Use cases

One firmware analysis, three first questions

Whoever builds devices, runs them or manages them for customers asks the firmware a different question first. The analysis underneath is the same.

Free CRA readiness check

The same report

What each reader reads first

The analysis is the same for everyone. The legal reference in the report follows your role: CRA Annex I for manufacturers, § 30 BSIG (Germany's NIS2 implementation) for operators.

Device manufacturers

SBOM as CycloneDX or SPDX
Vulnerabilities per component
Actively exploited vulnerabilities first
Hardening per binary
Findings against CRA Annex I
Findings against § 30 BSIG
One report per device to hand on

Critical infrastructure operators

SBOM as CycloneDX or SPDX
Vulnerabilities per component
Actively exploited vulnerabilities first
Hardening per binary
Findings against CRA Annex I
Findings against § 30 BSIG
One report per device to hand on

Managed service providers

SBOM as CycloneDX or SPDX
Vulnerabilities per component
Actively exploited vulnerabilities first
Hardening per binary
Findings against CRA Annex I
Findings against § 30 BSIG
One report per device to hand on

From the analysis	Device manufacturers	Critical infrastructure operators	Managed service providers
SBOM as CycloneDX or SPDX
Vulnerabilities per component
Actively exploited vulnerabilities first
Hardening per binary
Findings against CRA Annex I
Findings against § 30 BSIG
One report per device to hand on

read first also in the report not in the report

What goes in

Any industry, because it comes down to the file

LegacyMind reads Firmware images with Linux, bare-metal microcontroller builds (ELF and AXF, for example from Keil, IAR or GNU Arm) and your suppliers' SBOMs in CycloneDX or SPDX. The exact formats are listed under Formats.

Start with one file

In the free CRA readiness check we analyse one firmware of your choice. You get the report and SBOM within three working days.

Free CRA readiness check Book a call