EU Cyber Resilience Act — December 2027 Deadline

xZETA starts with CRA compliance.
It doesn't stop there.

From automated CRA compliance to full supply chain risk management — 189% more vulnerability coverage than NVD, built-in threat intelligence, and integrations that fit directly into your PLM and CI/CD workflows. All from day one.

Book Your 30-Minute Assessment →
Scroll

"xZETA… helped us achieve compliance on time, even without prior compliance experience."

Koji Kanazawa  ·  Connected Business Division, JRC Mobility
The Real Risk

Every product you ship extends the compliance obligation you're already carrying.

Every new release brings new components, new suppliers, and new vulnerabilities to track. The products you shipped last year are still in the field, still accumulating CVE disclosures, still subject to CRA's continuous monitoring requirement.

Each product has its own supply chain. Each supply chain has its own exposure. A manual process that works for three products collapses under thirty.

The question isn't whether to comply. It's whether your team can manage a growing obligation without it becoming the bottleneck that slows everything else down.

Non-compliance carries penalties of up to €15 million or 2.5% of global annual turnover — and the loss of EU market access entirely. Full obligations apply by December 2027.
xZETA

From CRA compliance to supply chain risk intelligence — one platform.

xZETA helps automate core CRA processes, giving product teams deeper vulnerability coverage, threat detection, and workflow integration beyond standard compliance tools.

⛔  Others: CRA compliance only
── xZETA Platform ──
← xZETA goes further
Supply Chain
Risk Management
  • SBOM · HBOM · CBOM
  • PLM Integration
  • CI/CD Pipeline
  • Country-of-origin Detection
  • PSIRT Workflow Integration
←
Where most tools stop
CRA
Compliance
→
xZETA goes further →
Continuous Threat
Intelligence
  • 189% Beyond National Vulnerability Database (NVD)
  • Zero-Day Detection
  • Undisclosed Vulnerabilities
  • Daily Automated Rescans
  • Exploit Path Mapping

xZETA makes CRA compliance the byproduct of a supply chain risk program you already need — one platform, built for both.

How xZETA Handles CRA

Supply chain risk, managed continuously.
CRA compliance, handled automatically.

CRA Annex I — SBOM Management
Maintain accurate component inventories across every shipped product
xZETA →

Automates SBOM generation for open-source and third-party components — maintained continuously, not archived at release. Full supplier traceability and component provenance included. Country-of-origin detection also identifies components tied to countries of concern, supporting compliance with US Connected Vehicle Regulations (15 CFR Part 791 Subpart D).

CRA Annex I — Vulnerability Handling
Identify, assess, and document vulnerabilities throughout the product lifecycle
xZETA →

Daily rescans across all shipped products. VVIR* prioritization reduces actionable volume to 10% of CVEs — with assessment rationale auto-documented for every decision, including vulnerabilities reviewed and deprioritized.

*VVIR: VicOne Vulnerability Impact Rating (Patent Pending)

CRA Article 14 — 24-Hour ENISA Reporting
Report actively exploited vulnerabilities within 24 hours of discovery
xZETA →

Built-in threat intelligence with industry-leading coverage of undisclosed and zero-day vulnerabilities automatically flags actively exploited weaknesses — with attack path insights and exploit scripts to support impact analysis before the reporting window opens.

CRA Annex I — Supply Chain Security
Document security controls across third-party components and suppliers
xZETA →

PSIRT ticketing integration connects vulnerability detection to internal response workflows. API integration with your PLM, TARA, and CI/CD systems keeps supply chain risk visibility in sync across your entire development lifecycle.

xZETA is built to support CRA requirements in one platform. You don't build a compliance program on top of xZETA — xZETA makes compliance the output of a supply chain risk program you already needed.
Customer Success

Trusted by product manufacturers
facing exactly this problem.

70–80%
reduction in compliance workload

"With the CRA deadline looming, we were overwhelmed by thousands of vulnerabilities. xZETA automated SBOM generation and prioritized real risks with automotive threat intelligence, helping us achieve compliance on time — even without prior compliance experience."

Koji Kanazawa Connected Business Division, JRC Mobility

"The xZETA system delivers almost immediate results — accelerating our product development efficiency. In a recent case, we went from vulnerability scan to patch deployment in just two weeks, down from a previous six-month time frame."

YC Chang Senior Director, Askey Automotive Product Unit

"VicOne xZETA swiftly addresses unknown cybersecurity vulnerabilities, enhancing our proactive management and product security."

Jason Hsu Vice President, Primax Connected Mobility Business Unit
Why xZETA

Not just another compliance tool.

Most tools stop at CRA. xZETA starts there — and extends into the supply chain risk management capability your product teams need long after the deadline.

Standard SCA tool Point compliance tool xZETA VicOne
CRA compliance
SBOM generation & management Dev only ✓ ✓
Continuous monitoring of shipped products Post-release, not just pre-release ✗ ✗ ✓
Audit documentation auto-generation ✗ ✓ ✓
24-hour ENISA reporting support ✗ ✗ ✓
Vulnerability intelligence
National Vulnerability Database (NVD) coverage ✓ ✓ ✓
Coverage beyond NVD 189% more than NVD alone ✗ ✗ ✓
Zero-day & undisclosed vulnerability detection ✗ ✗ ✓
Built-in threat intelligence ✗ ✗ ✓
Supply chain risk management
Custom PLM / CI/CD / PSIRT workflow integration Partial Partial ✓
Multi-product catalog risk tracking Scales across your entire product line ✗ ✗ ✓
Country-of-origin Detection Supporting compliance with US Connected Vehicle Regulations (15 CFR Part 791 Subpart D) ✗ ✗ ✓
30-Minute Assessment

See your actual supply chain exposure.
In 30 minutes.

We run xZETA against your firmware or SBOM — live, not a demo.
You see which components carry vulnerabilities outside NVD and which trigger CRA's 24-hour reporting window.
You leave with a prioritization report. Not a sales deck.
Book Your 30-Minute Assessment →
FAQ

Frequently Asked Questions

The EU Cyber Resilience Act entered into force in December 2024. It requires manufacturers of products with digital elements — including IoT devices, industrial equipment, EV chargers, agricultural machinery, and off-highway systems — to meet mandatory cybersecurity requirements throughout the product lifecycle. These include SBOM documentation, continuous vulnerability management, security update distribution, and incident reporting to ENISA. Full compliance obligations apply to all in-scope manufacturers by December 2027.
CRA applies to any manufacturer placing a hardware or software product with network or device connectivity on the EU market. This includes IoT devices, industrial control systems, EV chargers, consumer electronics, agricultural machinery, non-road mobile machinery (NRMM), and off-highway equipment. It is not limited to automotive or critical infrastructure. For some product categories — such as radio-connected devices — CRA obligations apply alongside existing directives such as the Radio Equipment Directive (RED).
xZETA automates the workflows that consume engineering time in manual compliance programs: SBOM extraction, vulnerability scanning against shipped firmware, exploitability prioritization, and documentation generation. When a new CVE is disclosed, xZETA cross-references it against your full product catalog automatically — surfacing which shipped products are affected and generating the audit documentation CRA requires, without requiring engineering intervention for each disclosure event.
Software composition analysis tools identify vulnerabilities during the development lifecycle. CRA requires manufacturers to monitor, assess, and document vulnerability response across the entire supported lifetime of every shipped product — including products already in the field when new CVEs are disclosed. Most SCA platforms do not continuously rescan shipped products, do not carry threat intelligence beyond the National Vulnerability Database, and do not generate the audit documentation CRA's technical file requirements demand.
CRA requires manufacturers to notify ENISA within 24 hours of identifying an actively exploited vulnerability. xZETA's threat intelligence extends beyond the National Vulnerability Database by 189%, including zero-day detection — surfacing exploitation activity before it propagates to public CVE feeds. When an actively exploited vulnerability is identified, xZETA flags affected products in your catalog, maps the exploit path, and generates the documentation CRA's 24-hour ENISA reporting requirement demands.
The obligations xZETA addresses — continuous SBOM management, post-production vulnerability monitoring, supply chain security, and lifecycle documentation — are the same structural requirements CRA places on all product manufacturers. JRC Mobility, a leading ETC device manufacturer for construction and agricultural machinery, used xZETA to achieve compliance with no prior compliance experience — meeting a hard regulatory deadline with an estimated 70–80% reduction in workload compared to manual processes.