Getting started with Provetry

Provetry keeps your products ready for the Cyber Resilience Act: it knows what is inside each release, watches every component for new and exploited vulnerabilities, and prepares the reports you owe ENISA. Here is how to start.

1. Sign up with your work e-mail and confirm the address from the link we send. Your workspace is created on the Free plan: one product, a weekly vulnerability digest.
2. Add your first product under Products › Add a product. Give its name, what it is, your role and its CRA category. Not sure of the category? The free check on our site gives it in five minutes.
3. Upload a release: the SBOM of the release, or its lock files. Provetry builds the component list and runs the first vulnerability check within a minute.
4. Look at the result on the product page: exploited vulnerabilities first, then the ones to assess.
5. Check your alerts under Alerts: the owner’s address receives them from the start.

Want to look around first? On the overview, Try it with an example product adds an example web shop, already filled in, whose lock file pins old versions with known vulnerabilities. It does not count in your plan, sends no alert, creates no ticket and cannot be changed; delete it whenever you like.

From there, connect your CI so every release is sent on its own, and set the Member States where your products are sold in Settings: the early warning to ENISA names them.

Your CRA readiness

Each product shows its CRA readiness: what Provetry records against the main duties of the regulation, item by item, with a link to where each is done. Its profile and support period, an SBOM of a supported release, alerts set up, every vulnerability assessed, none actively exploited left open, the disclosure policy, the public security page, a reporting drill, the technical documentation and the EU declaration of conformity. The score is the share of items done, shown for every product in the product list; the product page also gives the days left before 11 December 2027. Items that need a larger plan say so.

It is a checklist of what Provetry can see, not an assessment of conformity: some requirements of Annex I (secure by default, data minimisation…) are yours to check.

What Provetry never does

Provetry never submits anything to ENISA for you, and never decides for you that a vulnerability is actively exploited. The law gives both to the manufacturer; Provetry prepares, reminds and keeps the proof.