EU CYBER RESILIENCE ACT · ART. 14 · APPLIES 11 SEP 2026
An actively exploited vulnerability in your product will mean an early warning to the authorities within 24 hours — then 72 hours, then a final report. Aisthetix is the monitoring and reporting engine that makes those clocks survivable. Built for small IoT and Maschinenbau manufacturers.
Free scans, no account. Your CycloneDX or SPDX JSON runs through the same live pipeline our tenants use — OSV.dev, CISA KEV, EUVD. If anything in your stack is being actively exploited, you see the Art. 14 clock it would start. Demo data is purged after 48 hours.
You have 24 hours to report this.You have 72 hours to report this.
You already build an SBOM in CI. Aisthetix takes it from there — the same engine runs in your pipeline, in our EU cloud, and air-gapped on your bench.
Parses CycloneDX 1.4–1.6 and SPDX 2.2/2.3, matches components purl-first against OSV.dev,
CISA KEV and ENISA EUVD, scores CVSS v3.1 and speaks ecosystem version rules — semver,
Debian EVR, RPM. --fail-on gates your CI; offline mode runs air-gapped.
$ aisthetix scan build/sbom.cdx.json --fail-on kev
Upload an SBOM per product version; scans run as async jobs on a Postgres
SKIP LOCKED queue. Findings keep their triage state across rescans — a human decision
is never overwritten by a robot. Every read is tenant-scoped, every action lands in the audit log.
OSV bulk archives bootstrap the advisory cache; modified_id.csv deltas keep it
current. Changed advisories trigger targeted rescans — only the SBOMs whose match keys
overlap, found with one indexed query. No nightly full-fleet rescan theatre.
The KEV catalog is diffed on every cycle. A CVE entering "known exploited" flips your affected findings in one pass — ransomware-campaign flags included — and your PSIRT is emailed immediately. Under Art. 14, actively exploited is the phrase that starts the clock.
Exploited findings alert immediately; everything else arrives as a daily digest. Delivery goes through the job queue — SMTP with retry and backoff — so an alert is a record, not a hope.
The 24-hour clock starts when you become aware. We make sure "aware" happens on our watchfloor — not in a customer call, not in a headline.
This is the actual product loop: feed deltas come in, only affected SBOMs get rescanned, KEV escalations go out as immediate alerts, and CRA deadline reminders escalate until you mark the milestone submitted.
When you determine you're aware of an actively exploited vulnerability or a severe incident, you open a case. From that moment Aisthetix runs the legal clock — you keep the judgement, we keep the time.
A human opens the case. KEV escalation notifies you — it never starts a legal clock on its own.
Exploitation indication, member states affected. Submit, mark, the clock advances.
Product info, nature of the exploit, corrective measures taken and available to users.
14 days after a corrective measure, or one month after an incident notification.
[TODO]. A draft says ready only when it is.CRA Annex I requires a coordinated vulnerability disclosure policy and a
contact address. Every Aisthetix tenant gets a public intake portal and a generated
security.txt — live today.
/cvd/<your-slug>: your policy text and a structured
report form that works with no JavaScript and no reporter account.security.txt generated for your own domain.Service first, product always — both engagements run on the platform you just scrolled through. Free while we onboard our first design partners.
FREE — EARLY ACCESS
Pricing to be announced.
security.txt + intake portalFREE — EARLY ACCESS
Pricing to be announced.
BUILT IN THE EU · HOSTED IN THE EU (FRANKFURT) · YOUR SBOMS ARE PROCESSED AND STORED IN THE EU.