Automated Cyber Resilience
for every build
Software supply chains are the #1 attack surface. CRACI helps companies ship secure releases with automated SBOMs, vulnerability tracking, and audit-ready evidence right from your CI/CD.
Backed by
End-to-end lifecycle management
CRACI organizes supply chain security around four connected workspaces — from your first build to your next audit.
Builds
Trusted builds, faster CI
- Trigger builds across all your repositories
- Sign artifacts with provenance attestations
- Generate and export a complete SBOM
- Accelerate your CI builds
Security
View your supply chain dependencies
- Discover vulnerable packages in your supply chain
- Triage builds sharing vulnerable dependencies
- Assess supply chain vendor risks
- Set up automated alerts for new CVEs
Inventory
Monitor your devices and deployments
- Investigate sites and products currently flagged at risk
- Manage out-of-date software versions
- Resolve version divergencies across deployments
- Manage inventory across regulatory regions
Compliance
Manage your compliance reports
- Detect and remediate product compliance issues
- Submit required CRA reports to ENISA
- Set up customer notification integration
- Prove compliance to vendors
Featured
Designed for products of all scales.
Whether you're shipping a single microservice or managing hundreds of repositories, CRACI brings supply chain security to every build.
Automated SBOM Generation
Generate a provably complete Software Bill of Materials directly from CRACI's build runner. CycloneDX and SPDX formats supported.
Vulnerability Tracking
Continuous vulnerability management with real-time monitoring across all your dependencies.
Compliance Reports
Generate CRA-ready SBOM reports and vulnerability disclosures for ENISA with one click.
CI/CD Integration
Runs as your build runner, surfacing results in GitHub, GitLab, Jenkins, and more.
Team Collaboration
Assign vulnerabilities, track remediation progress, and coordinate disclosures.
Research
Disclosure is outpacing triage
We rebuild the full CVE record from the CVE Program's official
cvelistV5 repository every day and publish what
it shows. In 2026 the rate is still climbing.
CVEs published per day
One every 6 minutes in 2026
High or Critical per day
Up from 54 per day in 2025
Records analysed since 2020
Rebuilt daily from the CVE Program's cvelistV5