See what matters
Bring findings, affected components and severity into one clear view.
YOUR PRODUCT. UNDER THE SURFACE.
See deeper.
Ship with clarity.
From the components you ship to the risks you need to review. Make your software evidence visible.
Repository / SBOM → Findings → Evidence
01 / DEPENDENCY INSPECTIONILLUSTRATIVE VISUALIZATION
FROM THE VISUAL TO THE VALUE
Start with what you ship.
Connect a repository at a specific commit with read-only access, or upload an SBOM. Every finding needs a source you can trace.
Watch a sample scan sample-productIllustrative scan
1,284components resolved
package-lock.jsonproduct.cdx.json Source pinned to commit a3f9c21
A scan, start to finish
See what your product contains.
KROMSE identifies components and checks them against vulnerability advisories. Follow the path from the source file to the affected version.
- Source
- Components
- Findings
- Human review
Illustrative scan
kromse — scan
commit a3f9c21
- Connecting repository — read-only
- Pinning commit a3f9c21
- Resolving dependency tree
- Generating SBOM (CycloneDX)
- Matching against vulnerability data
- Writing findings in plain English
- Awaiting your product impact review
1284components resolved
Traceable evidence
Human review required
Findings
- Known exploitedlibwebp 1.2.4CVE-2023-4863
Attackers are exploiting this vulnerability elsewhere — confirmed exploitation somewhere in the world, not evidence of anything in your product. Your build includes the affected version.
- Highopenssl 3.0.8CVE-2023-0464
A vulnerable version is present in this example. Reachability has not been established for this finding. Review the evidence and your product's exposure before deciding its impact.
- Mediumexpress 4.17.1CVE-2024-29041
An update is available. No exploitation is recorded in this example.
Article 14 draft after your confirmation
Fields KROMSE cannot know are left as marked blanks for a human to complete — never guessed.
Illustrative sequence. KROMSE reads the repository read-only, pins one exact commit, and never writes to it.
Read-only accessExact commit
An illustrative workflow, with example findings rather than results from your product. Scan duration depends on the input and coverage; response cases and report drafts require your team's decisions.
From a finding to a next step
Less deciphering. More understanding.
KROMSESample productIllustrative exampleA clear view of what needs attention
3findings to review
Known exploited
What this means
Attackers are exploiting this vulnerability elsewhere — confirmed exploitation somewhere in the world, not evidence of anything in your product. Your build includes the affected version.
Know what to verify
See what the scan established, what remains uncertain, and what your team needs to decide.
Keep the evidence together
Carry findings and recorded decisions into an internal CRA report draft for human review.
How it works
Three steps to your first scan
- 01
Create your account
A workspace for your products, findings and evidence.
Read the full explanation
Create a workspace for your products, scan evidence and findings. Your team decides which findings need a response case after reviewing their impact.
- 02
Connect GitHub, or upload an SBOM
Choose a repository for read-only access, or upload a CycloneDX or SPDX SBOM.
Read the full explanation
The KROMSE GitHub App is read-only, and you choose which repository it may see. No repository to hand? Upload a CycloneDX or SPDX SBOM instead and the scan runs against that.
- 03
Read what your product contains
Review the findings, verify their impact and decide what happens next.
Read the full explanation
KROMSE checks components found at the scanned commit, or listed in your uploaded SBOM, against supported advisory sources. It records findings and coverage limits for your team to review before responding.
02 / FOLLOW THE EVIDENCE
The scan is only the beginning.
Record your team’s determination and supporting evidence. Use them in an internal CRA report draft, with missing information visible and human review still required.
Open your workspaceEvidence recordedHuman review required
ILLUSTRATIVE VISUALIZATION
What a scan gives you
A finding you can read without a security background
KROMSE organizes findings into five parts, giving your team a starting point for assessing product impact.
Uncertainty is written down, not rounded off
“Attackers are exploiting this vulnerability elsewhere — that means confirmed exploitation somewhere in the world, not evidence of anything in your product.”
Known exploitation elsewhere does not establish exploitation in your product. KROMSE keeps that distinction explicit.
Read the full explanation
Matching a component to an advisory does not by itself prove that your product is exploitable. KROMSE shows reachability only when a supported analysis engine produced evidence for that scan. Otherwise it remains unverified. Your team reviews the product impact.
And then: what to do about it
After your team confirms that a finding affects a product you place on the EU market, KROMSE can open a response case and record your decision. You choose when to prepare an internal Article 14 draft. Missing facts stay marked for human review, and tracked dates are an operational aid, not a legal determination.
Why now
Article 14 arrives before the rest of the Regulation
The Cyber Resilience Act applies to products with digital elements placed on the EU market. Its reporting obligation does not wait for the general date of application: under Article 71(2), Article 14 applies from 11 September 2026, Chapter IV from 11 June 2026, and the Regulation generally from 11 December 2027.
Read the full explanation
Article 14 gives a manufacturer 24 hours to send an early warning after becoming aware of an actively exploited vulnerability in its product, and 72 hours for the notification that follows. Twenty-four hours is not enough time to find out what your product contains. That part has to already be true.
Dates of application
- Chapter IV (Articles 35 to 51)
- Article 14 — reporting
- General application
Source: Article 71(2), second subparagraph of the Cyber Resilience Act.
Explore the CRA reference guide
The Regulation
What the Cyber Resilience Act is, and when it starts asking
Regulation (EU) 2024/2847 — the Cyber Resilience Act — entered into force on 10 December 2024. It is the first EU law to put binding cybersecurity obligations on the products themselves rather than on the organisations that run them, and it reaches almost anything with digital elements sold into the Union.
What it actually regulates
The CRA applies to products with digital elements — hardware or software whose intended purpose includes a direct or indirect data connection to a device or network. That is deliberately broad: connected industrial equipment, consumer devices, mobile and desktop applications, operating systems, and the libraries underneath them. Products already covered by sector-specific EU rules — medical devices, motor vehicles, civil aviation — are carved out and stay under those regimes.
Who carries the obligation
Primarily the manufacturer: whoever develops a product with digital elements and places it on the EU market under their own name or trademark. Importers and distributors carry their own duties, and a distributor who substantially modifies a product can become the manufacturer for CRA purposes. Selling from outside the EU does not avoid it — what matters is that the product is placed on the Union market.
Dates of application
The Regulation does not arrive all at once. Article 71(2) staggers it, and the reporting obligation lands well over a year before the rest.
Entered into force
Published in the Official Journal on 20 November 2024; in force twenty days later.
✓ In force
Chapter IV — Articles 35 to 51
The conformity assessment machinery: notification of bodies that will assess products.
✓ In force
Article 14 — reporting obligations
Manufacturers must report actively exploited vulnerabilities and severe incidents. This is the first obligation with a clock attached to it.
General application
The full regime: essential requirements, conformity assessment, CE marking. From this date a non-conforming product cannot lawfully be placed on the EU market.
The Article 14 clock
Once a manufacturer becomes aware of an actively exploited vulnerability in its product, the Regulation sets fixed windows. They are short by design, and they run on awareness — not on confirmation, not on a fix being ready.
24 hours
Early warning
To the CSIRT designated as coordinator and to ENISA, from becoming aware of the actively exploited vulnerability.
72 hours
Vulnerability notification
The substantive notification, including any corrective or mitigating measures available and, where applicable, how the product is affected.
14 days
Final report
After a corrective or mitigating measure becomes available: what happened and what was done.
A parallel track applies to severe incidents affecting the security of the product: 24-hour early warning, 72-hour incident notification, and a final report within one month. Twenty-four hours is not enough time to discover what your product contains — that has to already be true when the clock starts.
What you have to be able to show
Annex I sets the essential requirements. The vulnerability-handling half is the part that produces evidence someone can ask to see:
- An SBOM in a commonly used, machine-readable format, covering at least the top-level dependencies of the product.
- Identification and documentation of the vulnerabilities and components the product contains.
- Remediation without delay, including by providing security updates — free of charge, and distributed securely.
- Regular testing and review of the security of the product.
- A coordinated vulnerability disclosure policy, and a contact address for reporting.
- Public disclosure of information about fixed vulnerabilities once an update is available.
What non-compliance costs
Article 64 sets the ceilings. Member States set the actual penalties, and the higher of the two figures applies in each band.
- €15 million or 2.5% of worldwide annual turnover
- Breach of the essential cybersecurity requirements in Annex I, or of the Article 13 and 14 obligations.
- €10 million or 2% of worldwide annual turnover
- Breach of the other obligations the Regulation places on economic operators.
- €5 million or 1% of worldwide annual turnover
- Supplying incorrect, incomplete or misleading information to notified bodies or market surveillance authorities.
Source: Regulation (EU) 2024/2847, in particular Articles 13, 14, 64 and 71 and Annex I. This is a summary for orientation, not legal advice — KROMSE does not tell you whether the Regulation applies to your product.
Pricing
Start free. Grow at your pace.
Get your first product into view with a free workspace. Add capacity and support as your team grows.
Free
€0/ month
Evaluate KROMSE on one real product, with bounded usage.
- 1 product, 1 connected repository
- 2 scans per rolling 30 days
- Every finding in full, in plain English
- No AI usage on Free
- Scan artefacts kept for 7 days
Scan your product for free
No card required.
Basic
€49/ month
For a small team taking one or two products through the CRA.
- Up to 3 products
- Expanded scan and evidence capacity
- €10 of AI credit per month
- CRA Article 14 report drafting
Start free, upgrade later
Published price. Billing opens when the beta ends.
For growing teams
Pro
€249/ month
For teams with a portfolio of products and a real reporting clock.
- Up to 10 products
- €50 of AI credit per month
- Continuous monitoring and deadline tracking
- Full audit trail and evidence export
Start free, upgrade later
Published price. Billing opens when the beta ends.
Enterprise
Contact sales
Scope and pricing agreed for your product portfolio.
- Repository and SBOM scanning
- Findings, evidence and report drafts
- Capacity agreed for your workspace
- Compliance decisions reviewed by your team
Contact sales
Availability and service scope confirmed in a written proposal.
Prices are per workspace per month, excluding VAT. Paid plans open after beta; there is no checkout today. Start free, and KROMSE will show you when you reach a plan limit.
See the full plan comparisonTalk to us about Enterprise
Tell us what you make, how many products you have, and what your team needs. You can also contact info@kromse.com.
Scope and limits
Software does the groundwork. People make the call.
A compliance record is only worth having if it survives someone disagreeing with it. That means being precise about where the software stops and a person starts.
01Evidence, not certification
It does not certify you. No software can: CRA conformity is a manufacturer's declaration, and a scan is evidence toward it, not a substitute for it.
02Drafts, not automatic filing
It does not file your Article 14 report. KROMSE drafts the document and marks what it cannot know; a human reviews, completes and submits it.
03Uncertainty made explicit
It does not claim a vulnerable dependency is exploitable in your product. It tells you the component is present and says plainly what that does and does not establish.
04Missing facts stay visible
It does not invent the parts it has not been given. Missing information stays a marked blank, never a plausible-sounding guess.
05A clear framework scope
Scans provide product-security evidence. Separate NIS2 and EU AI Act readiness workspaces organize information for human review; they do not turn a scan result into a compliance determination.
Questions
A few things you might be wondering
Do I need a GitHub repository?
No. You can connect a GitHub repository or upload a CycloneDX or SPDX SBOM.
What does KROMSE read from my code?
The GitHub App is read-only and scoped to the repositories you select. KROMSE resolves the dependency tree at a specific commit; it does not write to your repository.
Is the free workspace time-limited?
No. It is limited by capacity — one product and two scans a month — not by a countdown. The product shows you your own live limits and usage.
Can I pay today?
Not yet. Billing is not switched on: no payment provider is connected and the API reports billing as disabled. The prices above are published so you can plan; if you need more capacity now, contact sales.
Does KROMSE make me CRA compliant?
It produces evidence and drafts records. Conformity remains the manufacturer's declaration, made by a person who reviews what the product assembled.
Which languages do you support?
This site is published in English, Spanish, French and German. The product interface is in English today, and findings are written in plain language rather than jargon.
Scan for free
Find out what your product actually contains
One repository or one SBOM, one exact commit, and findings written for the person who has to answer for them. Free, and no checkout in the way.
Create an account, then connect a repository or upload an SBOM.