Every build is signed, timestamped in a public log and kept in storage that cannot be altered. With every commit, you produce the evidence your auditors and the CRA will ask for.
The Wisec agent gathers the commit, the dependencies, the SBOM and your scanners' results. It runs in your pipeline, on GitLab, GitHub, Azure DevOps or Jenkins. Wisec never clones your repository and has no access to your source control.
The agent signs the whole with your Ed25519 key. The signature covers the build as it is recorded: change a single field afterwards, and the proof no longer holds.
Each build carries the hash of the previous one, so none can be removed without it showing. It is anchored on IPFS and copied to WORM storage for three years. Its SLSA attestation is timestamped in Rekor, Sigstore's public log, and the signed VEX follows the vulnerability analysis.
This build is real. It comes from project_go, one of our test projects, on 4 November 2026 at 21:54 UTC. Verifiable without a Wisec account, with standard tools.
Backed by the French tech and cybersecurity ecosystem.
The Cyber Resilience Act applies to every product with digital elements sold in the Union. Manufacturers will have to show how they handle their vulnerabilities, product by product and over time.
The regulation is published and the countdown starts.
Actively exploited vulnerabilities and severe incidents must be notified.
All requirements apply to products placed on the market.
“Which components does this product contain?”
A signed CycloneDX SBOM for every build, anchored with the rest of the proof.
“Are you affected by this CVE?”
A search across your build history, by component or by vulnerability, and a signed VEX for each decision.
“How do you handle your vulnerabilities?”
A posture measured against your own deadlines, frozen every month in a signed record.
Wisec produces the evidence and maps it to the requirements. It does not issue a certificate of compliance.
contact@wisec.io
Wisec