CSAF 2.0 · Cyber Resilience Act · Made in Germany
Security advisories that arrive.
Secvisory makes you a CSAF trusted provider – without your own infrastructure. Write, review, sign and distribute advisories and meet every CRA deadline.
- Free Starter plan
- Hosted in Germany
- No lock-in
app.secvisory.com/dashboard
Published
128
+12 this month
Subscribers
2,418
+184
Feed requests
41.2k
last 7 days
Feed requests30 days
Latest advisories in the network live
Example CorpSVY-2026-0142TLP:CLEAR9.8 Critical
Nordwerk RoboticsNWR-SA-2026-019TLP:CLEAR7.2 High
Muster MedicalMMA-2026-004TLP:CLEAR6.1 Medium
Demo DevicesDD-2026-077TLP:CLEAR8.6 High
Manufacturers protecting their customers (example logos)
Beispiel Automation
Muster Medical
Demo Devices
Example Networks
Sample Smart Home
Placeholder Software
Muster Industrie
Nordwerk Robotics
Platform
Everything a trusted provider needs
From the first line in the editor to the signed ROLIE feed – in one platform that knows the standard.
Create
CSAF editor with live validation
Guided form, all fields or raw JSON – every input is checked against all CSAF 2.0 tests instantly. Optional AI suggestions speed up descriptions and remediations.
app.secvisory.com/advisories/SVY-2026-0142/edit
GuidedAll fieldsJSON
Title
Authentication bypass in web interface
CVE
CVE-2026-31337
CVSS v3.1
9.8
Product
Controller X200 · Firmware < 4.2.1
Remediation
Update to firmware 4.2.1 or later
Apply AI suggestion?
Validation0/5
- 6.1.1 Missing definition of product ID
- 6.1.7 Multiple scores with same version
- 6.1.13 PURL syntax
- 6.1.27 Profile tests (security advisory)
- 6.3.x Informative tests
Submit for review
Collaborate
Four-eyes approval
No advisory goes out unchecked: authors submit, reviewers approve. Every version stays traceable and immutable.
app.secvisory.com/reviews/SVY-2026-0142
SVY-2026-0142 · Version 2
submitted by Sofia M. · 12 min ago
14"title": "Auth-Bypass im Web-Interface",
15−"cvss_v3": { "baseScore": 8.1 },
15+"cvss_v3": { "baseScore": 9.8 },
16"product_ids": ["CSAFPID-X200"],
17+"remediations": [{ "category": "vendor_fix" }]
TB
Thomas B.: Score now matches the vector. Approved ✓
1 commentSMTB
Distribute
OpenPGP signatures
Every document is signed and hashed. Your own keys, rotation and optional HashiCorp Vault Transit – private keys never leave the signer.
Distribute
Trusted provider distribution
provider-metadata.json, ROLIE feeds, index.txt and changes.csv are maintained automatically – on your own domain under /.well-known/csaf/.
example-corp.csaf.secvisory.com/.well-known/csaf/
/.well-known/csaf/
provider-metadata.json
white/
2026/
svy-2026-0142.json
svy-2026-0142.json.sha512
svy-2026-0142.json.asc
index.txt
changes.csv
feed-tlp-white.json
Canonicalised
SHA-512 created
OpenPGP signed
ROLIE feed updated
CDN invalidated
0x7A3F…C91E
Ed25519 · rotated 2026-09
Distribute
Public security portal
Your brand, your advisories: vendor page with CPE and PURL search, product pages, PDF export, CVD policy and hall of fame.
security.example-corp.com
EC
Example Corp · Security Center
CSAF trusted provider · 128 advisories
pkg:generic/x200@4.2.0
Authentication bypass in web interface
SVY-2026-0142·Controller X200
Buffer overflow in Modbus parser
SVY-2026-0139·Gateway G5
Disclosure of configuration data
SVY-2026-0131·HMI Panel 7
Weak TLS configuration
SVY-2026-0127·Cloud Connector
Compliance
Product catalog & SBOM
The catalog is derived from your product_trees. Version ranges, end of support and SBOMs in CycloneDX and SPDX in one place.
app.secvisory.com/catalog
Product catalogderived from product_tree
Controller X200CycloneDX
4.0.x4.1.x4.2.1
Gateway G5SPDX
2.3.02.4.x
HMI Panel 7End of supportCycloneDX
1.9.x
Collaborate
Subscriptions & notifications
Customers subscribe to vendors or individual products and get notified by email – instantly or as a daily digest.
Notificationslive
New advisory: Controller X200
SVY-2026-0142 · Critical 9.8 · Update available
Daily digest · 3 advisories
Gateway G5, HMI Panel 7, Cloud Connector
Version 2 published
SVY-2026-0139 · Remediation added
Compliance
CRA cases with Art. 14 deadlines
24-hour early warning, 72-hour notification, final report: deadlines run from awareness, reminders arrive automatically, drafts for ENISA are prepared.
app.secvisory.com/cra/cases/CRA-2026-007
CRA-2026-007 · Actively exploited
Awareness: 08 Oct 2026, 06:14
Early warning in
17:42:09
24h
Early warning
72h
Notification
14d
Final report
Case created, time recorded
Early warning draft prepared
Approval by CISO
How Secvisory works
One workflow. From finding to feed.
Scroll through the lifecycle of an advisory.
01 · Create
Write without memorising the spec
The editor guides you through all required fields, validates live and shows errors before they happen.
- Guided, all fields or JSON
- All CSAF 2.0 tests live
- Optional AI suggestions
app.secvisory.com/advisories/SVY-2026-0142/edit
GuidedAll fieldsJSON
Title
Authentication bypass in web interface
CVE
CVE-2026-31337
CVSS v3.1
9.8
Product
Controller X200 · Firmware < 4.2.1
Remediation
Update to firmware 4.2.1 or later
Apply AI suggestion?
Validation0/5
- 6.1.1 Missing definition of product ID
- 6.1.7 Multiple scores with same version
- 6.1.13 PURL syntax
- 6.1.27 Profile tests (security advisory)
- 6.3.x Informative tests
Submit for review
02 · Review
Four eyes see more
Reviewers see changes as a diff, comment and approve. Only then is it published.
- Separate roles
- Immutable versions
- Complete audit log
app.secvisory.com/reviews/SVY-2026-0142
SVY-2026-0142 · Version 2
submitted by Sofia M. · 12 min ago
14"title": "Auth-Bypass im Web-Interface",
15−"cvss_v3": { "baseScore": 8.1 },
15+"cvss_v3": { "baseScore": 9.8 },
16"product_ids": ["CSAFPID-X200"],
17+"remediations": [{ "category": "vendor_fix" }]
TB
Thomas B.: Score now matches the vector. Approved ✓
1 commentSMTB
03 · Distribute
Signed. Hashed. Found.
After approval, signatures, hashes, ROLIE feeds and provider-metadata.json are created – on your domain.
- OpenPGP with key rotation
- /.well-known/csaf/ per vendor
- CDN delivery
example-corp.csaf.secvisory.com/.well-known/csaf/
/.well-known/csaf/
provider-metadata.json
white/
2026/
svy-2026-0142.json
svy-2026-0142.json.sha512
svy-2026-0142.json.asc
index.txt
changes.csv
feed-tlp-white.json
Canonicalised
SHA-512 created
OpenPGP signed
ROLIE feed updated
CDN invalidated
0x7A3F…C91E
Ed25519 · rotated 2026-09
04 · Notify
Customers hear it first
Subscribers are notified instantly or in a digest – exactly for the products they use.
- Subscriptions per vendor or product
- Instant or daily digest
- Public portal with search
Notificationslive
New advisory: Controller X200
SVY-2026-0142 · Critical 9.8 · Update available
Daily digest · 3 advisories
Gateway G5, HMI Panel 7, Cloud Connector
Version 2 published
SVY-2026-0139 · Remediation added
app.secvisory.com/advisories/SVY-2026-0142/edit
GuidedAll fieldsJSON
Title
Authentication bypass in web interface
CVE
CVE-2026-31337
CVSS v3.1
9.8
Product
Controller X200 · Firmware < 4.2.1
Remediation
Update to firmware 4.2.1 or later
Apply AI suggestion?
Validation0/5
- 6.1.1 Missing definition of product ID
- 6.1.7 Multiple scores with same version
- 6.1.13 PURL syntax
- 6.1.27 Profile tests (security advisory)
- 6.3.x Informative tests
Submit for review
By the numbers
Built for the emergency
0h
CRA early warning always in view
0%
CSAF 2.0 tests on every upload
0 min
to your first advisory
0
servers you have to run
Use cases
For every industry with products in the field
From controller manufacturers to SaaS vendors – advisories customers actually use.
Cyber Resilience Act
The clock is ticking. You're prepared.
The CRA requires manufacturers to handle vulnerabilities, disclose them and report actively exploited flaws. Secvisory covers the requirements.
10 Dec 2024
CRA enters into force
Regulation (EU) 2024/2847 becomes EU law.
11 Jun 2026
Conformity assessment bodies
Rules for notifying conformity assessment bodies apply.
11 Sep 2026
Reporting obligations (Art. 14)
Actively exploited vulnerabilities: 24h early warning, 72h notification.
11 Dec 2027
Full application
All requirements apply, including vulnerability handling under Annex I.
Onboarding
Live in four steps
No project, no rollout – one afternoon.
1
Sign up
Create your company and invite your team with roles.
2
Verify your domain
Set a DNS TXT record – your CSAF host is ready.
3
Create an advisory
Write in the editor or upload existing documents.
4
Publish
Approve, sign, distribute – automatically.
Voices
PSIRTs that sleep better at night
We became a CSAF trusted provider in one week. We had expected a year-long project.
Lena Hoffmann
Head of PSIRT · Beispiel Automation GmbH
Four-eyes approval maps exactly to our QM process. Auditors love the audit log.
Thomas Berger
CISO · Muster Medical AG
The editor finds mistakes before anyone else does. Live validation is a game changer.
Sofia Marino
Product Security Engineer · Demo Devices
CRA deadlines don't worry me anymore. The platform reminds us before it gets tight.
Jonas Weber
CTO · Sample Smart Home
Our advisories now come out of the pipeline. No copy & paste, no forgotten fields.
Daniel Kaya
Engineering Lead · Placeholder Software
No lock-in, full export, hosting in Germany – that convinced our procurement team.
Markus Lindner
Compliance Officer · Example Networks
Our customers subscribe to their products themselves. The flood of PDF emails is finally over.
Anna Schulz
Security Program Manager · Muster Industrie
We became a CSAF trusted provider in one week. We had expected a year-long project.
Lena Hoffmann
Head of PSIRT · Beispiel Automation GmbH
Pricing
Fair, transparent, no surprises
Start for free. Grow as your product lines grow.
Starter
For small manufacturers publishing their first CRA-compliant advisories.
0€/ forever
0€/ forever
- up to 3 Products
- 12 Advisories per year
- 2 Users
- CSAF trusted provider on secvisory subdomain
- Public security portal
- OpenPGP signatures
- Four-eyes approval
- Custom domain
- CRA cases & deadlines
- API access
Most popularTry 14 days
Professional
For product teams and PSIRTs that publish regularly.
189€/ month
cancel monthly
157€/ month
billed yearly · 1,884 €/year
- up to 50 Products
- unlimited Advisories per year
- 10 Users
- CSAF trusted provider on secvisory subdomain
- Public security portal
- OpenPGP signatures
- Four-eyes approval
- Custom domain
- CRA cases & deadlines
- API access
Business
For manufacturers with many product lines and the full CRA process.
490€/ month
cancel monthly
408€/ month
billed yearly · 4,896 €/year
- unlimited Products
- unlimited Advisories per year
- unlimited Users
- CSAF trusted provider on secvisory subdomain
- Public security portal
- OpenPGP signatures
- Four-eyes approval
- Custom domain
- CRA cases & deadlines
- API access
Enterprise
On-premises, SLA and dedicated support for large organisations.
Custom
annual contract
Custom
annual contract
- unlimited Products
- unlimited Advisories per year
- unlimited Users
- CSAF trusted provider on secvisory subdomain
- Public security portal
- OpenPGP signatures
- Four-eyes approval
- Custom domain
- CRA cases & deadlines
- API access
All prices excl. VAT. Paying yearly saves about two monthly fees.
FAQ
Frequently asked questions
What is CSAF and why do I need it?
The Common Security Advisory Framework (CSAF 2.0) is an OASIS standard for machine-readable security advisories. The German BSI recommends CSAF, and under the Cyber Resilience Act manufacturers must publish and share information about fixed vulnerabilities. CSAF makes this information automatically processable for customers.
What does “trusted provider” mean?
A CSAF trusted provider publishes advisories following strict rules: over TLS, with provider-metadata.json, signed with OpenPGP, with hash files and ROLIE feeds. Secvisory fulfils these requirements for your domain automatically.
Do I need my own servers or infrastructure?
No. Secvisory runs the complete distribution. You only connect your domain with a DNS record. For companies with special requirements there is an on-premises edition.
Can I migrate existing advisories?
Yes. Upload CSAF JSON files or entire ZIP archives – including all versions. Every document is checked against all CSAF tests on upload.
Is there a free trial?
The Starter plan is free forever. You can try Professional and Business for 14 days without payment details.
How does billing work?
Monthly or yearly by invoice, SEPA direct debit or credit card. Paying yearly saves you about two monthly fees. Upgrades apply immediately, downgrades at the end of the period.
What happens if I exceed my limits?
Nothing is deleted. New objects become possible again after an upgrade; existing advisories stay publicly available.
Where is my data stored?
In data centers in Germany. Tenants are isolated with PostgreSQL row-level security, private keys live only in the isolated signer service or in your Vault. A GDPR data processing agreement is part of every plan.
Can I leave the platform?
Anytime. The full export contains your CSAF directory with hashes and signatures, catalog, SBOMs, cases and audit log. After cancellation, your public presence stays available read-only for 12 months.
Which CRA deadlines does Secvisory support?
For actively exploited vulnerabilities and severe incidents under Art. 14: early warning within 24 hours, notification within 72 hours and a final report. Deadlines start at the moment of awareness, reminders are sent automatically.
Is Secvisory legal advice?
No. Secvisory provides the tools and processes the CRA requires. For the legal assessment of your products we recommend your legal counsel or notified body.
Blog
Knowledge for PSIRTs
Ready for your first signed advisory?
Start for free – no credit card, no servers, no need to memorise the specification.