Skip to content

services

Seven services, all of them online.

Upload firmware or documents and the analysis starts on its own; a person reviews anything urgent. ENISA report drafts and the reporting channel come with monitoring.

01 · manufacturers and white-label brands

For manufacturers and white-label brands.

If the product carries your name or your brand, whether you made it or someone else made it for you, you have the manufacturer's obligations (art. 3, point 13, and art. 21). The duty to report already applies.

Firmware analysis

You upload the compiled firmware, or the component list from your build system, and the platform analyses it on its own: what the product contains, in which versions, and which known vulnerabilities it carries. If you sell under your brand and do not have the firmware, ask the company that makes the device for you. Measured on the public OpenWrt 25.12.5 image in October 2026: the component list scored 9.6 out of 10 in the BSI TR-03183-2 checks, against 2.5 straight from the scanner, and 610 known vulnerabilities were matched to its components.

  • A component list (SBOM) in CycloneDX, with a score for its quality
  • Known vulnerabilities of each component, ranked by severity and by whether they are being exploited
  • The product's probable CRA category, worked out with the same logic as the self-check
  • A technical report in the platform

Daily monitoring

We keep the component list of each version up to date and check it every day against public vulnerability sources and the catalogues of exploited vulnerabilities (CISA KEV and ENISA's European vulnerability database, EUVD).

  • An alert as soon as we see an exploited vulnerability affecting a component of your product
  • A written decision on each relevant vulnerability: whether it affects you, and why
  • A regular summary of what was reviewed
  • A record that shows you were monitoring, for an authority or a customer who asks

Reports through ENISA's platform

When you have to report, the clock is running. The platform opens a case with the 24-hour, 72-hour and final-report deadlines, and prepares every field of ENISA's single reporting platform in English, with a translation into your language next to it, for you to review. The report goes to the CSIRT of the member state where your main establishment is (art. 14.7). ENISA's platform has no API, so a person submits each report: it is not automatic.

early warning
24 h
notification
72 h
final report
14 daysafter the fix is available; for a severe incident, one month after the notification
  • Drafts of the early warning (24 h), the notification (72 h) and the final report
  • A notice for your affected users (art. 14.8)
  • Submission by your primary representative, the person registered for your company on ENISA's platform, or by us as a secondary representative with your authorisation
  • Until your primary representative has been verified and has invited us, they submit it with our text
  • A log of who submitted each report and when

Vulnerability reporting channel

For units you place on the market from 11 December 2027, the CRA asks for a coordinated vulnerability disclosure policy and an address where people can report flaws to you. We set up both and receive the reports for you.

  • A disclosure policy in English and in your language
  • A security.txt file on your website, checked every week
  • A reporting address on your domain that reaches us
  • A first reply to the researcher, and a proposal for you

Automated security test of cloud, web and API

It reviews the part of your product that lives on the internet: the cloud, the website and the API that the device and the app talk to. Claude, Anthropic's AI model, runs it with a fixed set of non-destructive tools, only against domains you have verified as yours with a DNS record or a file on your website, and only with your authorisation signed online, where you set the scope and the time window. Today the test is passive: it looks only at what normal requests show. Port scanning and template-based checks will come later.

passive checks today: DNS · certificates and TLS · headers · email · security.txt · subdomains

  • Findings with their severity (CVSS 4.0) and how to fix them
  • Each finding mapped to the requirements of annex I of the CRA
  • A report in the platform
  • A second run once you have fixed them

02 · importers and distributors

For importers and distributors.

From 11 December 2027 you will have to check each product before you place it on the market (importer, art. 19) or before you sell it (distributor, art. 20). The orders for goods sold after that date are placed during 2027.

what article 19.2 will ask you to check

  • That the manufacturer has carried out the conformity assessment and has the technical documentation.
  • That the product carries the CE marking and comes with the EU declaration of conformity.
  • That it comes with the information and instructions of annex II in a language users understand.
  • That its type, batch or serial number, the manufacturer's contact details and the end date of support are given.
  • That the manufacturer has a process to handle vulnerabilities (art. 19.1 and annex I, part II).

You will also have to keep the EU declaration of conformity for ten years, or for the support period if that is longer (art. 19.6). If you learn of a vulnerability, you will have to tell the manufacturer and, if there is a significant risk, the market surveillance authorities (art. 19.5).

Supplier and product checks

For each product reference you import, we check what article 19 of the CRA requires before you put it on sale, and we keep the evidence in case an authority asks. Your suppliers can upload documents and firmware straight to the platform from an invitation you send them, on a page in English.

  • The art. 19 checklist for each reference, with the evidence and its status
  • Firmware analysis: what is inside and which known vulnerabilities it has, to see whether the product matches its paperwork
  • A technical verdict on each reference
  • The EU declaration of conformity and the file archived for ten years
  • Monitoring of the references while you sell them, with an alert if a serious vulnerability appears

Quick check before you buy

Before you close an order, you send us a model's documentation and firmware, and we give you a technical verdict on whether, with what there is, you will be able to sell it from 11 December 2027: suitable, doubtful or not suitable, and why.

  • A three-level verdict with its reasons
  • What the supplier is missing, so you can ask for it
  • Known vulnerabilities in the firmware

billing

Per product or reference, per month.

firmware analysis
Once, when you add the productfrom you Compiled firmware or an SBOM
daily monitoring
Per product and monthfrom you Each new firmware version
ENISA reports
Included in monitoringfrom you The facts, and your review of each draft
reporting channel
Included in monitoringfrom you A security address on your domain, forwarded to us
security test
Per test, or within the monthly feefrom you Domain verification and a signed authorisation
supplier checks
Per reference and monthfrom you An invitation to each supplier
quick check
Per checkfrom you Documentation and firmware of one model

Each price goes in a written proposal, for the products or references you want covered.

limits

What we do not do.

  • We do not certify products and we are not a notified body: article 39 of the CRA rules that out for anyone who also consults.
  • We do not decide what gets reported. That duty is the manufacturer's: we prepare the report and, with your authorisation, submit it.
  • We do not test the physical device, in a lab or over the radio. Everything we offer today is online.
  • We do not run active scans yet. The automated test only looks at what normal requests show.
  • We do not test anything you have not shown is yours, and nothing without your written authorisation.

Platform hosted in the EU

how we start

One product is enough to start.

  1. 01You write to us Which products you make or import, how they connect and where you sell them.
  2. 02We reply with a proposal A first view of what the CRA asks of you and by when, and a price per product for the services you need.
  3. 03Mutual NDA Signed before we see your firmware, your code or your suppliers.
  4. 04Invitation to the platform An account on app.duravigil.com, where you upload the firmware or the documents and the analysis starts on its own. There is no open sign-up.
  5. 05Daily monitoring From then on we check each product or reference every day, for its support period or for as long as you sell it, billed monthly.
Ask for a proposalTake the self-check