131% more reported CVEs per day in 2026 than last year.

Inventory Management

Complete visibility into your device fleet — know what products you have, what software they run, and where they're deployed

Device Registry

Maintain a centralized registry of every physical product in your fleet. CRACI gives you a single source of truth for all deployed devices — their model, firmware version, deployment location, and current status — so you always know exactly what's out in the field.

Which versions are deployed to which products CRACI's inventory view shows exactly which software versions are deployed to which products, globally, and each version traces back to the build and SBOM that produced it. Inventory view Product Deployed version Web app v4.12.0 Mobile API v2.3.1 Gateway firmware v1.8.4 Sensor firmware v3.0.2 Each version traces back Version Build SBOM

Vulnerability Monitoring Across Everything You Ship

CRACI keeps re-evaluating the monitored SBOMs of your releases as new vulnerabilities are published, with vendor SBOMs for bought-in components monitored alongside them. When an advisory affects a version, the inventory view shows exactly which products that version is deployed to, so you know where a fix has to go without rerunning a scan. Security teams triage the finding and route it to the team that owns the fix.

Vulnerabilities across everything you have deployed When a new vulnerability is published, CRACI re-evaluates the monitored SBOMs of your releases and vendor SBOMs, finds the affected version, and the inventory view shows which products that version is deployed to. The finding is triaged and routed to the team that owns the fix. New advisory published Long after the release shipped Monitored SBOMs re-evaluated Your release builds and your vendors' SBOMs Affected: Gateway firmware v1.8.4 Inventory: where v1.8.4 is deployed Product Deployed version Gateway Pro v1.8.4 Gateway Mini v1.8.4 Route the fix

SBOM-to-Device Mapping

Link every device to its exact software composition. CRACI maps SBOMs to specific product versions and individual devices, so when a new vulnerability drops, you instantly know which devices in your fleet are affected and where they are.

Provenance data from every build Every job on CRACI records the packages it fetched and its network trace. The public REST API returns the job's SBOMs, network trace and provenance. Build release job on CRACI Recorded packages fetched network trace Provenance build data, via the API Ask the API about any job Job → SBOM, trace, provenance Returned by the API Job Packages CycloneDX SBOM Network trace Recorded on every CRACI job, no extra step

Deployment Tracking

Know where your products are and what software they're running. Track device locations, customer deployments, and regional distribution to understand your exposure and plan targeted updates — critical when the CRA requires you to notify users of security issues.

One view across builds and repositories Findings from every build are aggregated across repositories, with organization views on the default branch. The inventory view shows which software versions are deployed to which products. Default branch builds api-service web-app firmware billing Organization view Findings aggregated across builds and repositories 4 repositories, one list of findings Inventory: deployed versions Product Version Web app v4.12.0 Mobile API v2.3.1 Gateway firmware v1.8.4

Version Visibility

See at a glance which firmware and software versions are deployed across your fleet. CRACI tracks version distribution, identifies outdated devices, and highlights fragmentation so you can prioritize rollouts and ensure every product meets current security standards.

Vendor SBOMs tracked next to your own SBOMs from your own builds and SBOMs added from your vendors are monitored in the same place, so bought-in components are re-evaluated against new vulnerabilities alongside your own dependencies. Your builds api-service SBOM web-app SBOM firmware SBOM Your vendors Payment SDK SBOM Camera module SBOM RTOS SBOM Monitored in one place Every SBOM re-evaluated as new vulnerabilities are published Third-party code tracked like your own dependencies Findings triaged and routed to the team that owns the fix

Know your fleet

Book a demo to get complete visibility into your device inventory

Book a demo