EU CRA Compliance, automated.
Prismor automatically generates SBOM and VEX documents for every release, giving enterprises a clear path to EU Cyber Resilience Act compliance without manual overhead. Integrates with your existing CI/CD, GitHub, and security toolchain in minutes.
What the EU CRA Requires
The Cyber Resilience Act applies to all products with digital elements sold in the EU. It mandates machine-readable vulnerability documentation and ongoing monitoring throughout the product lifecycle.
Software Bill of Materials (SBOM)
A machine-readable inventory of every dependency in your software, required for CRA conformity assessment. Prismor generates SPDX 2.3 and CycloneDX SBOMs automatically on every scan.
What the CRA requiresVulnerability Exploitability eXchange (VEX)
VEX documents clarify which known CVEs are actually exploitable in your product. Prismor auto-generates VEX statements so you can demonstrate due diligence without manual triage for every advisory.
What the CRA requiresContinuous Vulnerability Reporting
CRA requires ongoing monitoring and timely disclosure of actively exploited vulnerabilities. Prismor continuously re-scans and alerts your team to new CVEs, keeping your compliance posture current.
What the CRA requiresHow Prismor Automates CRA Compliance
From first scan to audit-ready documentation, no manual steps, no specialist overhead.
Connect your repository
Point Prismor at any GitHub repository. Our GitHub App or CLI scans your entire dependency tree, including transitive dependencies, in seconds.
Automatic SBOM & VEX generation
Prismor produces a CRA-compliant SBOM in SPDX 2.3 or CycloneDX format and generates VEX statements for every detected CVE. Export as JSON, XML, or PDF, ready for your conformity assessment body.
Integrate with your existing tools
Prismor slots into your current pipeline, GitHub Actions, Jenkins, GitLab CI, Jira, Slack. No rip-and-replace. Enterprise customers can connect to their existing SIEM and vulnerability management platforms.
Continuous monitoring & AI-powered fixes
New CVEs are tracked automatically as they are published. Prismor's AI can open pull requests to upgrade vulnerable dependencies, keeping your SBOM and VEX accurate without manual intervention.
Built for Enterprise Scale
Whether you manage 10 repositories or 10,000, Prismor handles the compliance workload so your engineers can focus on shipping.
CI/CD-native scanning: Trigger scans on every PR or release tag. SBOMs generated fresh with every build.
SSO & role-based access: Enterprise SSO, audit logs, and granular permissions for large security teams.
Custom integrations: Bespoke connectors to your SIEM, GRC, or vulnerability management platform.
Want this handled for you?
Prismor can set this up across your whole org - continuous scanning, SBOM/VEX generation, auto-remediation, and audit-ready CRA compliance. Tell us your stack and we’ll take it from here.