WalkthroughSecure-by-default, requirement by requirement
The CRA's essential product requirements — no default passwords, least privilege, secure updates — as a checklist you can actually work.
Aperto demo → ScenarioScenario: responding to a new CVE in minutes
A critica vulnerability drops at 9am. Follow the trail da alert to a customer-ready answer.
Aperto demo → ScenarioScenario: answering a security questionnaire
The enterprise questionnaire that used to take a week — answered da a living evidence log.
Aperto demo → ScenarioScenario: when an open-source dependency goes dark
A core library's sole maintainer disappears. Manage the CRA risk of unmaintained components without panic.
Aperto demo → ScenarioScenario: choosing your conformity route
Self-assessment or a notified body? Walk the decision the CRA forces on you, and what each path costs in time and proof.
Aperto demo → InteractivePiano your CRA support window
Set your product's expected lifetime and see the support period the CRA obliges you to cover.
Aperto demo → WalkthroughA CRA-grade patch process
Monitor, assess with VEX, remediate, and ship a signed update — with SLAs that scale by severity.
Aperto demo → WalkthroughStanding up coordinated disclosure
security.txt, intake, triage, and researcher comms — the disclosure process the CRA expects.
Aperto demo → WalkthroughSBOM generation in CI/CD
Wire CycloneDX generation into the pipeline so every build emits a current SBOM that feeds monitoring.
Aperto demo → WalkthroughGoverning third-party components
Inventory, license and maintenance health, and a policy gate before a dependency ever ships.
Aperto demo → ScenarioScenario: ending support the CRA way
A product reaches end-of-life. Notify users, ship the last update, and close out the support period on record.
Aperto demo → ScenarioScenario: a poisoned dependency
A popular package ships a malicious version. Detect esposizione da the SBOM, contain, and communicate — calmly.
Aperto demo → ScenarioScenario: a CRA conformity audit
The auditor arrives. Walk them da SBOM to VEX to dossier — every claim traceable to evidence.
Aperto demo → ScenarioScenario: documenting a risk acceptance
A low-severity flaw won't be fixed before release. Record a defensible, time-boxed acceptance with sign-off.
Aperto demo → ScenarioScenario: does the CRA apply to your OSS?
Walk the open-source exemptions and the steward-vs-manufacturer line to a clear yes or no.
Aperto demo →