Product security for what you shipped
Living inventory, continuous monitoring, triage, and Article 14 evidence, the CRA spine for manufacturers of products with digital elements.
The object of assessment is the shipped product
September 2026 is a report to CSIRT/ENISA when something is actively exploited in a product already on the market. You cannot report what you cannot find. Spreadsheets and one-off scans are not enough.
alloy-it runs the living workflow: inventory → scan → triage → awareness → evidence, then a rebuild path when you must patch for years. It is not CE-marking software and does not submit to ENISA.
Security capabilities
Product inventory
Products and releases as the CRA unit of record. Upload vendor CycloneDX/SPDX per version you placed on the market.
Firmware-derived SBOM
On-demand analyze of the binary. Compare vendor vs derived inventories, trust but verify. Never auto-opens firmware.
Continuous rescan & alerts
Scheduled rescans against vulnerability intelligence. New high/critical findings go to the PSIRT inbox, not to customers.
Component-level triage
Decide affected / not affected with justification and history. Assessor-ready decisions, not a 5,000-row dump.
Article 14 readiness
KEV/EUVD overlay, awareness timestamp, and copy-JSON SRP payload. Alloy does not submit to ENISA.
Evidence packs
SBOM(s), findings, triage decisions, and awareness history per release for technical documentation.
Build-environment scanning (reproduce leg)
Toolchain and blueprint CVE scanning sits under the reproduce capability: useful for technical docs and for reconstructing the environment that built an affected release. It is not the September 2026 Article 14 lead.
Read about build-environment SBOMs →Preparing for the EU Cyber Resilience Act?
Our CRA hub covers deadlines, product SBOM rules, Article 14 reporting, and a manufacturer checklist, with honest scope on what alloy-it does and does not do.
Explore the CRA compliance hubRun this on what you shipped
Start free with a product inventory, or book a CRA walkthrough.