For software companies in the EU & US
AI-assisted vulnerability analysis of your source code, validated by security engineers. You get a report your CTO can act on and your EU Cyber Resilience Act evidence file can include.
The EU Cyber Resilience Act turns security from a nice-to-have into a requirement for selling products with digital elements in the EU. A code audit helps you address part of Annex I.
| EU CRA requirement | What the law says | What the audit covers |
|---|---|---|
| Annex I, Part II - vulnerability handling | “Regularly test and review the security of the product” | The report is documented evidence that security testing was carried out. |
| Annex I, Part I - known vulnerabilities | “Placed on the market without known exploitable vulnerabilities” | We find and describe exploitable vulnerabilities before the product ships. |
| Annex I, Part I - access control | “Protection from unauthorised access, including authentication and authorisation issues” | Authorization and business-logic flaws are exactly what we look for in the code. |
“Regularly test and review the security of the product”
The report is documented evidence that security testing was carried out.
“Placed on the market without known exploitable vulnerabilities”
We find and describe exploitable vulnerabilities before the product ships.
“Protection from unauthorised access, including authentication and authorisation issues”
Authorization and business-logic flaws are exactly what we look for in the code.
The audit report is a technical assessment and supporting evidence; it is not a CRA conformity assessment or certification.
| Criteria | SAST scanners | Manual review | Pentest | DigVel audit |
|---|---|---|---|---|
| Speed | Minutes | Weeks | 1-3 weeks | 1 working week |
| Cost | Low | High | Medium | Fixed, $3,200 |
| Business-logic depth | Shallow | Good | Limited | Deep |
| Result reliability | Many false positives | High | High | Expert-validated |
| Scales to large codebases | Yes | Poorly | Poorly | Yes |
Indicative comparison; actual results depend on the product and the vendor.
Input: a read-only repository. Three steps over 1 working week, all included in the fixed price.
Architecture analysis, identification of modules and entry points, and a threat model with testing goals.
Result: Threat model and code map
Multi-round, methodical scanning of the codebase along different attack vectors.
Result: Vulnerability candidates
A qualified security engineer reviews every finding, rates its severity, and filters out false positives.
Result: Report with validated vulnerabilities
Code is available to us only for the duration of the project.
Your code is available to us only for the duration of the project and is deleted together with the virtual machine it was analyzed in.
A mutual NDA is signed before any work begins and before we receive repository access.
AI environments are tightly restricted: storage, session context access, and material exchange are all locked down.
DigVel holds Cyber Essentials accreditation, and the engineers reviewing your code are certified security professionals.
The analysis is static: real user data, load, and availability of your live systems stay safe throughout the work.
A technical artifact that evidences vulnerability testing for EU CRA and is clear to your CTO. Your team can verify and close every vulnerability on its own.
One finding as it appears in a report (illustrative example)
src/api/documents/handler, lines 84-97$3,200
1 working week
Custom quote
Based on the number of confirmed vulnerabilities
If your team is overloaded, we manually reproduce the vulnerabilities found in Phase 1 on a controlled test environment that you provide, only with your consent and only for the agreed findings.
Ask about Phase 2We sign the NDA - the contract is ready.
You grant read-only access to the repository.
We start the audit.
Within 1 working week you receive the report.
Tell us about your product. We'll send an NDA and schedule your 1-week audit.