Vulnerability management: watching your products for their whole lifetime
The Vulnerability management module keeps track of the components in your products after release and supports the reports the CRA now requires.
1. What this module is
Continuous monitoring of the components in your products for new vulnerabilities, for the whole product lifetime.
2. Why it is useful
- Since 11 September 2026, the CRA requires reporting actively exploited vulnerabilities within 24 and 72 hours. From 11 December 2027, vulnerability handling for the whole support period applies as well.
- FDA premarket rules and IEC 62443-4-1 expect the same discipline.
- A new vulnerability is only manageable if you know at once which products and versions it affects.
3. How it works, briefly
- Your component lists are tracked against vulnerability sources.
- New findings are linked to the affected products, versions and risks in the shared product model.
- The platform supports the 24-hour and 72-hour reports and the final report.
4. Who uses it
PSIRT and product security teams.
5. Which industries use it
Manufacturers in all six industries we serve.
Connected to
Before: Assessment. Next: Threat modeling and concept design, because a new vulnerability flows back into the risk assessment. All modules share one product model.
In depth: vulnerability management
Why vulnerability management matters, where it is required, which problems it prevents and what the effort looks like.
Why it matters
A product's security does not end at release. New vulnerabilities are published every day in components your products contain, often years after the product was built. You need to know quickly which products and versions are affected, how serious it is and what to do.
Where it is required
Since 11 September 2026, the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities with an early warning within 24 hours and a notification within 72 hours; from 11 December 2027, vulnerability handling applies for the whole support period. ISO/SAE 21434 and UN R155 require monitoring of vehicles in the field, IEC 62443-4-1 requires defect and update management, and the FDA expects a postmarket vulnerability plan.
Which problems it prevents
Missed reporting deadlines. Products left unpatched in the field. Slow impact analysis because nobody knows where a component is used. And decisions about a vulnerability that are made but never documented.
Typical effort without tooling
Without an up-to-date link between the software bill of materials of each product and the vulnerability sources, impact analysis takes days instead of hours, and meeting a 24-hour deadline becomes a matter of luck.
With AITIGRITY
Your component lists are matched against vulnerability sources continuously. New findings are linked to the affected products, versions and risks in the shared product model, and the platform supports the 24-hour and 72-hour reports and the final report, so the decision and its reason are documented for every vulnerability.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.