2026 年每日通報的 CVE 數量比前一年多 131%。

供應商法規遵循管理

管理整條供應鏈中第三方的資安與法規遵循

第三方資安評估

持續評估並監控供應商的資安態勢。CRACI 協助您評估第三方是否符合 CRA 要求、追蹤供應商的資安認證，並維護最新的供應商資安檔案。確保您的上游供應鏈符合法規標準。

Vendor SBOMs tracked next to your own SBOMs from your own builds and SBOMs added from your vendors are monitored in the same place, so bought-in components are re-evaluated against new vulnerabilities alongside your own dependencies. Your builds api-service SBOM web-app SBOM firmware SBOM Your vendors Payment SDK SBOM Camera module SBOM RTOS SBOM Monitored in one place Every SBOM re-evaluated as new vulnerabilities are published Third-party code tracked like your own dependencies Findings triaged and routed to the team that owns the fix

供應商 SBOM 管理

向所有供應商收集、驗證並追蹤軟體物料清單（SBOM）。CRACI 會彙整供應商的 SBOM，找出整條供應鏈中的漏洞，並讓您全面掌握產品所使用的第三方元件。

Vulnerability tracking after release After a release ships, its SBOM stays monitored. When a new vulnerability is published, CRACI re-evaluates the monitored SBOMs, finds the affected releases, and the security team triages the finding and routes it to the team that owns the fix. The inventory view shows which software versions are deployed to which products. Release shipped SBOM monitored Later New advisory published Re-evaluated automatically Finding: critical, in 2 releases 1. Triage 2. Route to owner 3. Team fixes Policy gates can block a build on findings · VEX supported Inventory: deployed versions Product Version Web app v4.12.0 Mobile API v2.3.1

法規遵循文件入口網站

透過自助式入口網站，簡化供應商法規遵循資料的收集。供應商可直接提交所需的文件、認證與資安評估。自動化的驗證與追蹤，確保您隨時握有最新的法規遵循佐證資料。

SBOMs and build records for each reader SBOMs export as CycloneDX or SPDX, including transitive dependencies and the vulnerabilities found in their components, and the API returns SBOMs, network traces and provenance, so the same record serves customers, auditors and your own tooling. One record SBOMs Vulnerability records Provenance Network traces Exported from CRACI or through the API CycloneDX SBOM SPDX SBOM API: network traces API: provenance Same evidence, every audience No manual assembly between the build and the SBOM SBOMs carry transitive dependencies and vulnerabilities

風險監控與警示

即時監控供應商的法規遵循狀態，並在發生資安事件或法規遵循缺失時立即收到警示。CRACI 會追蹤供應商的漏洞揭露、資安更新，以及可能影響您法規遵循義務的法規變動。

Triage and routing to the owning team A security team triages a discovered vulnerability and sends it to the team that owns the fix. CRACI supports VEX for recording how a vulnerability affects your product. New finding Vulnerable component in shipped builds 3 builds 2 repositories Security team Triages the finding VEX supported Owning team Receives the finding and ships the fix Each finding reaches the people who can act on it Policy gates can block a build on findings, so a known issue does not ship again

保護您的供應鏈

預約示範，了解如何以 CRACI 管理供應商法規遵循

預約示範