2026 年每日通報的 CVE 數量比前一年多 131%。

生命週期管理

從第一次建置到終止支援，追蹤整個產品組合中的漏洞、修補程式與版本

漏洞監控

持續掃描您裝置群中每個產品版本的 CVE 與資安公告。CRACI 會將新漏洞與您的裝置資產清冊比對，因此當威脅出現時，您能立即知道哪些產品與客戶受到影響，並在它演變成資安事件之前採取行動。

Vulnerability tracking after release After a release ships, its SBOM stays monitored. When a new vulnerability is published, CRACI re-evaluates the monitored SBOMs, finds the affected releases, and the security team triages the finding and routes it to the team that owns the fix. The inventory view shows which software versions are deployed to which products. Release shipped SBOM monitored Later New advisory published Re-evaluated automatically Finding: critical, in 2 releases 1. Triage 2. Route to owner 3. Team fixes Policy gates can block a build on findings · VEX supported Inventory: deployed versions Product Version Web app v4.12.0 Mobile API v2.3.1

修補程式與更新追蹤

追蹤從發現漏洞到部署修補程式的完整修補生命週期。CRACI 會監控哪些產品版本已修補、哪些尚待處理、哪些仍然暴露在風險中，讓您清楚掌握每個版本的資安狀態。

Triage and routing to the owning team A security team triages a discovered vulnerability and sends it to the team that owns the fix. CRACI supports VEX for recording how a vulnerability affects your product. New finding Vulnerable component in shipped builds 3 builds 2 repositories Security team Triages the finding VEX supported Owning team Receives the finding and ships the fix Each finding reaches the people who can act on it Policy gates can block a build on findings, so a known issue does not ship again

版本管理

管理每項產品在整個生命週期中的完整版本歷史。CRACI 會隨時間追蹤韌體版本發布、相依套件變更與 SBOM 的演變，讓您能比較版本、了解變更內容，並將任何元件追溯到引入它的建置。

Provenance data from every build Every job on CRACI records the packages it fetched and its network trace. The public REST API returns the job's SBOMs, network trace and provenance. Build release job on CRACI Recorded packages fetched network trace Provenance build data, via the API Ask the API about any job Job → SBOM, trace, provenance Returned by the API Job Packages CycloneDX SBOM Network trace Recorded on every CRACI job, no extra step

終止支援規劃

在完整掌握影響的情況下，規劃並傳達產品的終止支援（EOL）。CRA 要求製造商在產品的預期使用期間內提供安全性更新。CRACI 協助您追蹤支援承諾、找出即將到來的 EOL 日期，並確保客戶在支援結束前收到通知並完成移轉。

CRA notifications, prepared for you When a vulnerability is actively exploited, the CRA sets deadlines: an early warning within 24 hours, a notification within 72 hours and a final report 14 days after a fix is available. CRACI prepares their content; a person at the manufacturer submits them through the CRA Single Reporting Platform to the CSIRT and ENISA. Actively exploited vulnerability found Aware 24 hours Early warning 72 hours Notification Fix + 14 days Final report CRACI prepares the notification content You submit it through the Single Reporting Platform to the CSIRT and ENISA and shows which products and releases are affected What stays with you The reporting obligation itself Informing affected users Severe incidents: final report within one month

為您的產品提供長期保護

預約示範，端到端管理您的產品資安生命週期

預約示範