Resilic covers the Cyber Resilience Act obligations that matter: product & SBOM register, fleet-wide vulnerability intelligence, secure-by-design and technical documentation, and incident reporting. Start where the obligation already applies (Article 14 reporting, in force since 11 September 2026), then cover the remaining CRA obligations on the same platform, step by step. AI drafts it; you sign it.
No credit card · 30-day trial · Set up in an afternoon
See at a glance whether any machine you have shipped is hit by an actively-exploited CVE, correlated across EUVD, NVD and CISA KEV, exploited first.
When a report is required, the Article 14 draft is pre-filled and cited to its sources. You review and sign; nothing is auto-submitted.
Live 24h / 72h / 14-day countdowns on every reportable event, so the regulatory clock never catches you out.
The Cyber Resilience Act doesn't arrive all at once. It lands in waves, and each wave reuses the work from the last. Resilic is built around that timeline so you're never starting over.
Most teams are ready within an afternoon. You bring your products and SBOMs; Resilic does the correlation and the first draft.
Add every product, version and customer deployment, by hand or by bulk CSV import. Then ingest CycloneDX or SPDX SBOMs; AI normalises components to known CPE/PURL identifiers for you to confirm.
Resilic correlates your components against EUVD, NVD and the CISA KEV catalogue: actively-exploited first, with EPSS context. AI triage explains whether a CVE really affects your product, with sources cited.
When a report is required, a guided editor maps to the ENISA Single Reporting Platform fields with the AI-drafted content pre-filled. A live deadline panel tracks the cascade. You review, edit and sign; nothing leaves without you.
Not a generic AppSec scanner and not a slide-deck GRC tool. A vertical workflow built around how machine builders actually work.
The one view that answers "is any fielded machine at risk right now?" Your fleet, matched against EUVD, NVD and CISA KEV, prioritised by active exploitation and EPSS. Each row carries the affected products and the suggested next action, and a one-click Start Article 14 report when it's exploited.
Every product, version and customer deployment in one fleet view, with SBOM, vulnerability and support-period status at a glance.
Import CycloneDX and SPDX bills of materials. AI matches components to known identifiers; you confirm or correct with confidence shown.
A staged form mapped to the ENISA platform (early warning, notification, final), with live countdowns and a submit gated behind your sign-off.
Request SBOMs and attestations from your component suppliers through a dead-simple branded portal, and qualify them with a structured questionnaire. Coverage rises as they respond.
Timestamped, attributed, immutable records of what was reported and who signed: the defensible artifacts a regulated buyer needs.
Generate a CVD policy and CRA technical documentation from templates: AI-drafted, human-approved, with a clear draft vs approved state.
Approve a security advisory and Resilic publishes it as a signed CSAF 2.0 feed under your verified domain, with security.txt and a daily refresh — for issues with a CVE and for those without one yet.
Draft your AI-use policy or upload the one you have, let staff confirm it through a personal link, and export the AI Act Article 4 evidence pack — the duty that already applies to every organisation using AI.
An on-premise scanner finds machines and firmware on the plant network, PROFINET included, and matches them to your register — so the fleet view reflects what is actually installed.
Machine builders face a stack of overlapping regimes, and tools built for horizontal software teams don't fit. Resilic is the vertical, built around the CRA and how machine builders actually work.
Scanners list CVEs. Resilic tells you which ones hit a machine you have shipped, prioritised by active exploitation, then drafts the Article 14 report.
Generic checklists weren't written for the CRA or for machinery. Resilic is a vertical workflow: fleet, SBOMs, suppliers, vulnerabilities and reports in one place.
A retainer produces slides. Resilic is software you own that keeps working between audits: your evidence reusable across CRA, Machinery and the AI Act.
A connected machine is a "product with digital elements" under the CRA and machinery under the Machinery Regulation, and may soon embed high-risk AI. The obligations overlap. Resilic keeps one evidence graph and shows which regime each row satisfies.
Machinery Regulation and AI-Act modules expand from the same account as those deadlines approach: no migration, no re-entry.
In a regulated domain, a black box is a liability. Every AI output in Resilic is drafted, cited and clearly labelled; then it waits for a human. Nothing is auto-submitted, ever.
This vulnerability in OpenSSL 3.0.x is likely exploitable in your PalletBot-X2 firmware 4.2: the affected TLS renegotiation path is reachable from the machine's remote-maintenance interface. An Article 14 report is recommended.
No customer logos to show off yet. So here is what actually earns your trust in a regulated domain.
Priced by the number of products you manage, with no hidden quotes. Start on a 30-day trial and upgrade when you're ready.
Answer four questions and get an honest read on your scope, your deadlines, and where to start. Most machine builders are in scope, but not for everything at once. We'll tell you exactly which.
We'd rather be precise than alarmist. Here's what Resilic does — and what it deliberately doesn't.
No. Anyone who claims that is overselling. Our first kit is Article 14 readiness: detect exploited vulnerabilities in your fleet and stand up the reporting workflow. Full CRA conformity (Dec 2027) is a later expansion on the same platform.
Start now; the obligation covers products already in the field. The CRA has real teeth: penalties reach up to €15 million or 2.5% of global annual turnover, and market-surveillance authorities can restrict or withdraw a product. We won’t fear-sell that: the point of Resilic is to get you ready within days, with the evidence to show it.
No. Resilic drafts and organises everything to match the ENISA Single Reporting Platform, but a human always reviews and submits. AI drafts; you sign.
For actively-exploited vulnerabilities and severe incidents, Article 14 requires an early warning within 24h, a notification within 72h, and a final report within 14 days. Resilic tracks each stage with a live countdown.
Very likely yes: the CRA is explicitly extraterritorial. If you place products with digital elements on the EU market, you're in scope regardless of where you're headquartered.
EUVD, NVD and the CISA KEV catalogue, with EPSS for exploitation-probability context. Actively-exploited issues are always surfaced first.
Yes. Resilic is built for German and English from day one, with WCAG AA contrast and full keyboard navigation, designed with longer German strings in mind.
Set up your fleet, see your first vulnerability result, and know your Article 14 position — the obligation applies today, to products already in the field.
Occasional updates on Cyber Resilience Act milestones, ENISA guidance, and Article 14 practice — for machine builders. No spam.