The free tools that get you most of the way to CRA readiness

A lot of writing about the Cyber Resilience Act nudges you toward buying something. So here's the honest version from someone who does sell a tool in this space: you can get a real chunk of the way there with free, open-source software and public data. Here's the list.

For the ingredients list (SBOM)

Open-source generators like Syft read your project and produce a standard-format SBOM in seconds. Free, well-maintained, and the output is the real thing, not a toy version.

For finding known vulnerabilities

Tools like Grype, and the OSV database that backs a lot of the ecosystem, will take your dependency list and tell you which components have known security advisories against them. Also free, also genuinely useful.

For knowing what's actually being exploited

CISA publishes the Known Exploited Vulnerabilities catalogue: a public list of the vulnerabilities attackers are actually using in the wild. Cross-referencing your findings against it is how you separate the handful that matter from the noise. FIRST publishes EPSS scores, also public, for ranking the rest by likelihood.

So why would anyone pay?

Fair question, and the honest answer is time and packaging, not secret data. The free tools each do one job and hand you raw output. Stitching them into a single readable answer, running it continuously so you catch a newly-exploited component the day it lands, and producing something you can actually hand to a customer or an auditor: that's the work a paid tool saves you.

If you have the time and the inclination, the free stack is real and I'd genuinely encourage you to use it. If your time is better spent shipping your actual product, that's the gap a tool like ours fills. Either way, the worst option is the third one: not looking at all.