crAcken
crAcken records what manufacturers of connected products knew, when they knew it and what they decided as a result.
In use
As an online application. You create the SBOM in your own infrastructure. What gets uploaded is the evidence, not your source code.
- Who it is for and what it is for
For manufacturers of products with digital elements, meaning embedded, industrial and connected devices. The task: being able to show what the manufacturer knew and when, and what it decided, when the Cyber Resilience Act (CRA) requires reports. The reporting obligations under Article 14 have applied since September 11, 2026.
- What it does
- Takes in the software bill of materials (SBOM) of every shipped release, as SPDX or CycloneDX from your pipeline.
- Matches vulnerability reports from OSV, GitHub Advisories, NVD, CISA KEV and EPSS to the shipped releases.
- Records when a finding was first detected in the product and opens a reporting case from it, with an internal review deadline.
- Prepares drafts for the early warning, the vulnerability notification and the final report, as PDF and JSON.
- An AI memo retrieves evidence, explains it and writes drafts.
- What stays with people
A named person states when and on what basis the manufacturer became aware, and decides whether to report. The AI may give recommendations but decides none of this. crAcken does not submit reports. A submission is documented, never assumed.
- What comes out
An evidence log: who knew what and when, what was decided and what was reported. Plus report drafts as PDF and JSON that a person who was not involved can also review.
- Where it runs
As an online application. You create the SBOM in your own infrastructure. What gets uploaded is the evidence, not your source code.
Connects to: Your build pipeline via SPDX and CycloneDX. Vulnerability data from OSV, GitHub Advisories, NVD, CISA KEV and EPSS.
- Example
The findings view of a release, grouped by component: the finding for log4j-core carries the label "Known to be exploited elsewhere" and shows the date of first detection in the product, along with CVE, source, EPSS probability and status.
A real view from the application, as shown on cracken.tech. No customer data.