We run structured penetration tests against devices, firmware, interfaces and cloud backends based on your CRA threat model. Findings are rated for exploitability and impact and mapped to CRA essential requirements, so you can update the risk analysis, prioritise fixes and reuse the reports in CE technical documentation.

We design and roll out a secure development lifecycle: threat modelling in design, security requirements per component, SAST/DAST/SCA in CI/CD and security sign-off criteria for releases. For industrial/OT products we align this with IEC 62443-4-1/-4-2 practices and prepare mappings that show how your controls satisfy CRA obligations over the full lifecycle.

We assess your organisation against NIS2 risk-management and governance requirements and your products against CRA obligations in a single engagement. Our vCISO / advisory team builds a consolidated gap analysis, RACI and roadmap, links CRA to existing frameworks (ISO 27001, IEC 62443, etc.) and maintains a portfolio-wide view of compliance status for management and boards.

We onboard your product infrastructure—APIs, portals, update servers, telemetry pipelines—into our SOC. Together we define CRA-relevant detection use cases, log retention and incident evidence. Alerts, cases and reports provide the post-market monitoring trail you need for CRA and NIS2 incident and vulnerability reporting.

We correlate threat feeds and CVE sources with your SBOMs and technology stack. Each hit is mapped to affected products and versions, risk-rated and handed over with a recommended action (patch, workaround, accept). This gives your PSIRT a concrete queue and supports CRA-compliant vulnerability handling and documentation.