Awareness 06:10Early warning due Fri 06:10Remaining 22:30:00Affected 3 machinesExample values

Report vulnerabilities in your machines on time.

Fixradar helps machine and device manufacturers meet the reporting obligations under the Cyber Resilience Act (CRA) on time. Every morning, Fixradar checks whether a known vulnerability affects your machines. If it does, you find out that same morning and receive a ready-written report text.

Book a demoHow a report works
  • Servers in Germany
  • Report texts matching the form of the ENISA Single Reporting Platform
  • Support with the SECURE funding application
Controller TX 400OpenSSL 3.2.1
actively exploited
CVE-2026-31877
Sheet 1 · Packaging line TX 400 · Example

What happens when a new vulnerability becomes known.

In this example, 90 minutes pass between the morning matching and the submitted early warning. Fixradar handles the matching, the deadlines and the report text. Your team reviews and decides.

Time 06:10Matching in progressDeadline none yet
Controller TX 400OpenSSL 3.2.1
actively exploited
Submitted by you at 07:4022 h 30 min before the deadline · Customer notice ready as a draft
0 of 1,284 software components across all products checked
06:10

The morning matching.

Fixradar compares every software component in your machines with the public vulnerability databases. This includes the US agency CISA's list of vulnerabilities that are being actively exploited.

06:11

Match in the TX 400 controller.

The controller's encryption library has a vulnerability that is being actively exploited. The 24-hour deadline for the early warning runs from the matching at 06:10. Fixradar notifies the responsible person immediately.

07:35

The other entries have been pre-assessed.

143 other new entries from the databases do not affect your plant, for example because the version does not match or the affected function is not used. Each one comes with its reasoning. Your team only has to confirm them.

07:40

You submit the early warning.

With one click, the form-filling helper enters the finished English text into the ENISA Single Reporting Platform; you review and submit. Fixradar stores the time and confirmation number for your evidence.

Three affected machines, one step.

The same software is often found in several product lines. Fixradar shows immediately which machines are affected and prepares the early warning for all affected products together.

TX 400 · Packaging lineTX 600 · Pillow bag machinePack S · Compact packerEarly warning for all threeOpenSSL 3.2.1 · 3 machinesTX 400 · Packaging lineTX 600 · Pillow bag machinePack S · Compact packerEarly warning for all threeOpenSSL 3.2.1 · 3 machines
Sheet 2 · Example

The reporting obligation also applies to the machine you delivered to Poland in 2019.

Since 11 September 2026 the reporting obligation has applied to actively exploited vulnerabilities in all connected products you have placed on the EU market, including older ones. The early warning is due after 24 hours, the full notification after 72 hours and the final report no later than 14 days after a security update is available.

Tavrona plant · DETavrona TX 400Built 2019 · SN 19-0412FW 4.2.0 · Support until 2031Site Poznań · Hall 2Tavrona plant · DETavrona TX 400Built 2019 · SN 19-0412FW 4.2.0 · Support until 2031Site Poznań · Hall 2
Sheet 4 · in the field · reportable

In the morning, you see first what needs doing today.

At the very top is what has to be reported today, with the deadline and the next step. All other vulnerabilities have already been pre-assessed and are just waiting for your confirmation. A quick look in the morning is enough.

Example view with example values
06:11

What is due today is at the top.

If a vulnerability in your software is being actively exploited, it appears at the very top, together with the deadline and the next step.

07:38

The early warning is prepared.

One click opens it. All required fields are pre-filled, in English and structured like the platform's form.

07:40

Submitted by you, recorded by Fixradar.

You enter the confirmation number. Fixradar closes the deadline and shows the next one.

You know what is inside every controller.

Fixradar keeps the software bill of materials (SBOM) of every product for every firmware version, including the details from your suppliers. That way, every new vulnerability reaches the right machine within seconds. And from December 2027, when the SBOM becomes part of the technical documentation for the CE marking, it is already in place.

Controller TX 400geschlossen
Sheet 3 · Exploded view · Example
Product

First, the products.

Every machine and every controller gets an entry with its CRA classification, support period and responsible person.

Firmware version

Then the firmware versions.

This includes older versions that have been running at customers' sites for years, as long as you provide support for them.

Software

Finally, every software component with its version.

We import existing SBOMs directly. Missing ones we create together with your development team during onboarding. Details only your supplier knows can be requested from them through Fixradar.

Linux 6.1.84
OpenSSL 3.2.1
BusyBox 1.36.1
Mosquitto 2.0.18
lighttpd 1.4.73
zlib 1.3

Product security evidence

  1. Products and support periods14
  2. SBOMs per firmware version38
  3. Assessments with reasoning612
  4. Reports and confirmations4
  5. Reporting setup and deputies2 people
  6. Vulnerability disclosure policypublished
ManufacturerTavrona Anlagenbau
Date29.10.2026
Sheet1 / 1
BasisRegulation (EU) 2024/2847
Approved byL. Hartmann
ValuesExample

If a major customer asks for evidence, you send it the same day.

Car makers and pharmaceutical and food groups increasingly want to know from their suppliers how they are implementing the Cyber Resilience Act. For this, Fixradar produces a ready-made evidence document that you can present at customer audits, to conformity assessment bodies or to authorities.

Frequently asked questions

Your question is not here? Ask it in the first call, ideally using one of your own machines as the example.

Book a demo
Do we need a dedicated security team for this?

No. In most companies, someone from development or product management handles it alongside their other work. Fixradar pre-assesses every vulnerability and drafts the report. Your team reviews, decides and submits.

What is the ENISA Single Reporting Platform?

Since 11 September 2026, all manufacturers in the EU have reported through a single platform run by the EU Agency for Cybersecurity, ENISA. From there, your report goes to the competent authority in the country of your main establishment, in Germany the BSI (German Federal Office for Information Security), and to ENISA at the same time. Fixradar prepares all the details. The Fixradar form-filling helper for Chrome and Edge enters them into the platform's form with one click; you review and submit yourself.

When does the CRA reporting obligation apply?

Since 11 September 2026. It also applies to products you shipped years ago that are still in use. The other obligations of the Cyber Resilience Act, for example on secure development and CE marking, apply from 11 December 2027.

What deadlines apply to a report?

From the moment you become aware of an actively exploited vulnerability, you have 24 hours for the early warning and 72 hours for the full notification. You submit the final report no later than 14 days after a security update is available. For a severe incident, it is due one month after the notification. Fixradar tracks every deadline and reminds your team in good time.

Which products are subject to the reporting obligation?

Every product with software and a data connection that you offer in the EU: controllers, machines with remote maintenance, sensors, gateways, operator panels and pure software too. We clarify which of your products are covered during onboarding.

How much does Fixradar cost?

You receive a quote for your situation. The price depends on the number of your products and firmware versions, your sites and how much of the onboarding we take on for you. You receive the quote after the first call.

Is there funding available?

Yes. The EU project SECURE funds small and medium-sized enterprises implementing the CRA with up to EUR 30,000 per project. You cover half of the costs yourself. The second call has been open since 1 October and runs until 11 December 2026; every company can apply. We support you with the application.

Where is our data stored?

On servers in Germany. Your SBOMs and assessments do not leave the EU. Only the people you authorise can see them.

How quickly can we get started?

Daily matching starts as soon as the first product has been created. We plan two weeks for the complete onboarding.

In the first call, we check one of your machines live.

Send us an SBOM in advance or name the main software components of a controller. After 30 minutes, you know which reports would be due for you today. You then receive a quote that fits your products.

  1. Three short questionsHow many products, whether SBOMs exist and how far along your reporting setup is. This takes one minute.
  2. Live check, 30 minutesWe match one of your machines and show which reports would be due today.
  3. Your quoteTailored to your products. You can start within two weeks.
Book a demoNo obligation. We will get back to you within one working day.
Your SBOM becomes a check result