← Back to productsLevel 2 - Product sheet

Cerbercode

Software Objlab - OBJ-CERB-001 da 4.800 €/anno

Level 3 - Commercial request

This sheet summarizes value, pricing and use cases. From here you can move to the dedicated areas or to the client portal for the next action.

On-premise security scanning and compliance suite for software with digital components: 18+ scanners (SAST, SCA, SBOM, secret detection even on binaries, quality, architecture, IaC, containers) orchestrated into a single product, enriched CVEs (NVD, CISA KEV, EPSS) and automatic generation of technical dossiers. A single tool for CRA, NIS2, ISO 27001, IEC 81001-5-1 (medical devices) and EN 50742.

What it solves

Conformita' al Cyber Resilience Act entro dicembre 2027 senza assemblare 5+ vendor
SBOM, matching CVE and enrichment (real CVSS, CISA KEV, EPSS) to be managed manually
Technical file CRA (Annex IV/V) and Declaration of Conformity to be produced manually
The source code must not leave the company perimeter (on-premise, air-gapped)

Cerbercode does not reinvent analyzers: it orchestrates 12+ established tools (Bandit, ESLint-security, Semgrep, SpotBugs+FindSecBugs, Security Code Scan, OWASP Dependency-Check, pip-audit, npm-audit, Flawfinder, Checkov, detect-secrets), normalizes their output to SARIF 2.1.0 + CycloneDX 1.5, deduplicates findings across tools and maps them to Cyber Resilience Act requirements. It runs scanners in parallel (full or diff mode vs base ref), produces merged SARIF + SBOM + triageable findings in DB, aggregates per project and tenant with dashboards, historical trends and CVE/GHSA registry (workflow open->fixed), and generates the CRA Annex V technical dossier in PDF with declaration of conformity and published SBOM/VDP via standard endpoint.

18+ open-source and proprietary scanners orchestrated in parallel, including the analysis of executables. All outputs are normalized to SARIF 2.1.0 and merged into a single document, with cross-tool deduplication via stable fingerprint (file + line + CWE + rule).

Category	Integrated Tools	Target
SAST (static analysis)	Bandit, Semgrep, ESLint-security, njsscan, Flawfinder, SpotBugs+FindSecBugs, Security Code Scan	Python, JS/TS, Java, C#, C/C++
SCA (dependencies and CVEs)	pip-audit, npm-audit, OWASP Dependency-Check, dotnet-list-vulnerable, Grype	PyPI, npm, Maven, NuGet, multi-ecosystem
Universal SBOM	Syft	Python, npm, Maven, NuGet, Gem, Cargo, Go, Composer, deb/rpm/apk
Container image	Grype (image target)	Docker / OCI image
Secret detection	detect-secrets, Gitleaks, binary-secrets	Credentials/keys hardcoded in sources and in the executables (PE/ELF/Mach-O, .NET assembly)
Code quality	lizard (code-quality)	Cyclomatic complexity, function length and parameters (multi-language)
Architecture	module-arch	Dependency graph between modules, circular dependencies (Python, JS/TS, Java, C#)
IaC scanning	Checkov	Terraform, CloudFormation, Kubernetes, Helm, Dockerfile

How to Adopt

Setup (~15 min) — create the project, indicate the repository, compile the case file metadata (product name, CRA classification, manufacturer).
Scanning — manual, scheduled or automatic via GitHub Action / GitLab CI. Output: normalized findings, SBOM, merged SARIF.
Triage — SLA dashboard with filters for severity, tool, real CVSS, KEV, fix-available; bulk-assign and bulk-status. Optional AI advisory.
Vulnerability management — enrichment of CVEs from NVD (real CVSS), CISA KEV ('actively exploited') and EPSS; cross-project registry with open -> fixed lifecycle.
Dossier — automatic generation of technical case files (CRA Annex V, IEC 81001-5-1, EN 50742 Software Evidence), Declaration of Conformity and Vulnerability Handling Policy.
Submission package — complete ZIP ready for submission to the Notified Body / Notification Body.

Key Features

Parallel Orchestrator with timeout for scanners and diff mode (only changed files vs base ref, for fast CI).
Executable Analysis: inventory of components and secret scanning also from binaries (.exe/.dll/.jar), not just sources - where detect-secrets and gitleaks don't reach.
Triage Carry-over: a decision (false positive, accepted risk) propagates to subsequent scans.
SBOM Explorer interactive: sunburst for ecosystem, treemap of packages with more CVEs, drill-down, license inventory.
Automatic Vulnerability Enrichment: NVD + CISA KEV + EPSS, with local cache.
Triage Workflow with SLA by severity, email digest and webhook (Slack/Teams).
Native CI/CD: standalone CLI, official GitHub Action (SARIF in Code Scanning + PR comment), snippets GitLab/Azure/Jenkins.
Issue Tracker: creation of Jira / GitHub issues directly from findings.
MSP Multi-Tenant: cockpit "Customer Dashboard" with aggregated security posture cross-client, aggregated CVE registry cross-tenant and executive summary AI (also via local Ollama, air-gapped).
Optional AI-assisted Triage (Claude or local Ollama, air-gapped) - always advisory, never automatic.

Architecture

Backend FastAPI (Python 3.12) stateless, PostgreSQL for immutable data and audit logs, scanners invoked as subprocess CLI. Self-contained: no external microservices (no Dependency-Track, SonarQube Server or vendor SaaS). Air-gapped friendly, with local Ollama AI triage and optional NVD fetch.

Requirements (order of magnitude)

OS: Linux (recommended) or Windows. Python 3.12+, PostgreSQL 15+.
Hardware (PMI single-tenant): 4+ cores, 8+ GB RAM, ~50 GB disk.
Deploy: bare-metal (uvicorn + nginx), Docker Compose, or air-gapped.

Compliance & regulations

CRA

Cyber Resilience Act (Reg. UE 2024/2847)

13 essential requirement dell'Annex I mappati a CWE e scanner. EU Declaration of Conformity (Annex IV), Vulnerability Handling Policy (Annex I Sec. 2), SBOM CycloneDX e submission package ZIP pronti per il Notified Body.

NIS2

Direttiva NIS2 (UE 2022/2555)

10 misure di gestione del rischio (art. 21) mappate a scanner: risk analysis, supply chain security, cryptography, logging/monitoring, MFA/TLS e altre, con indicazioni operative su cosa resta al produttore.

ISO 27001

ISO/IEC 27001:2022 Annex A

13 controlli tecnici automatizzabili: A.8.8 gestione vulnerabilita' (allineamento full), A.8.25/A.8.28 secure development & coding, A.8.24 crittografia, A.5.7 threat intelligence (NVD + CISA KEV + EPSS) e altri.

IEC 81001-5-1

IEC 81001-5-1 — Software di dispositivo medico

Verticale MedTech: 17 requisiti (12 automatizzati) per la cybersecurity del software di dispositivo medico, con integrazione IEC 62304 (gestione SOUP) e FDA Section 524B (SBOM). Dossier 'Medical Device Software Cybersecurity' pronto per Organismo Notificato / FDA.

EN 50742

EN 50742 — Software Evidence

Dossier verticale con sezione Software Evidence: metriche di manutenibilita' (qualita' del codice) e grafo delle dipendenze tra moduli (architettura) a supporto delle evidenze di sicurezza del software.

Reports & dossiers

Report tecnicoHTML + PDF
Review interno del team dev/security
Report executiveHTML + PDF (1 pagina A4)
Briefing per il management
Report interattivoHTML self-contained (offline)
Consegna al cliente, navigabile con filtri
Export totale scanZIP (findings + SBOM + SARIF + report)
Audit e second opinion
Dossier CRA Annex VHTML + PDF
Allegato al fascicolo tecnico CRA
EU Declaration of Conformity (Annex IV)HTML + PDF
Marcatura CE
Vulnerability Handling PolicyHTML + PDF
Annex I Sec. 2 - policy del produttore
Submission packageZIP (tutto-in-uno)
Consegna al Notified Body / autorita'

Try it

Cerbercode in quattro passaggi

Dai dodici analizzatori al fascicolo tecnico dell'Allegato V, passando per la deduplica e il punteggio di conformita'.

Frequently asked questions

Do we need to replace the analyzers we are already using?

No, and it wouldn't be a good idea either. Cerbercode does not reinvent analyzers: it orchestrates twelve already established ones — including Bandit, Semgrep, SpotBugs with FindSecBugs, OWASP Dependency-Check, pip-audit, Checkov, and detect-secrets — and normalizes their results into a single format. What changes is not the tool that scans but rather the fact that the results arrive in one place, deduplicated across different tools and linked to regulatory requirements.

Che cosa produce di concreto per il Cyber Resilience Act?

Il fascicolo tecnico dell'Allegato V in PDF, con lo scoring di conformità sui tredici requisiti dell'Allegato I, la dichiarazione di conformità e la distinta dei componenti software in formato CycloneDX. Il registro delle vulnerabilità si esporta in CSV per ENISA e le autorità nazionali, con lo storico delle date di scoperta, notifica e risoluzione che il regolamento richiede.

Se marchiamo un problema come falso positivo, lo ritroviamo alla scansione dopo?

No. In Cerbercode le decisioni di triage sopravvivono alle scansioni successive, perché l'aggancio è su un'impronta stabile del problema e non sul numero di riga. Un file che si sposta o del codice riformattato non fanno riemergere quello che avevate già chiuso.

Si integra con GitHub o Azure DevOps?

Sì. Cerbercode produce SARIF 2.1.0, che è il formato che GitHub, Azure DevOps e Sonar leggono nativamente: i risultati compaiono negli strumenti che il team già usa, senza integrazioni su misura.

Quali linguaggi copre?

Python, JavaScript and TypeScript, Java, C#, C and C++, plus infrastructure as code. For dependencies it covers the ecosystems PyPI, npm, NuGet and Maven.

Il nostro codice esce dalla nostra rete?

No. Cerbercode si installa presso di voi, e l'installazione nativa on-premise richiede circa mezz'ora. Gli analizzatori girano sulle vostre macchine e il codice sorgente non lascia la vostra infrastruttura.

Try it Client area — download Parla con un esperto

Use cases

Dossier CRA in 1 click

PMI software: conformita' CRA pronta per il Notified Body

Fascicolo tecnico Annex V, EU Declaration of Conformity e SBOM CycloneDX generati automaticamente e raccolti in un submission package ZIP.

10 misure NIS2 mappate

Operatore di servizi essenziali: misure tecniche NIS2

SAST, SCA cross-ecosystem e SBOM continui mappati alle misure di gestione del rischio dell'art. 21 della Direttiva NIS2.