Start free trial
CRA reporting obligations have applied since September 11, 2026

Know the moment your software has a vulnerability.

Secupipe knows every component in your software and raises the alarm as soon as a vulnerability becomes known in any of them. You see immediately which product is affected and what needs to happen by when, and you have the evidence for CRA, NIS2 and BSI IT-Grundschutz.

  • Automatically detectedNew vulnerabilities are mapped to your products, without anyone having to search.
  • Reported on timeThe 24-hour early warning is prepared, not improvised.
  • Fully documentedEvery step is logged and can be exported for audits.
Try free for 14 days See pricing
No credit card for the trial Hosted in Germany Auditors free of charge
app.secupipe.com/reports
ReportsPrepare report
CVE-2026-1502actively exploitedGateway 2.1.4 · Unauthenticated remote access
24 h · Early warning08:49:38
72 h · Notification2 d 17 h
14 d · Final report13 d 16 h
CVE-2026-0942reportedController 4.2 · Buffer overflow in library
24 h · Early warningdone
72 h · Notificationdone
14 d · Final report6 d 3 h
AIEarly warning draft for CVE-2026-1502 is ready: affected versions, exploitation, initial mitigations.ViewApprove

Sample data

Mapped to the frameworks you are audited against

CRANIS2BSI IT-GrundschutzISO 27001DORA

From commit to audit. All documented.

Every assessment, every report and every piece of evidence traces back to a source: SBOM, scan, signature or decision.

Vulnerabilities with VEX

Findings ranked by exploitability, not just CVSS. With VEX status and justification, so “not affected” is backed by evidence.

Reporting deadlines under control

The deadline clock starts as soon as a vulnerability is considered exploited. 24 h, 72 h and final report, each with a prepared draft.

SBOMs per version

A bill of materials for every release, traceable down to the individual component. The foundation for every assessment and every report.

Policies that take effect

Rules like “no end-of-life components” warn or block the release before a problem reaches your customer.

Evidence package in one click

For auditors or authorities: requirements, SBOMs, VEX decisions and scan reports, organized by CRA, NIS2, IT-Grundschutz or ISO 27001.

A complete audit log

Who decided what and when, whether a person, the AI or the system. Entries cannot be changed and can be exported as CSV.

One product. Modules as you need them.

The core is always included. Turn on everything else in the settings when you need it.

Always included

Core

Vulnerabilities, VEX, SBOMs, policies, requirements, evidence, team and audit log.

For manufacturers

Products & CRA

Products with versions and technical documentation, a reporting assistant for CSIRT and ENISA, and the deadline clock.

For operators & IT

Infrastructure

Data center, cloud and Kubernetes as an inventory, checked against IT-Grundschutz and NIS2.

For service providers

Customer projects

Delivery packages per customer and contractual reporting deadlines, which are often shorter than the legal ones.

For procurement

Suppliers

Request evidence from suppliers, track deadlines and keep an eye on your supply chain, including for DORA.

Optional

AI assistant

Assessment suggestions and report drafts. The AI suggests, a human approves.

Who Secupipe is built for.

Three starting points, one platform. If you have more than one role, simply turn on more than one module.

01 · Manufacturers

You place products on the market.

The CRA requires an SBOM, vulnerability handling throughout the support period and notifications within 24 hours.

02 · Operators & IT

You run the infrastructure.

Data center, cloud or Kubernetes under NIS2 or IT-Grundschutz: risk management, incident reporting, evidence.

03 · Service providers

You build software for customers.

Your customers pass their CRA and NIS2 obligations on to you by contract, usually with shorter deadlines.

Build your plan.

Base price plus modules plus €29 per user. Read-only auditors are free. Monthly prices in euros, plus VAT, cancel any month.

Base price and modules2 modules
Managed service · Self-hosting

On request, we handle the entire integration.

We integrate and configure Secupipe for you and, if you like, run it too: assess vulnerabilities, prepare reports on time, keep evidence up to date. You approve, we handle the rest.

We set up the entire chain for you: pipelines, CMDB, Jira, Slack, Microsoft Teams and other integrations.

Prefer to run it yourself? Secupipe also runs as a Docker container in your own infrastructure, in your own data center or in your cloud.

  • Setup. Connect products, infrastructure, CI/CD pipelines, your CMDB, ticketing and chat tools, define policies.
  • Ongoing operations. Assess new vulnerabilities weekly and submit VEX decisions for your approval.
  • Incident reporting. Prepare notifications to CSIRT, ENISA and BSI and keep track of deadlines.
  • Audit. Compile the evidence package and support you during the audit.
Book a call

Frequently asked questions

Does the CRA apply to me?

The CRA applies to products with digital elements placed on the EU market: software, and hardware that contains software, whether sold or provided free of charge as part of a commercial activity. Pure SaaS offerings generally fall under NIS2, not the CRA. If in doubt, a short call helps.

What happens after the 14-day trial?

You decide whether to subscribe. Without a subscription your data stays readable, but changes are locked. You don’t need a credit card for the trial.

Where is my data stored?

On servers in Germany, or with you: Secupipe can also be self-hosted as a Docker container. Each company is strictly separated from all others, and every change is logged with its time and author.

How much does an additional user cost?

€29 per month for each admin or member, prorated on a running subscription. Read-only auditors, such as external auditors, are free. You invite team members by link and assign the role Admin, Member or Auditor.

Does the AI make decisions about my vulnerabilities?

No. The AI assistant makes suggestions, such as a VEX assessment or a report draft. Only what a human approves is applied, and both are logged.

I work with several customers. Can I use one login?

Yes. With one login you can belong to several companies and switch between them. Each company has its own subscription and its own data.

Ready for your next audit?

Create your company and try Secupipe for 14 days, with all modules and no credit card.

Start free trial