Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

Provetry vs Verimu: which one for the CRA?

6 min read

On this page
  1. In one sentence
  2. Side by side
  3. Where Verimu may suit you better
  4. Where Provetry may suit you better
  5. What to check before choosing
  6. Sources

Verimu and Provetry are both services built for the Cyber Resilience Act, both run from the EU, and their paid plans even start at the same prices. They do not put the same things in each plan, though, and they do not cover the same documents. This page sets out what each offers, as of November 2026, from Verimu’s public pages and ours, so you can compare them on what matters to you.

In one sentence

Verimu scans your repositories in CI, produces SBOMs per commit and alerts you to new vulnerabilities, with a CRA notification workflow and PDF reports on its Professional plan. Provetry takes a product from its lock files to its CRA duties: SBOM at every release, exploited-vulnerability watch, the Article 14 reporting deadlines with drafts for ENISA’s platform, VEX, the disclosure policy, CSAF advisories and the technical documentation.

Side by side

For each service, the plan that includes a feature is given in brackets. Prices exclude VAT. “Not stated” means we did not find it on Verimu’s public pages in November 2026; it may exist all the same.

Verimu Provetry
Model Hosted, EU infrastructure Hosted, in the EU
Price Free, then €49 (Starter) or €149 (Professional) a month; Enterprise on quote; 20% off yearly Free for one product, then €49, €149 or €399 a month; 20% off yearly
SBOM input Scan in CI (GitHub, GitLab, Bitbucket), command-line tool; npm, pip, Maven, NuGet, Cargo, Go, Composer, Bundler Lock files of 8 ecosystems, or CycloneDX and SPDX SBOMs in JSON; from CI on paid plans
SBOM output CycloneDX (Free); CycloneDX and SPDX per commit (Starter); all formats (Professional) CycloneDX 1.6 (all plans); SPDX 2.3 and 3.0.1 (paid plans); one SBOM kept per release (up to 3 releases on Free)
New-vulnerability alerts Weekly digest (Free); real time (Starter) Weekly digest (Free); real time (Starter)
Known exploited vulnerabilities CISA KEV and ENISA’s EU list, EUVD (Professional) CISA KEV and EUVD (Starter)
EPSS Not stated Yes (all plans)
VEX Not stated Records your assessments and exports OpenVEX (all plans); public VEX feed (paid plans)
Reachability Not stated Suggestions from your CI, with evidence (paid plans); function level for npm, PyPI and Java (Pro and Consultant)
Article 14 reporting 24 h, 72 h, 14 days notification workflow (Professional) Reporting case opened from the moment you became aware, deadlines counted down, drafts that follow the fields of ENISA’s platform (Starter)
Disclosure policy, security.txt, CSAF advisories Not stated Yes, with a public security page per product (paid plans)
CRA reports and documentation CRA conformity reports in PDF, conformity score per project (Professional) Guided dossier, draft EU declaration of conformity, conformity report in PDF (Pro and Consultant)
Slack and Teams Yes (Starter) Yes (Starter)
Audit log Yes (Professional) Yes (Pro and Consultant)
Interface languages English (the only one we found) English, French, German

Where Verimu may suit you better

  • You want the scan to run in your pipeline and fail the build. Verimu’s command-line tool runs as a CI stage with a severity threshold, on GitHub, GitLab or Bitbucket.
  • You commit often and want an SBOM per commit, rather than per release.

Where Provetry may suit you better

  • You want the exploited-vulnerability watch and the reporting deadlines on the first paid plan. At Verimu, CISA KEV, EUVD and the notification workflow come with Professional; at Provetry, with Starter.
  • You need the documents around the SBOM. VEX statements, the disclosure policy and the contact address the CRA expects (for example in security.txt), CSAF advisories, a security pack to share with buyers, guided technical documentation following Annex VII and a draft EU declaration of conformity. Verimu’s public pages mention CRA conformity reports in PDF, but we did not find the others there.
  • You want to know whether a vulnerability actually reaches your code, with reachability suggestions from your CI.
  • Your team works in French or German. Provetry’s application and help are available in English, French and German, and so is the disclosure policy it generates.

What to check before choosing

  • Ask each vendor for a demo on one of your products and look at what you would hand a market surveillance authority: the SBOM, the VEX decisions, the reporting drafts, the technical file.
  • Who will write the ENISA reports? Under Article 14, an early warning is due within 24 hours of becoming aware of an actively exploited vulnerability in your product. Check which plan, in each tool, gives you what you need on that day.
  • Is your product even in scope? Many SaaS products are not. The free check tells you in a few minutes.

Provetry is not affiliated with Verimu. The facts above were checked on 13 November 2026 against Verimu’s home and pricing pages; if something has changed or is missing, tell us at hello@provetry.com and we will correct it.

Sources