How it works
Six steps, most of them automatic
How Provetry works: what runs by itself, what a certified security expert reviews, and what stays your decision.
- Art. 14(2)(b)Notification2 d 18 h left
- Art. 14(2)(c)Final reportStarts when the fix ships
Draft · early warning
# Early warning: actively exploited vulnerability
Regulation (EU) 2024/2847, Article 14(2)(a)
Product: Gateway firmware 4.2 (connected device)
Affected component: libwebp 1.3.1 (fixed in 1.3.2)
Member States where the product is available: FR, IE- 1
Add a product and check its scope
Name the product, answer the scope questions and pick its category. Provetry records its class, the conformity route and the support period you commit to, with its end date.
- 2
Build the software bill of materials
Connect your Git repository (read-only) or upload a lock file, a container image or an existing SBOM. Provetry produces a CycloneDX and SPDX bill of materials for each release, transitive dependencies included, and keeps every release’s SBOM in your technical file.
- 3
Watch every component, every day
Each component is matched against public vulnerability data (OSV) and, above all, against the catalogues of actively exploited vulnerabilities: CISA KEV and the EU Vulnerability Database. You can mark a vulnerability as not exploitable in your product, with your reason: that record is kept.
- 4
When a component is exploited, the clock starts
You get an alert at once, by e-mail and in the dashboard. The early warning is already drafted with your product data: versions affected, Member States where it is sold, contacts. You decide whether it applies, and you submit it through ENISA’s Single Reporting Platform.
- 5
Notification, final report and user notice
The 72-hour notification and the final report follow the same way, with reminders before each deadline, and a notice for your users that you can adapt and send.
- 6
Keep your file ready for December 2027
Guided technical documentation, a coordinated vulnerability disclosure policy and a security.txt file, the EU declaration of conformity: drafted from what Provetry already knows about the product.
Many of those vulnerabilities sit in code your product never runs. Your CI tells which, with the evidence: see reachability.
Expert review
Who reads what, before it reaches you
| Output | Produced | Reviewed by an expert | Decided by you |
|---|---|---|---|
| SBOM, vulnerability matches, alerts | Automatically, at once | No, so that nothing waits | Which findings apply |
| CRA readiness audit report | Automatically | Always, before delivery | The action plan |
| Technical documentation, disclosure policy | Drafted from your data | Always, before delivery | The final wording |
| ENISA early warning, notification, final report | Drafted at once | On the Reviewed reports add-on | Whether to submit, and submitting |
The reviewer is a security professional certified CISSP, OSCP and CEH. Provetry gives no legal advice.