SbomReady Cockpit · for makers of connected products
For devices, apps and the services behind them. Track every release, catch what's actually exploitable, and keep the paperwork ready before an auditor asks.
The free scan runs in memory: no account, nothing stored.
Any free scanner will tell you which known vulnerabilities your components have. The work starts after that: deciding which ones matter for your product, explaining why, and reporting in time when one is exploited. That's the part the Cockpit does with you.
A severity score is the same for every product in the world. Yours isn't. Tell us once what each part of your product does, and every new vulnerability arrives ranked by its impact on you — and by whether attackers are already using it.
When a vulnerability in your product is exploited, a case opens with every deadline — 24 hours, 72 hours, 14 days — and the report already drafted for your review.
Every obligation for your product, item by item: essential requirements, technical documentation, conformity assessment for its class, CE marking, support period, disclosure policy. Each shows who owns it, what backs it up and what's still missing — including what you'll do outside the Cockpit.
Article 14 drill
Run a drill on one of your own products: a fictitious exploited vulnerability, the legal deadlines on an accelerated clock, nothing sent to any authority. In about 15 minutes your team walks through the 24-hour early warning, the 72-hour notification and the notice to users.
3 points to fix before a real case: a backup person to report, the base text of the notice to users, a channel to reach users.
A snapshot today, or every release from now on
| Free scan | Cockpit | |
|---|---|---|
| What you get | One report for one SBOM, today | Every release of every product, watched continuously |
| New vulnerabilities after today | You find out when you scan again | An alert within 4 hours — email, Slack or webhook |
| Prioritization | Severity, exploit probability (EPSS), known exploitation (KEV) | The same, weighted by what each component does in your product |
| Decisions | — | Who decided, when and why — exported as OpenVEX and CSAF |
| Article 14 | Flags vulnerabilities known to be exploited | A case file with every deadline and the report fields drafted |
| Article 14 drill | — | Rehearse the 24- and 72-hour reports on your own product, and get a list of what's missing |
| Account | None | Free plan: 2 products, no card |
Upload it, or post it from your pipeline. Check a release candidate before it ships, too.
Public advisories and the CISA and EU catalogs of exploited vulnerabilities, checked continuously.
Network, authentication, updates, payments: a vulnerability inherits the risk of the part of your product it sits in.
VEX statements, user advisories and Article 14 reports arrive as drafts. A person on your team approves every one.
We propose functional zones from your SBOM; you confirm them once. A severity floor keeps critical vulnerabilities out of the low-priority pile, always.
Deadlines run from the moment you're aware. The fields for ENISA's reporting platform come drafted, in English, ready to paste.
Every status comes with a plain-language reason, who set it and when. A "not affected" carries over to the next release instead of resurfacing.
In the app and by email, always. Slack, or a signed webhook into PagerDuty, Jira or your own tooling.
Export it all, any time, in open formats: SPDX, CycloneDX, OpenVEX, CSAF. Your compliance history never depends on us.
The checklist tracks what the Cockpit covers and what stays with you — conformity assessment, CE marking, technical documentation.
SbomReady Cockpit helps you detect, prioritize and document vulnerabilities across your product versions, and prepares the Article 14 notification paperwork when one turns out to be actively exploited. Its compliance checklist maps everything the CRA asks of you, including what stays outside SbomReady Cockpit, such as conformity assessment, the EU declaration and CE marking, so you can see in one place what you have and what's missing. It keeps count: it doesn't assess conformity, doesn't replace a notified body or secure-by-design engineering, and doesn't generate your full Annex VII technical documentation.
Every plan has the full regulatory feature set: detection, triage, Article 14, documentation. Plans differ in volume and integrations. Paid plans are never blocked mid-month — extra units are billed.
One simple product: a device or an app, plus its backend.
For an early team validating SbomReady Cockpit on a first product.
For teams shipping several products or frequent releases.
Several organizations under one subscription, shared limits, one invoice.
Multiple organizations/brands under one account, SSO, and a dedicated compliance contact.
Prices exclude VAT. Compare plans in detail →
No. It covers vulnerability handling and Article 14 readiness, and its checklist tracks everything else. Conformity assessment, CE marking and your technical documentation are still yours — you just see in one place what's done and what's missing.
If your build can export an SPDX or CycloneDX SBOM, yes. How well vulnerabilities match depends on the identifiers in that SBOM; the upload report shows which components we couldn't identify, so there are no blind spots you don't know about.
Mark it "not affected" once, with the reason; the decision follows that component into later releases. We don't yet check whether a vulnerable code path was actually compiled in — and we'd rather say so.
It's a draft until a person on your team confirms it. Nothing is ever sent to a regulator automatically.
Export everything, any time, in open formats. We're an early-stage company and don't offer an enterprise SLA yet; what we do guarantee is that your history is never something only we can produce.
SbomReady is built by Movilok. Payments go through our reseller, who issues the invoice and handles EU VAT.
Two minutes. Nothing to install, nothing stored.