Supported product inputs
Connect a repository, upload a Linux-based firmware image, or send an SBOM. One view of what your product contains and what is vulnerable in it.
VULNERABILITY DETECTION FOR SOFTWARE AND FIRMWARE · BUILT AND HOSTED IN THE EU
Find vulnerabilities in
everything you ship.
KROMSE checks supported software and firmware components for known vulnerabilities and records the evidence and coverage limits. Paid plans add scheduled OSV checks of supported SBOM components. AI-assisted review is subject to your plan’s usage allowance.
No card required.
Repository / SBOM → Findings → Evidence
01 / PRODUCT CYBERSECURITY CHECKILLUSTRATIVE VISUALIZATION
FROM CYBERSECURITY CHECK TO NEXT STEP
Start with what you ship.
Connect a repository at a specific commit with read-only access, or upload an SBOM. Every finding needs a source you can trace.
Watch a sample scan sample-productIllustrative scan
1,284components found
package-lock.jsonproduct.cdx.json Source pinned to commit a3f9c21
A scan, start to finish
See what your product contains.
KROMSE identifies components and checks them against vulnerability advisories. Follow the path from the source file to the affected version.
- Source
- Components
- Findings
- Human review
Illustrative scan
kromse — scan
commit a3f9c21
- Connecting repository — read-only
- Pinning commit a3f9c21
- Resolving dependency tree
- Generating SBOM (CycloneDX)
- Matching against vulnerability data
- Writing findings in plain English
- Awaiting your product impact review
1284components resolved
Traceable evidence
Human review required
Findings
- Known exploitedlibwebp 1.2.4CVE-2023-4863
Attackers are exploiting this vulnerability elsewhere — confirmed exploitation somewhere in the world, not evidence of anything in your product. Your build includes the affected version.
- Highopenssl 3.0.8CVE-2023-0464
A vulnerable version is present in this example. Reachability has not been established for this finding. Review the evidence and your product's exposure before deciding its impact.
- Mediumexpress 4.17.1CVE-2024-29041
An update is available. No exploitation is recorded in this example.
Article 14 draft after your confirmation
Fields KROMSE cannot know are left as marked blanks for a human to complete — never guessed.
Illustrative sequence. KROMSE reads the repository read-only, pins one exact commit, and never writes to it.
Read-only accessExact commit
An illustrative workflow, with example findings rather than results from your product. Scan duration depends on the input and coverage; response cases and report drafts require your team's decisions.
What you get
Less deciphering. More understanding.
KROMSESample productIllustrative exampleA clear view of what needs attention
3findings to review
Known exploited
What this means
Attackers are exploiting this vulnerability elsewhere — confirmed exploitation somewhere in the world, not evidence of anything in your product. Your build includes the affected version.
Answers, not alerts
Findings include plain-English explanations. Within your usage allowance, AI reviews priority findings: are they likely to affect you, what to upgrade, and what it cannot know. Your team makes the final call.
Start free, on your own
Your first scan is free and needs no sales call. Basic is €59 monthly or €49 per month billed €588 annually, excluding VAT. Hosted in the EU.
Selling in the EU? The same scan prepares your Cyber Resilience Act evidence for human review.
How it works
Three steps to your first scan
- 01
Create your account
A workspace for your products, findings and evidence.
Read the full explanation
Create a workspace for your products, scan evidence and findings. Your team decides which findings need a response case after reviewing their impact.
- 02
Connect GitHub, or upload an SBOM
Choose a repository for read-only access, or upload a CycloneDX or SPDX SBOM.
Read the full explanation
The KROMSE GitHub App is read-only, and you choose which repository it may see. No repository to hand? Upload a CycloneDX or SPDX SBOM instead: components with supported identifiers are checked against OSV. Components without those identifiers are not checked. An SBOM carries no source code, so the secret, code and infrastructure checks of a repository scan do not run on it.
- 03
Read what your product contains
Review the findings, verify their impact and decide what happens next.
Read the full explanation
KROMSE checks components found at the scanned commit, or listed in your uploaded SBOM, against supported advisory sources. It records findings and coverage limits for your team to review before responding.
02 / FOLLOW THE EVIDENCE
The scan is only the beginning.
Record your team’s determination and supporting evidence. Use them in an internal CRA report draft, with missing information visible and human review still required.
Open your workspaceEvidence recordedHuman review required
ILLUSTRATIVE VISUALIZATION
What a scan gives you
A finding you can read without a security background
KROMSE organizes findings into five parts, giving your team a starting point for assessing product impact.
Uncertainty is written down, not rounded off
“Attackers are exploiting this vulnerability elsewhere — that means confirmed exploitation somewhere in the world, not evidence of anything in your product.”
Known exploitation elsewhere does not establish exploitation in your product. KROMSE keeps that distinction explicit.
Read the full explanation
Matching a component to an advisory does not by itself prove that your product is exploitable. KROMSE shows reachability only when a supported analysis engine produced evidence for that scan. Otherwise it remains unverified. Your team reviews the product impact.
And then: what to do about it
After your team confirms that a finding affects a product you place on the EU market, KROMSE can open a response case and record your decision. You choose when to prepare an internal Article 14 draft. Missing facts stay marked for human review, and tracked dates are an operational aid, not a legal determination.
Why now
Article 14 arrives before the rest of the Regulation
The Cyber Resilience Act applies to products with digital elements placed on the EU market. Its reporting obligation does not wait for the general date of application: under Article 71(2), Article 14 applies from 11 September 2026, Chapter IV from 11 June 2026, and the Regulation generally from 11 December 2027.
Read the full explanation
Article 14 gives a manufacturer 24 hours to send an early warning after becoming aware of an actively exploited vulnerability in its product, and 72 hours for the notification that follows. Twenty-four hours is not enough time to find out what your product contains. That part has to already be true.
Dates of application
- Chapter IV (Articles 35 to 51)
- Article 14 — reporting
- General application
Source: Article 71(2), second subparagraph of the Cyber Resilience Act.
Explore the CRA reference guide
The Regulation
What the Cyber Resilience Act is, and when it starts asking
Regulation (EU) 2024/2847 — the Cyber Resilience Act — entered into force on 10 December 2024. It is the first EU law to put binding cybersecurity obligations on the products themselves rather than on the organisations that run them, and it reaches almost anything with digital elements sold into the Union.
What it actually regulates
The CRA applies to products with digital elements — hardware or software whose intended purpose includes a direct or indirect data connection to a device or network. That is deliberately broad: connected industrial equipment, consumer devices, mobile and desktop applications, operating systems, and the libraries underneath them. Products already covered by sector-specific EU rules — medical devices, motor vehicles, civil aviation — are carved out and stay under those regimes.
Who carries the obligation
Primarily the manufacturer: whoever develops a product with digital elements and places it on the EU market under their own name or trademark. Importers and distributors carry their own duties, and a distributor who substantially modifies a product can become the manufacturer for CRA purposes. Selling from outside the EU does not avoid it — what matters is that the product is placed on the Union market.
Dates of application
The Regulation does not arrive all at once. Article 71(2) staggers it, and the reporting obligation lands well over a year before the rest.
Entered into force
Published in the Official Journal on 20 November 2024; in force twenty days later.
✓ In force
Chapter IV — Articles 35 to 51
The conformity assessment machinery: notification of bodies that will assess products.
✓ In force
Article 14 — reporting obligations
Manufacturers must report actively exploited vulnerabilities and severe incidents. This is the first obligation with a clock attached to it.
General application
The full regime: essential requirements, conformity assessment, CE marking. From this date a non-conforming product cannot lawfully be placed on the EU market.
The Article 14 clock
Once a manufacturer becomes aware of an actively exploited vulnerability in its product, the Regulation sets fixed windows. They are short by design, and they run on awareness — not on confirmation, not on a fix being ready.
24 hours
Early warning
To the CSIRT designated as coordinator and to ENISA, from becoming aware of the actively exploited vulnerability.
72 hours
Vulnerability notification
The substantive notification, including any corrective or mitigating measures available and, where applicable, how the product is affected.
14 days
Final report
After a corrective or mitigating measure becomes available: what happened and what was done.
A parallel track applies to severe incidents affecting the security of the product: 24-hour early warning, 72-hour incident notification, and a final report within one month. Twenty-four hours is not enough time to discover what your product contains — that has to already be true when the clock starts.
What you have to be able to show
Annex I sets the essential requirements. The vulnerability-handling half is the part that produces evidence someone can ask to see:
- An SBOM in a commonly used, machine-readable format, covering at least the top-level dependencies of the product.
- Identification and documentation of the vulnerabilities and components the product contains.
- Remediation without delay, including by providing security updates — free of charge, and distributed securely.
- Regular testing and review of the security of the product.
- A coordinated vulnerability disclosure policy, and a contact address for reporting.
- Public disclosure of information about fixed vulnerabilities once an update is available.
What non-compliance costs
Article 64 sets the ceilings. Member States set the actual penalties, and the higher of the two figures applies in each band.
- €15 million or 2.5% of worldwide annual turnover
- Breach of the essential cybersecurity requirements in Annex I, or of the Article 13 and 14 obligations.
- €10 million or 2% of worldwide annual turnover
- Breach of the other obligations the Regulation places on economic operators.
- €5 million or 1% of worldwide annual turnover
- Supplying incorrect, incomplete or misleading information to notified bodies or market surveillance authorities.
Source: Regulation (EU) 2024/2847, in particular Articles 13, 14, 64 and 71 and Annex I. This is a summary for orientation, not legal advice — KROMSE does not tell you whether the Regulation applies to your product.
Pricing
Start free. Grow at your pace.
Get your first product into view with a free workspace. Add capacity and support as your team grows.
Free
€0/ month
Evaluate KROMSE on one real product, with bounded usage.
- 1 product, 1 connected repository
- 2 scans per rolling 30 days
- Every finding in full, in plain English
- AI verdicts on priority findings, within your usage allowance
- Scan artefacts kept for 7 days
Scan your product for free
No card required.
Basic
€49/ month
Excluding VAT
€588 billed annually
Save €120/year
7-day trial for eligible new subscriptions. Card required. Cancel before the trial ends and pay nothing; otherwise the full annual amount is charged when it ends.
For a small team taking one or two products through the CRA.
- AI assistant and recommended actions, within your usage allowance
- Up to 3 products
- Expanded scan and evidence capacity
- AI usage included
- CRA Article 14 report drafting
Start free, upgrade later
Choose an available billing option in Subscription & credits.
For growing teams
Pro
€249/ month
Excluding VAT
€2,988 billed annually
Save €600/year
7-day trial for eligible new subscriptions. Card required. Cancel before the trial ends and pay nothing; otherwise the full annual amount is charged when it ends.
For teams reviewing security evidence across a portfolio of products.
- Up to 10 products
- 5× usage
- Scheduled OSV checks of supported SBOM components
- Full audit trail and evidence export
Start free, upgrade later
Choose an available billing option in Subscription & credits.
Enterprise
Contact sales
Scope and pricing agreed for your product portfolio.
- Repository and SBOM scanning
- Findings, evidence and report drafts
- 10×+ usage
- Compliance decisions reviewed by your team
- Any git host or CI-pushed SBOM
Contact sales
Availability and service scope confirmed in a written proposal.
Published prices per workspace in EUR, excluding VAT. For professional use, including freelancers. Available purchase options appear in Subscription & credits. Creating a workspace does not start a paid subscription.
Cancel renewal at any time and keep access until the paid term ends. Current-term fees are non-refundable except where required by law.
Usage multipliers refer to AI usage compared with Basic: 5× for Pro and 10×+ for Enterprise, with Enterprise capacity agreed for your team. Included usage renews monthly, including on annual plans.
Talk to us about Enterprise
Tell us what you make, how many products you have, and what your team needs. You can also contact info@kromse.com.
Scope and limits
Software does the groundwork. People make the call.
A compliance record is only worth having if it survives someone disagreeing with it. That means being precise about where the software stops and a person starts.
01Evidence, not certification
It does not certify you. No software can: CRA conformity is a manufacturer's declaration, and a scan is evidence toward it, not a substitute for it.
02Drafts, not automatic filing
It does not file your Article 14 report. KROMSE drafts the document and marks what it cannot know; a human reviews, completes and submits it.
03Uncertainty made explicit
It does not claim a vulnerable dependency is exploitable in your product. It tells you the component is present and says plainly what that does and does not establish.
04Missing facts stay visible
It does not invent the parts it has not been given. Missing information stays a marked blank, never a plausible-sounding guess.
05A clear framework scope
Scans provide product-security evidence. Separate NIS2 and EU AI Act readiness workspaces organize information for human review; they do not turn a scan result into a compliance determination.
Questions
A few things you might be wondering
Do I need a GitHub repository?
No. You can connect a GitHub repository or upload a CycloneDX or SPDX SBOM.
Do I need GitHub?
No. GitHub, GitLab, Bitbucket, Azure DevOps or any HTTPS git server works with a read-only access token. And any build pipeline can push the SBOM of every release with an API token, without giving KROMSE access to your code at all.
What does KROMSE read from my code?
The GitHub App is read-only and scoped to the repositories you select. KROMSE resolves the dependency tree at a specific commit; it does not write to your repository.
Is the free workspace time-limited?
No. It is limited by capacity — one product and two scans a month — not by a countdown. The product shows you your own live limits and usage.
How do I choose a paid plan?
Workspace owners and administrators can open Plan & Usage to see available subscriptions and extra AI allowance purchases. Stripe shows the final price and applicable tax before you confirm payment. For Enterprise, contact sales.
Does KROMSE make me CRA compliant?
It produces evidence and drafts records. Conformity remains the manufacturer's declaration, made by a person who reviews what the product assembled.
Which languages do you support?
KROMSE supports English and Spanish (Spain). Choose your language in Settings → Language. Original evidence, earlier messages and documents retain their original language.
Scan for free
Find out what your product actually contains
One repository or one SBOM, one exact commit, and findings written for the person who has to answer for them. Free, and no checkout in the way.
Create an account, then connect a repository or upload an SBOM.
Build a tool KROMSE should connect with? Become a technology partner.