**Site navigation:** - [Home](/index.md) - **Use Cases** - [Fleet Health Monitoring](/use-cases/fleet-health-monitoring.md) - [OTA Firmware Updates](/use-cases/ota-firmware-updates.md) - [Firmware Vulnerability Management](/use-cases/firmware-vulnerability-management.md) - [Remote Diagnostics](/use-cases/remote-diagnostics.md) - [Product Analytics](/use-cases/product-analytics.md) - [Cyber Resilience Act](/use-cases/cyber-resilience-act.md) - [Pricing](/pricing.md) - [Docs](https://docs.spotflow.io/) - [Blog](/blog) - [About Us](/about-us.md) --- # Spotflow Accelerates Your CRA Compliance [Book a Demo](https://calendly.com/spotflow/meet-with-jan) [Start for Free](https://app.spotflow.io/signup) No credit card required! ## The CRA Requires Continuous Product Security You must monitor internal activity, handle vulnerabilities, and deliver security patches. ### 11 September 2026: Report Incidents and Exploited Vulnerabilities Manufacturers must use the CRA Single Reporting Platform to notify actively exploited vulnerabilities and severe security incidents. An early warning is due within 24 hours of becoming aware, followed by a fuller notification within 72 hours and a final report. [CRA: Article 14](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng) ### 11 December 2027: Meet CRA Cybersecurity Requirements Products placed on the EU market must satisfy the CRA's essential cybersecurity requirements. Manufacturers must assess cybersecurity risks, address vulnerabilities, provide security updates throughout the support period, maintain technical documentation, and complete the applicable conformity assessment. Products must also provide security-related information by recording or monitoring relevant internal activity, including access to or modification of data, services, or functions, with an opt-out mechanism for the user. [CRA: Articles 13 and 71, Annex I, Part I](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng) ## Spotflow Addresses Several CRA Requirements | CRA Requirements | How Spotflow Helps | | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Detect Firmware Vulnerabilities](/use-cases/firmware-vulnerability-management) | Spotflow continuously scans firmware dependencies against known CVEs. You can record whether each finding affects your firmware, document your response or justification, and preserve every decision in an audit timeline. | | [Deploy Security Fixes Over the Air](/use-cases/ota-firmware-updates) | Deploy patched firmware to selected devices or cohorts defined by tags such as model, hardware revision, or region. Start with a small group, track each device from pending to success or failure, then expand the rollout. Stop or roll back if problems appear. | | [Monitor Device Activity](/use-cases/fleet-health-monitoring) | Spotflow collects logs, system and application metrics, connectivity and uptime data, and crash reports from devices in the field. Use dashboards and alerts to spot unusual behavior, then search across the fleet or inspect an individual device to investigate incidents remotely. | | [Track Software Across Your Fleet](/use-cases/firmware-vulnerability-management) | See which firmware version runs on every device and use its SBOM to track the software components and dependencies it contains. When a component is vulnerable, identify the affected firmware versions and deployed devices. | ## Identify Affected Devices and Verify the Fix Track vulnerabilities from discovery through deployment. Monitor the fleet after each update. ### Maintain a Firmware-Level Software Inventory Upload an SBOM for each firmware version. Spotflow records its components and dependency relationships, then links that firmware version to the devices running it. When a vulnerability is disclosed later, you can see which releases and deployed devices may be affected. [See How SBOM and CVE Tracking Works](https://docs.spotflow.io/using-spotflow/guides/track-security-issues) ### Find Newly Disclosed Vulnerabilities in Existing Releases Spotflow matches SBOM components against known CVEs and re-evaluates existing SBOMs as the vulnerability database changes. Filter findings by severity, component, assessment state, or whether a CVE appears in the CISA Known Exploited Vulnerabilities catalog. [Explore Firmware Vulnerability Management](/use-cases/firmware-vulnerability-management) ### Make Vulnerability Triage Auditable Record whether each issue is under triage, affected, or not affected. Document the response to affected issues and the justification for issues that do not affect your firmware. The audit timeline preserves what changed, who made the decision, when, and why. [Read the Security Issue Workflow](https://docs.spotflow.io/using-spotflow/guides/track-security-issues#assess-the-issues) ### Patch Affected Devices with Controlled OTA Rollouts Deploy patched firmware to a selected list of devices or a cohort defined by device tags. Follow progress device by device, retry failed updates, stop a rollout, or create a rollback deployment. Then use firmware-linked telemetry to investigate how the update behaves in the field. [Learn About OTA Updates](/use-cases/ota-firmware-updates) ### Monitor Device Activity and Investigate Incidents Spotflow collects device logs, system and application metrics, connectivity and uptime data, and crash reports. Search these signals across the fleet or inspect one device, build dashboards and alerts, and link events to the firmware version running at the time to investigate suspicious behavior and verify fixes. [Explore Fleet Health Monitoring](/use-cases/fleet-health-monitoring) ## Frequently Asked Questions ### How Does Spotflow Identify Affected Firmware and Devices? Upload an SBOM for each firmware version. Spotflow continuously matches its components against known CVEs and maps each finding to the firmware versions and deployed devices that may be affected. ### Can We Document Vulnerability Assessments in Spotflow? Yes. Mark each finding as under triage, affected, or not affected, then record your response or justification. The audit timeline preserves what changed, who made the decision, when, and why. ### Can We Roll Out Security Fixes Gradually? Yes. Target selected devices or cohorts based on tags such as model, hardware revision, or region. Start with a small group, track progress device by device, then expand, stop, or roll back the deployment based on the results. ### Does Spotflow Work with Our Hardware and Firmware Stack? Spotflow integrates with Zephyr, including nRF Connect SDK, ESP-IDF, and Embedded Linux. Other platforms can connect over MQTT through a thin client integration; the cloud platform is operating-system and silicon agnostic. Feature availability varies by integration. ### What If Our Devices Are Constrained or Frequently Offline? The Spotflow SDK can be tuned for devices with limited resources. Telemetry is buffered on the device while it is offline and sent when connectivity returns, with a configurable buffer size. ## Become CRA Compliant with Spotflow Manage vulnerabilities, deploy fixes, and monitor devices in the field. [Sign Up](https://app.spotflow.io/signup) No credit card required! [Book a Demo](https://calendly.com/spotflow/meet-with-jan) --- ## Spotflow **Socials & Contact** - [hello@spotflow.io](mailto:hello@spotflow.io) - [Discord Community](https://discord.gg/yw8rAvGZBx) - [LinkedIn](https://www.linkedin.com/company/spotflow/) - [Contact us](mailto:hello@spotflow.io) - [Security](https://github.com/spotflow-io/security) **Product** - [Documentation](https://docs.spotflow.io/) - [Roadmap](https://roadmap.spotflow.io/roadmap) - [Changelog](https://roadmap.spotflow.io/changelog) - [Status Page](https://status.spotflow.io/) **Compare** - [vs Memfault](/memfault-alternative.md) **Legal** - [Terms of Use](/terms-of-use) - [Privacy Policy](/privacy-policy)