The EU Cyber Resilience Act sets mandatory cybersecurity requirements for essentially any "product with digital elements" sold into the EU market, with essential requirements covering secure-by-design development, vulnerability handling, and a Software Bill of Materials (SBOM), backed by conformity assessment and market surveillance with real penalties for non-compliance.
We test against the CRA's essential requirements and help you build the SBOM and vulnerability-handling evidence conformity assessment will expect.
We run penetration testing against your product's attack surface, mapped to the CRA's essential cybersecurity requirements — secure defaults, vulnerability handling processes, and technical documentation — and support production of the SBOM and vulnerability-disclosure process the regulation requires alongside the technical testing itself.
Why it matters
The CRA is not a niche standard — it applies horizontally across nearly all connected hardware and software products sold in the EU, and phased enforcement is bringing conformity assessment, market surveillance and real penalties. Manufacturers who have not yet mapped their product against CRA essential requirements are working against a clock that is already running.
What we test
- Product software & firmware penetration testing
- Secure-by-default configuration review
- Vulnerability handling & disclosure process review
- SBOM accuracy & supply-chain dependency review
- Update & patching mechanism security testing
- CRA essential-requirements gap analysis
Common vulnerabilities we uncover
- Insecure default configurations shipped to customers
- No documented vulnerability handling or disclosure process
- Inaccurate or incomplete Software Bill of Materials
- Update mechanisms that can be tampered with or spoofed
- Third-party and open-source components with unassessed risk
- No technical documentation supporting a conformity assessment
Our methodology
- Scoping & rules of engagement. We agree objectives, targets and boundaries for your eu cyber resilience act penetration testing, so testing is safe, authorized and focused on what matters to your business.
- Reconnaissance & mapping. We enumerate the full attack surface in scope, building a complete picture before any exploitation begins.
- Manual exploitation. Our senior testers chain vulnerabilities by hand — going far beyond automated scanners — to prove real, demonstrable impact.
- Analysis & reporting. Every finding is triaged, risk-rated with CVSS and written up with a copy-paste reproduction and clear remediation.
- Remediation support & free retest. We support your team through the fixes and retest the remediated issues to confirm they are genuinely closed.
Tools & techniques
We test the product's software and, where relevant, firmware attack surface against the CRA's secure-by-design and secure-by-default essential requirements, review the vulnerability handling and disclosure process the regulation mandates, and support building a compliant SBOM that reflects your actual software supply chain, not a static snapshot.
When you need this engagement
- You manufacture or sell hardware or software products with digital elements into the EU
- You need to build or validate your Software Bill of Materials
- You are preparing for CRA conformity assessment
- You need a documented vulnerability handling and disclosure process
- A customer or distributor is asking about your CRA readiness
What you receive
- Product penetration test report
- CRA essential-requirements gap analysis
- SBOM review and recommendations
- Vulnerability handling process documentation
- Prioritised remediation roadmap
- Free retest after remediation
What’s included in your report
Every eu cyber resilience act penetration testing engagement concludes with a comprehensive, board-ready report and a working session to walk your team through it. Your report includes:
- An executive summary with overall risk posture for non-technical stakeholders
- Detailed technical findings, each with a step-by-step, copy-paste reproduction
- CVSS v3.1 severity ratings and business-impact context for every issue
- Prioritized, actionable remediation guidance your engineers can apply directly
- A complimentary retest to confirm fixes and update finding status
- A formal attestation letter for customers, auditors and compliance programs
Standards & frameworks
EU Cyber Resilience Act (CRA)
ENISA CRA requirements mapping
Outcomes you can expect
After your eu cyber resilience act penetration testing, you will have clear, evidence-based visibility into your real security risk — not a scanner’s guesswork. You will know exactly which weaknesses an attacker could exploit, what the business impact would be, and the precise steps to fix them in priority order. Teams use our findings to close critical gaps, satisfy customer and regulator security requirements, and demonstrate due diligence to their board. With a complimentary retest included, you also get documented proof that the issues are genuinely resolved.
Engagement details & logistics
Every eu cyber resilience act penetration testing starts with a short, no-obligation scoping call to understand your goals, environment and constraints, followed by a fixed-price proposal and a clear statement of work. Most engagements are delivered fully remotely, with on-site work arranged where it genuinely adds value. Throughout testing we maintain an agreed communication cadence and escalate any critical, high-impact finding to you immediately rather than waiting for the final report. All work is performed under a signed NDA with strict data-handling controls, using safe, non-disruptive techniques and carefully coordinated rules of engagement to protect your production systems. On completion you receive your report and a walkthrough session, followed by a complimentary retest once your fixes are in place. Typical engagements are booked one to three weeks in advance, and urgent or pre-deadline testing can often be accommodated — just ask at hi@agentoffense.com.
Why organizations choose AgentOffense
Our eu cyber resilience act penetration testing is delivered by senior offensive-security engineers who test the way real attackers do — manually, creatively and with a relentless focus on proving genuine, demonstrable impact. Here is what sets our engagements apart:
- Manual, exploit-driven testing that chains vulnerabilities the way a real attacker would, going far beyond what automated scanners can find.
- Reproducible proof for every finding, with copy-paste reproduction steps your engineers can follow and independently verify.
- Honest severity calibration so you invest in fixing what genuinely matters and avoid wasting effort on false positives and noise.
- Clear, business-focused reporting that speaks to engineers and executives alike, tying every issue to real-world impact.
- A complimentary retest included, so you get documented proof that your fixes actually close the attack path.
- Responsible, collaborative delivery with a named point of contact and secure handling of all data throughout the engagement.
Explore related services
EU Cyber Resilience Act Penetration Testing is frequently scoped alongside our other offensive-security services for broader coverage. Explore related engagements that complement it:
- IoT Device Penetration Testing — IoT and embedded device penetration testing — firmware analysis, hardware interfaces, wireless protocols and cloud/app backends…
- Secure Code Review — Manual secure code review backed by SAST — data-flow and taint analysis, secrets detection and insecure-pattern…
- NIS2 Compliance Penetration Testing — NIS2 penetration testing and compliance readiness for EU essential and important entities — Article 21 risk-management…
How much does EU Cyber Resilience Act Penetration Testing cost?
Every eu cyber resilience act penetration testing is scoped and priced individually, so you pay for exactly the coverage you need — with no hidden extras. After a short, no-obligation scoping call we send a fixed-price quote, usually within one business day, with clear deliverables, a firm timeline and a complimentary retest included. The price of your eu cyber resilience act penetration testing depends on the size and complexity of the target and the depth of testing required, so you always know the cost up front before any work begins.
Get a fixed-price quote
Frequently asked questions
What counts as a "product with digital elements" under the CRA?
An intentionally broad category covering nearly any hardware or software product that connects to a device or network, from IoT devices and industrial equipment to standalone software — the CRA applies horizontally rather than to a narrow sector.
Does the CRA require an SBOM?
Yes, manufacturers are expected to produce and maintain a Software Bill of Materials as part of the technical documentation supporting conformity, and we help validate that it actually reflects your product's real dependencies.
Does penetration testing alone satisfy the CRA?
No — testing is one input into a broader secure-by-design, vulnerability-handling and documentation obligation, but it is the technical evidence that shows your essential requirements actually hold under real conditions.
When does this actually need to be in place?
The CRA has phased obligations, with vulnerability-handling and reporting duties applying earlier than full conformity assessment — we help you understand which deadlines apply to your specific product category.