You do not know how many CVEs your firmware has
Nobody has ever produced a component inventory. The honest answer to "are you affected by this vulnerability?" is "we do not know".
Regulation (EU) 2024/2847, Cyber Resilience Act
Your product has to comply with the CRA. We help you prepare the firmware and the evidence.
SBOM, vulnerability management, secure boot and secure updates for embedded Linux devices. Fixed prices, no surprises.
Since 11 September 2026, reporting actively exploited vulnerabilities is mandatory. On 11 December 2027 the full regulation applies.
Quick Scangateway-fw-2.4.1.wic
| Packages in the SBOM | 1,284 |
| CVEs found | 137 |
| Exploitable on this device | 6 |
| Secure boot | not verified |
| Exposed services | sshd, dropbear, httpd (port 80) |
| Private keys in the image | 2 found |
Report delivered in 31 working hoursPrioritised by EPSS and CISA KEV, not CVSS alone
For manufacturers whose product is already in the field
European companies of 20 to 200 people that build embedded Linux devices and have no security team. If any of these three sounds familiar, let us talk.
Your BSP has not been updated in years
The kernel and U-Boot are whatever the module vendor shipped. Updating is scary because there is no pipeline and no tests to cover it.
Nobody knows what to answer when a customer asks
A large customer, a German distributor or an authority asks for "CRA compliance evidence" and the request sits in an inbox.
CRA
Four steps, each with a fixed price
Start wherever you are. Each step can be bought on its own; none commits you to the next.
CRA Quick Scan
€1,900
Report in 48 working hours
Send us the firmware image or the Yocto artefacts through an encrypted link. You get a report with what actually matters.
Includes
- Full SBOM (SPDX and CycloneDX)
- CVEs with their exploitability on your specific device: exposed services, configuration, whether the component is really used
- Configuration findings: secure boot, services, credentials and keys in the image
- A final page listing the CRA gaps the scan does not cover
- 30-minute review with the engineer
Does not include
- Fixing the findings
- CE marking documentation
100% credited against the audit if you order it within 30 days.
Order a Quick ScanCard payment. By paying you accept the Quick Scan terms.
CRA-Readiness Audit
€9,500
2 to 3 weeks
Where your product stands against each essential requirement of the CRA, and a prioritised plan to get there.
Includes
- Gap analysis against the Annex I essential requirements
- Architecture review: secure boot, OTA, vulnerability management, logging
- SBOM and vulnerability scan
- Prioritised roadmap with effort estimates
- Baseline technical documentation
Does not include
- Implementing the measures
Remediation
€20,000 to €60,000
In phases, 40/30/30 payments by milestone
We implement what the audit flagged, inside your CI and your process.
Includes
- SBOM + CVE pipeline integrated in your CI
- Image signing and secure boot
- Secure OTA updates
- System hardening
- Documentation for the technical file
Does not include
- Third-party certification (we prepare it, we do not issue it)
Continuous compliance
€2,500 to €4,000 per month
Monthly, paid in advance
The CRA is not a one-off: you have to monitor and report. We do it for you.
Includes
- CVE monitoring on your SBOM
- Alerts and prioritised patches
- Monthly report
- Support with notifications to authorities
- +€300 to €500 per month per additional product
Prices exclude VAT.
Quick Scan
How the Quick Scan works
You send the image
Through an encrypted link you upload the image (.wic, .img, rootfs) or the Yocto artefacts: manifest, buildhistory, license.manifest. Under NDA if you need one.
We analyse without executing anything
Extraction in an isolated container with no network. SBOM with Syft, vulnerabilities with Grype and OSV, priority by EPSS and CISA KEV. Then an engineer reviews the device context.
Report in 48 working hours
One-page executive summary, the 10 CVEs that matter and why, full table in the annex, configuration findings and what the scan does not cover of the CRA. Plus 30 minutes to go through it together.
The clock starts on valid receipt of the firmware. Files are deleted after 30 days unless you are on a continuous compliance contract.
Case study
How we prepare firmware already on the market for the CRA
An example from a real customer: a European manufacturer of professional measurement instruments. Product on i.MX8M Plus with Yocto, on the market for years, with no SBOM and no vulnerability process.
Technical evidence prepared and documented in-house. No external audit: for most products, the CRA lets the manufacturer assess conformity through internal control (module A).
The client name will be published once authorised.
- 01SBOM generated from the Yocto build and cross-checked with the manifest
- 02Secure boot with HAB on the i.MX8MP, chain of trust down to the rootfs
- 03TPM for device keys and attestation
- 04CVE pipeline in CI, with a documented prioritisation policy
- 05Tamper-evident logging for the traceability the regulation requires
Why us
The people who know compliance do not know U-Boot. The people who know embedded run from paperwork. Here you get both halves.
Boottrace is run by Toni Quesada, an engineer with more than fifteen years in embedded Linux: Yocto and BitBake, U-Boot, secure boot with HAB and CAAM, TPM, i.MX8 and STM32, product security. He works on the CRA with real products on the market, not slide decks.
- Fixed, visible price before we start
- You talk to the person doing the work, not a sales rep
- Deliverables your team can maintain: pipeline, documentation, nothing proprietary
Embedded Linux engineering
For the same kind of manufacturer, without the compliance part.
BSP maintenance
from €1,500 per month
Kernel, U-Boot and Yocto layers kept current, tested on your hardware.
Secure boot and OTA
fixed-price project from €12,000
Complete chain of trust and secure updates with rollback.
Custom distributions
per project
Yocto or Buildroot tailored to your product, reproducible and documented.
Frequently asked questions
Does the CRA apply to my product?
If you sell in the EU a product with digital elements that connects, directly or indirectly, to another device or a network, almost certainly yes. There are exceptions (medical devices, automotive, aviation) because they already have their own regulation. We confirm it in the 30-minute call.
What is an SBOM and why does the CRA require it?
A machine-readable inventory of every software component in your product, with versions. The CRA requires it so that, when a vulnerability appears, you can tell whether you are affected. Without an SBOM you cannot do vulnerability management or notifications.
What happens if I do not comply?
Fines of up to €15 million or 2.5% of worldwide turnover, product withdrawal from the market and, in practice, losing large customers that already ask their suppliers for evidence.
I use Buildroot or Debian, not Yocto. Does it work?
Yes. The Quick Scan works on the final image, whether it comes from Yocto, Buildroot, Debian or Ubuntu Core. With Yocto we get more context (manifest, buildhistory), but it is not required.
How do I send you the firmware?
After payment you receive an encrypted, single-use upload link. We accept .wic, .img, .ext4, .squashfs, rootfs as .tar and Yocto artefacts. We never execute the image: we only extract it in an isolated container.
What about VAT if I am outside Spain?
EU companies with a valid intra-community VAT number: reverse charge, no VAT on the invoice. Outside the EU: no VAT. In Spain: 21%.
Do you sign an NDA?
Yes, yours or ours, before you send us anything.
Tell us about your product
Two lines are enough. We reply within 24 working hours with a first opinion: whether the CRA applies to you, where to start and what it costs.
- Where
- Barcelona. We work remotely with manufacturers across Europe.
- Languages
- Spanish and English.