2026 年每日通報的 CVE 數量比前一年多 131%。

工程主管的 CRA 法規遵循

在維持工程開發速度並符合法規要求的同時，打造安全的產品

整合工程工作流程

將 CRA 法規遵循順暢地整合到您的工程工作流程中，不影響開發速度。CRACI 融入既有的 CI/CD 管線，在每個階段提供自動化的資安檢查與法規遵循驗證。讓您的團隊在維持合規的同時更快交付。

GitHub Actions jobs on CRACI runners A GitHub Actions workflow sets runs-on to craci. Each job runs in its own isolated virtual machine on a CRACI runner, on Linux x86-64 or ARM64, hosted in Europe, and the run still appears in GitHub. .github/workflows/release.yml jobs: build: runs-on: craci was: ubuntu-latest CRACI runners Hosted in Europe Job VM build Linux x86-64 Job VM test Linux ARM64 Job VM publish Linux x86-64 One isolated virtual machine per job, 1 to 32 vCPU Runs still appear in GitHub About 2x GitHub-hosted speed

對開發人員友善的工具

以提升生產力的工具賦能您的工程團隊。CRACI 在開發人員既有的工作流程中提供清楚且可據以行動的回饋。自動化的 SBOM 產生、資安掃描與法規遵循檢查以透明方式進行，無需人工介入。

CRACI runs stay in GitHub Jobs that run on CRACI still appear in GitHub with their runs, logs and pull request checks. The GitHub Actions cache works as before, and CRACI runners use a stable egress IP range for allowlists. Pull request checks build runs-on: craci 1m 12s test runs-on: craci 2m 04s lint runs-on: craci 0m 31s Runs, logs and pull request checks in the usual place GitHub Actions cache as before Stable egress IP range No second pipeline to maintain Workflow files, actions and secrets stay where they are

即時可視性與指標

全面掌握所有專案的資安與法規遵循狀況。CRACI 提供主管儀表板、趨勢分析與 KPI，協助您追蹤進度、找出瓶頸，並向利害關係人與主管機關證明合規。

One view across builds and repositories Findings from every build are aggregated across repositories, with organization views on the default branch. The inventory view shows which software versions are deployed to which products. Default branch builds api-service web-app firmware billing Organization view Findings aggregated across builds and repositories 4 repositories, one list of findings Inventory: deployed versions Product Version Web app v4.12.0 Mobile API v2.3.1 Gateway firmware v1.8.4

技術風險管理

以完整的資料為基礎，對技術風險做出明智的決策。CRACI 找出漏洞、追蹤相依套件，並為元件提供風險評分。有效排定資安工作的優先順序，將工程資源投入最重要的地方。

Vulnerability tracking after release After a release ships, its SBOM stays monitored. When a new vulnerability is published, CRACI re-evaluates the monitored SBOMs, finds the affected releases, and the security team triages the finding and routes it to the team that owns the fix. The inventory view shows which software versions are deployed to which products. Release shipped SBOM monitored Later New advisory published Re-evaluated automatically Finding: critical, in 2 releases 1. Triage 2. Route to owner 3. Team fixes Policy gates can block a build on findings · VEX supported Inventory: deployed versions Product Version Web app v4.12.0 Mobile API v2.3.1

帶領團隊，充滿信心

預約示範，透過 CRACI 簡化工程團隊的法規遵循

預約示範