Every tool here started as a method we applied by hand in an engagement, then productised so that a product team can use it without a security specialist in the room: find the CRA category of a product, evaluate a portfolio against the requirements, derive security requirements from a risk assessment, produce the RED documentation, write, analyse and score a vulnerability disclosure policy. Several are free. The others are the platforms we deploy with clients.
Cyber Resilience Act
CRAted for CRA compliance
See where every product in your portfolio stands against the CRA requirements, in less than an hour, with no SBOM, no source code and no security expertise. For product and compliance teams, from one product to a whole catalogue.
- Web app
- Free 14-day trial
- Product and compliance teams
CRAscoping
Describe your product and get its CRA category, the harmonised standards that apply and the assessment route, in seconds. For anyone who has to answer “is this in scope?” before the engineers are involved.
- Web app
- Free
- Product managers, compliance, sales
Product security
FAST
Threat modelling and risk assessment of your product in minutes, to identify the relevant cyber security requirements. For development teams who know their product and are not security specialists.
- Web app
- Free demo
- Development teams
Auto VDP
Generate your vulnerability disclosure policy, ready to paste on your website, or check the one you have for the mandatory information. For whoever owns the website or the legal pages.
- Web app
- Free
- Product, legal and web teams
VDP scoring
Score how easily a researcher can find and use your vulnerability disclosure policy, against the criteria of our accessibility study. For product security owners checking their own brand, or a competitor’s.
- On this page
- Free
- Product security owners
ProSecCo, the product security maturity model
Measure the security maturity of your product and your team. Compare it with the level your market requires and get the improvements in order. For product security leads and CTOs.
- Web app
- Free
- Product security leads, CTOs
RED cyber
RED scoping
Find out whether RED cyber applies to your product, and under which articles. For product managers and compliance, before any testing is bought.
- On this page
- Free
- Product managers, compliance
RED self-assessment
Find out whether you can self-assess your product under RED cyber or need a notified body, and what that depends on. For compliance and certification managers planning the route to market.
- On this page
- Free
- Compliance, certification
Pre-compliance template
An Excel workbook that scores your product against EN 18031, shows the gaps and ranks what to fix first. For the engineer or compliance manager preparing the first assessment.
- Excel
- Free
- Engineers, compliance
REDact, compliance REDefined
The toolkit for a RED cyber file, with automated templates for scope, risk assessment, EN 18031 decision trees and E.Info. For the team writing the technical documentation.
- Toolkit, download
- Free
- Engineers, compliance
ICS2IXIT
Turn your EN 303 645 ICS into the TS 103 701 IXIT list, and reuse that work for your RED cyber self-assessment. For test and compliance engineers who already have an EN 303 645 assessment.
- Web app
- Free, no commercial use
- Test and compliance engineers
CRAted for CRA compliance
See where every product in your portfolio stands against the CRA requirements, in less than an hour, with no SBOM, no source code and no security expertise. For product and compliance teams, from one product to a whole catalogue.
- Web app
- Free 14-day trial
- Product and compliance teams
CRAscoping
Describe your product and get its CRA category, the harmonised standards that apply and the assessment route, in seconds. For anyone who has to answer “is this in scope?” before the engineers are involved.
- Web app
- Free
- Product managers, compliance, sales
FAST
Threat modelling and risk assessment of your product in minutes, to identify the relevant cyber security requirements. For development teams who know their product and are not security specialists.
- Web app
- Free demo
- Development teams
Auto VDP
Generate your vulnerability disclosure policy, ready to paste on your website, or check the one you have for the mandatory information. For whoever owns the website or the legal pages.
- Web app
- Free
- Product, legal and web teams
VDP scoring
Score how easily a researcher can find and use your vulnerability disclosure policy, against the criteria of our accessibility study. For product security owners checking their own brand, or a competitor’s.
- On this page
- Free
- Product security owners
ProSecCo, the product security maturity model
Measure the security maturity of your product and your team. Compare it with the level your market requires and get the improvements in order. For product security leads and CTOs.
- Web app
- Free
- Product security leads, CTOs
RED scoping
Find out whether RED cyber applies to your product, and under which articles. For product managers and compliance, before any testing is bought.
- On this page
- Free
- Product managers, compliance
RED self-assessment
Find out whether you can self-assess your product under RED cyber or need a notified body, and what that depends on. For compliance and certification managers planning the route to market.
- On this page
- Free
- Compliance, certification
Pre-compliance template
An Excel workbook that scores your product against EN 18031, shows the gaps and ranks what to fix first. For the engineer or compliance manager preparing the first assessment.
- Excel
- Free
- Engineers, compliance
REDact, compliance REDefined
The toolkit for a RED cyber file, with automated templates for scope, risk assessment, EN 18031 decision trees and E.Info. For the team writing the technical documentation.
- Toolkit, download
- Free
- Engineers, compliance
ICS2IXIT
Turn your EN 303 645 ICS into the TS 103 701 IXIT list, and reuse that work for your RED cyber self-assessment. For test and compliance engineers who already have an EN 303 645 assessment.
- Web app
- Free, no commercial use
- Test and compliance engineers