2026 年每日通報的 CVE 數量比前一年多 131%。

資安團隊的 CRA 法規遵循

為您 CRA 流程中的供應鏈環節，提供建置時佐證資料、漏洞監控與分級研判

持續資安監控

每當有新漏洞公開，CRACI 都會重新評估您已出貨產品的受監控 SBOM，並彙整各建置與儲存庫的檢測結果。CRACI 是記錄器，而不是掃描器：每份 SBOM 都來自建置實際下載的內容，並附有完整性狀態。違反對外連線（egress）政策時會發出警示。

Vulnerability tracking after release After a release ships, its SBOM stays monitored. When a new vulnerability is published, CRACI re-evaluates the monitored SBOMs, finds the affected releases, and the security team triages the finding and routes it to the team that owns the fix. The inventory view shows which software versions are deployed to which products. Release shipped SBOM monitored Later New advisory published Re-evaluated automatically Finding: critical, in 2 releases 1. Triage 2. Route to owner 3. Team fixes Policy gates can block a build on findings · VEX supported Inventory: deployed versions Product Version Web app v4.12.0 Mobile API v2.3.1

漏洞分級研判

資安團隊研判所發現的漏洞，並轉交給負責修正的團隊；CRACI 支援 VEX。它會顯示您哪些建置、儲存庫與產品含有易受攻擊的元件，讓您知道每項檢測結果適用於何處。

Triage and routing to the owning team A security team triages a discovered vulnerability and sends it to the team that owns the fix. CRACI supports VEX for recording how a vulnerability affects your product. New finding Vulnerable component in shipped builds 3 builds 2 repositories Security team Triages the finding VEX supported Owning team Receives the finding and ships the fix Each finding reaches the people who can act on it Policy gates can block a build on findings, so a known issue does not ship again

資安事件應變與追蹤

當漏洞遭積極利用時，CRACI 會備妥 CRA 通報的內容（早期預警、通報與最終報告），供您提交。其資產清冊檢視會顯示哪些軟體版本部署在哪些產品上，API 則會回傳 SBOM、網路追蹤記錄與來源證明（provenance），供您留存。

CRA notifications, prepared for you When a vulnerability is actively exploited, the CRA sets deadlines: an early warning within 24 hours, a notification within 72 hours and a final report 14 days after a fix is available. CRACI prepares their content; a person at the manufacturer submits them through the CRA Single Reporting Platform to the CSIRT and ENISA. Actively exploited vulnerability found Aware 24 hours Early warning 72 hours Notification Fix + 14 days Final report CRACI prepares the notification content You submit it through the Single Reporting Platform to the CSIRT and ENISA and shows which products and releases are affected What stays with you The reporting obligation itself Informing affected users Severe incidents: final report within one month

軟體供應鏈安全

每份 SBOM 都依據建置實際取用的內容記錄，包括從 CI 快取還原的套件。執行器上的對外連線政策會限制建置可連線的目標，在作業開始前完成驗證，並採失效即封鎖（fail closed）；API 會回傳 SBOM、網路追蹤記錄與來源證明。廠商提供的 SBOM 也會與您自己的建置一併監控。

An egress policy on the build network A build job connects to hosts in its egress policy, such as package registries and Git, and a connection to a host outside the policy is blocked. The policy is validated before the job starts and fails closed, and a violation sends an alert. Egress policy Default deny Validated before the job starts Fails closed · 24 source presets Build job on a CRACI runner npm registry allowed PyPI allowed Git over HTTPS allowed Unapproved host blocked Alert on policy violation Connections are recorded in the job's network trace

強化您的資安防護態勢

預約示範，了解如何以 CRACI 強化資安維運

預約示範