Vulnerability handling for the EU Cyber Resilience Act
Track every component and vulnerability in your products, match new advisories to them, and prepare the 24-hour, 72-hour and final reports the CRA requires, with DefectDojo Pro and the PSIRT Advisory Engine.
Which tools help software makers meet EU Cyber Resilience Act vulnerability handling rules?
Meeting the CRA's vulnerability handling rules takes three kinds of tooling. You need SBOM and scanning tools such as Syft, Trivy, OSV-Scanner or OWASP Dependency-Track, a system that tracks every vulnerability in your products to a fix, and a way to publish advisories and prepare the Article 14 reports. DefectDojo Pro covers the second and third. It imports SBOMs and findings from 500+ tools, matches new advisories to your components with the PSIRT Advisory Engine, exports SBOMs and VEX per release, and builds the report package for each Article 14 deadline.
Reporting obligations for actively exploited vulnerabilities and severe incidents have applied since September 11, 2026. The rest of the regulation applies from December 11, 2027.
| CRA Annex I Part II requirement | How DefectDojo Pro supports it |
|---|---|
| Identify and document vulnerabilities and components, including an SBOM | Imports CycloneDX and SPDX SBOMs and exports each product's inventory per release as CycloneDX 1.6 or SPDX 2.3. Findings arrive from 500+ scanners |
| Remediate vulnerabilities without delay | Prioritization with EPSS and CISA KEV, remediation SLAs, ticket routing and Sensei fix pull requests |
| Apply regular security tests and reviews | Results from every SAST, SCA, DAST, container and pentest tool kept in one history per product |
| Disclose fixed vulnerabilities | Write, review and publish security advisories with approvals tied to the exact content, and export triage decisions as CycloneDX VEX |
| Coordinated vulnerability disclosure | Reported and matched vulnerabilities are grouped into cases with SLA triage clocks. Your disclosure policy and contact address stay yours to publish |
| Report actively exploited vulnerabilities (Article 14) | Tracks the 24-hour, 72-hour and final report deadlines, builds each stage's package as JSON, Markdown or PDF, and records when you became aware and when you submitted. A person submits to ENISA's Single Reporting Platform |
The PSIRT Advisory Engine is a separately licensed add-on to DefectDojo Pro. Article 14 reporting and CRA evidence packs are in beta. DefectDojo does not decide whether the CRA applies to your product and does not submit reports for you.
The PSIRT Advisory Engine
Advisory feeds
Poll advisories from sources you choose, including CISA, NVD, Red Hat, Debian and the EU Vulnerability Database, plus your own RSS or Atom feeds.
Am I affected?
New advisories are matched against your SBOM inventory. Confirming a match files a DefectDojo finding.
Cases with clocks
Matches are grouped into cases with SLA triage clocks, so nothing waits unseen.
Advisory publishing
Write, review and publish your own advisories. Approvals are bound to the exact content and every publish is snapshotted.
SBOM and VEX export
Export each product's components as CycloneDX or SPDX and its triage decisions as CycloneDX VEX, per release.
Article 14 packages
Build the early warning, notification and final report for each actively exploited vulnerability, with an audit trail.
From advisory to report
Load your inventory
Import SBOMs and scanner findings for each product and release.
Watch the feeds
DefectDojo polls the advisory sources you select from your own instance.
Confirm and fix
Confirmed matches become findings with owners, SLAs and tickets.
Disclose and report
Publish an advisory, export VEX and prepare the Article 14 package for each deadline.
CRA dates that matter
| Milestone | Date |
|---|---|
| CRA entered into force | December 10, 2024 |
| Reporting obligations apply, ENISA Single Reporting Platform live | September 11, 2026 |
| Full application | December 11, 2027 |
Sources: European Commission and ENISA.
Pricing and next step
FAQ
When do the CRA reporting obligations start?
Reporting obligations for actively exploited vulnerabilities and severe incidents apply from September 11, 2026. The rest of the regulation applies from December 11, 2027.
What are the CRA reporting deadlines?
An early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report no later than 14 days after a corrective measure is available for a vulnerability, or within one month of the notification for a severe incident.
Does DefectDojo submit reports to ENISA?
No. DefectDojo builds the package for each stage and records when you became aware and when you submitted. A person on your team submits it through ENISA's Single Reporting Platform.
Which SBOM formats does DefectDojo support?
It imports CycloneDX (JSON and XML) and SPDX. It exports CycloneDX 1.6 or SPDX 2.3 per product and release, and exports VEX in CycloneDX format.
Is the PSIRT Advisory Engine part of DefectDojo Pro?
It is a separately licensed add-on to DefectDojo Pro.
Does DefectDojo tell us whether the CRA applies to our products?
No. Scope decisions belong with your legal and compliance teams. DefectDojo handles the vulnerability tracking, disclosure and reporting work once you know what is in scope.