CRA compliant, developer approved.
developers with findings that don't matter and starts focusing on the ones that do.
.gif)
How Endor Labs reduces your CRA burden
.webp)
FAQs
Not quite, and the distinction matters enormously for your team's workload. The CRA requires manufacturers to identify and remediate exploitable vulnerabilities, not every CVE in your dependency tree. A vulnerability in a function your code never calls is not exploitable in your application. Endor Labs' function-level reachability analysis identifies which vulnerable functions are actually reachable, so your team focuses on vulnerabilities that pose genuine risk and can document the rest as non-exploitable using VEX.
The EU Cyber Resilience Act (Regulation 2024/2847) establishes mandatory cybersecurity requirements for all products with digital elements sold in the EU market. Reporting obligations begin September 11, 2026. Full compliance and enforcement begins December 11, 2027. The three core obligations are:
- Secure by design (products must ship without known exploitable vulnerabilities)
- Vulnerability management (manufacturers must identify, document, and remediate vulnerabilities without delay for a minimum support period of five years)
- Transparency and reporting (manufacturers must notify ENISA within 24 hours of discovering an actively exploited vulnerability and maintain an SBOM for every product).
The CRA mandates SBOMs in a machine-readable format (CycloneDX or SPDX are the safe choices), maintained throughout the product lifecycle and available to customers and regulators. Endor Labs generates complete SBOMs in both formats with every scan, integrated directly into your CI/CD pipeline. SBOM Hub provides centralized management across all your products, with automated updates every time a new build ships. VEX annotations accompany every SBOM, documenting which discovered vulnerabilities are not exploitable in your specific application.
The biggest driver of missed remediation timelines is spending time on vulnerabilities that don’t need to be fixed. By reducing your actionable findings by an average of 92%, Endor Labs gives your team more time to focus on what's real and urgent. For the fixes that remain, Upgrade Impact Analysis predicts whether an upgrade will introduce breaking changes before your team commits. When a full upgrade cannot be completed within the required window, Endor Patches provide backported security fixes that keep you compliant while the larger work continues.
Yes. The CRA applies to any manufacturer selling products into the EU market, regardless of where they’re headquartered. If you sell into the EU directly or through distributors, you are in scope. You can designate an EU-based authorized representative to handle communications with authorities, but the core compliance obligations around secure design, vulnerability management, and SBOM maintenance remain yours. EU distributors and importers carry their own obligations too, and will increasingly demand compliance evidence from their supply chain.
