Compliance Engine
Self-service product security & CRA compliance
How it works
Standards
Pricing
Log in
Attackers don't find new vulnerabilities — they look for known ones in components manufacturers forgot they were using. The vulnerability ships with the product.
Modern firmware holds hundreds of open-source libraries and legacy code no single engineer fully knows. A single unpatched one is enough.
Traditional audits are slow, inconsistent, and depend on individual assessor skill. Weeks pass before you learn whether a product passes.
The EU CRA and RED require documented, traceable security evidence for every connected product placed on the market.
CRA vulnerability reporting begins Sept 11, 2026; full conformity and CE marking are due Dec 11, 2027.
The engine extracts your firmware, matches every component against known vulnerabilities, boots it to probe the live attack surface, and maps the evidence to each requirement — automatically.
Drop your production image — .bin, .img, .ubi, .ota, or vendor-encrypted.
Extraction, static analysis, live QEMU emulation, SBOM & CVE matching run automatically.
Findings mapped to your product and a technical-readiness score against your standard.
Interactive report, CycloneDX SBOM, and CRA requirement mapping — shareable instantly.
Powered by the open-source EMBA analyzer + a Claude reasoning layer that turns raw findings into requirement-level evidence.
Every package cross-referenced against NVD, CVE.org, and Exploit-DB, flagging CISA Known Exploited Vulnerabilities.
Default passwords, private keys, and API tokens surfaced from the filesystem before an attacker finds them.
NX, PIE, RELRO, and stack canaries verified on every compiled binary in the image.
A machine-readable inventory of every component and version — the foundation of ongoing CVE monitoring.
The firmware is booted in QEMU and probed like a real attacker would — catching runtime issues static analysis can't see.
Every finding is mapped to the specific CRA essential requirement it affects — with the evidence, in plain language.
The same firmware evidence maps across the frameworks CSA Group assesses — so nothing is re-run when you move toward full certification.
Upload firmware, get an instant automated report.
A signed readiness summary you can share with buyers today.
Detailed findings, fix guidance, and unlimited re-scans.
A CSA expert takes over — your scan history reduces the effort.
Pay per scan while you iterate, or subscribe for continuous CRA compliance. Every dollar spent on self-service is credited toward full certification.
See where one product stands before committing to anything.
Continuous compliance for the 5-year post-market obligation.
Expert-led conformity assessment, built on your scan history.
Pricing to be finalised. Certification engagements are quoted per product after a scoping call.
No quotes, no engagement letters, no waiting weeks for a PDF. Just answers.
Log in to the Compliance Engine