Werkspilot

    We automate vulnerability management for your embedded products — AI-assisted, in product context.

    Your team stays focused on development. SBOM management, AI-assisted CVE triage in hardware context and documented decisions — heavily automated and therefore cheaper than in-house.

    Request a free demo

    The EU Cyber Resilience Act requires manufacturers to manage vulnerabilities continuously.

    Development time is lost

    Every release generates hundreds of vulnerability alerts. At 15 to 30 minutes per assessment, that's hundreds of developer hours per release — time that should go into product innovation.

    Liability sits with the manufacturer

    The CRA requires justified, documented decisions for every vulnerability. Gaps in the documentation become a personal liability risk for management.

    24-hour reporting deadline — in force since 11 Sep 2026

    Actively exploited vulnerabilities must be reported within 24 hours. Without an established process, that is impossible to meet.

    Your team builds. We take care of vulnerability management.

    Software bill of materials from your source code

    We generate and maintain your software bill of materials directly from the source code — even in bare-metal environments without a package manager (depending on the project).

    Monitoring & context-based assessment

    New CVEs are matched daily and assessed in product context — with justification, source-code reference and a clear recommendation.

    AI-assisted filtering instead of a scan list

    Over 90% of reported CVEs aren't exploitable in your product. We filter automatically with SCA, reachability analysis and LLM-based assessment — cutting the noise drastically instead of just handing you a list.

    Results in your tools

    Results land prioritized in Jira, ServiceNow or Dependency-Track — no new portal, no process change.

    We run the analyses and document assessments directly in your systems.

    1

    Set up access

    To repositories, build configuration, risk assessment and vulnerability management system.

    2

    We analyze

    Heavily automated, continuous assessment in product context. Unclear cases with manual review.

    3

    We feed back

    Assessed findings land directly as tickets in your system — prioritized and with a clear recommendation.

    We filter and prioritize the vulnerabilities that are genuinely exploitable — heavily automated and AI-assisted.

    Hundreds of vulnerabilities per release — most of them typically not exploitable. We work at source-code level and assess in product context, with SCA, reachability and LLM analysis. Heavily automated, and therefore cheaper than assessing in-house.

    STRIDE threat analysis of your products for the CRA conformity assessment.

    The CRA requires a documented cybersecurity risk assessment for every product with digital elements — it belongs in the technical documentation and is a prerequisite for CE marking from 11 December 2027. We deliver it as a STRIDE threat analysis, documented in an auditable form.

    “With Werkspilot we have a capable partner who supports us in meeting the requirements of the Cyber Resilience Act – both as advisors and technically, from risk analysis through to implementing systematic vulnerability monitoring.”

    Günter Arztmiller

    Managing Director, The Imaging Source GmbH

    The Imaging Source logo
    Günter Arztmiller, Managing Director of The Imaging Source GmbH

    Frequently asked questions on the CRA, SBOMs and CVE triage for embedded manufacturers.

    Continuous vulnerability management across the whole support period, in three forms. First, a reasoned, documented decision for every reported vulnerability – gaps in that documentation become a liability risk for management. Second, reporting actively exploited vulnerabilities within 24 hours; that deadline has applied since 11 September 2026 and cannot be met without an established process. Third, a documented cybersecurity risk assessment for each product with digital elements, which belongs in the technical documentation and is a precondition for CE marking from 11 December 2027.

    From source code rather than from a build. The common SBOM generators assume a package ecosystem and run over a build step that resolves dependencies – bare-metal firmware often has neither. We therefore generate and maintain the software bill of materials directly from the source code, including bare-metal environments without a package manager, depending on the project. The bill of materials is kept current rather than produced once, because every release changes it.

    In our experience more than 90 percent of reported CVEs are not exploitable in the specific product. The reason is product context: whether a vulnerable function is reachable in the binary at all, whether the affected configuration is active and whether the interface is exposed externally decides exposure – not the mere presence of a library version. We filter that volume using SCA, reachability analysis and LLM-supported assessment at source-code level, instead of emitting a scan list.

    Every release typically produces hundreds of vulnerability reports. At 15 to 30 minutes per assessment that adds up to hundreds of developer hours per release – time taken out of product development. That arithmetic is precisely why a heavily automated assessment comes out cheaper than doing it in house: the effort scales with the number of reports, not with the number of findings that actually matter.

    No. Assessed findings arrive as tickets where your team already works – in Jira, ServiceNow or Dependency-Track – prioritised and with a clear recommended action. All that is set up is access to repositories, build configuration, risk assessment and the existing vulnerability management system. There is no second tool for anyone to log into and no process change for the development team.

    Request a demo now.

    See how your team can handle vulnerability management simply and meet every reporting deadline.