TactiQ Provision Get a free CVE snapshot
Free for the first ten device makers

Send us your SBOM. We tell you which CVEs the CRA would make you report.

One product, one image. Within two working days you get every known vulnerability in it, the ones already flagged as exploited in the wild, and the five to fix first. No charge and no commitment.

Get a free CVE snapshot See all services
  • Send an SBOM in SPDX or CycloneDX, or the package list of your Yocto image.
  • We delete it after the report. NDA on request.

What you get back

one product, two working days
1
Known CVEsEvery published vulnerability matched against the packages in your image
2
Exploited in the wildThe ones listed in the CISA Known Exploited Vulnerabilities catalog, the closest public signal for what CRA Article 14 makes reportable within 24 hours
3
Five to fix firstOrdered by exposure on your device, with the package version that closes each one
Whether a vulnerability is reportable stays your decision as the manufacturer.
EU Cyber Resilience Act, Article 14

The reporting clock has been running since 11 September 2026.

When a vulnerability in a product you sell in the EU is actively exploited, you must report it to ENISA and your national CSIRT. This applies to manufacturers outside the EU who sell into it, and to products released years ago.

24 hEarly warning
72 hVulnerability notification
14 daysFinal report after the fix is available

Full CRA obligations apply from 11 December 2027.

Embedded Linux security for device makers

Secure Boot that holds up on the production line.

We take Yocto-based devices on NXP i.MX, TI Sitara and Rockchip from a working prototype to a signed, locked boot chain and a provisioning procedure your factory can repeat. Then we keep you ready for EU Cyber Resilience Act reporting for as long as the product is on the market.

See services and prices

What we lock down

each stage verifies the next
1
BootROMChecks the first loader against the key hash fused into the chip
2
SPL / TF-AVerifies the signed U-Boot image
3
U-BootShell disabled, environment fixed, kernel and device tree verified
4
Linux kernelMounts the root filesystem through dm-verity
5
Root filesystemRead-only and checked block by block
Root of trust: public key hash in eFUSE / OTP. Burned once, after your sign-off.
Services and prices

Fixed scope, fixed acceptance tests.

Prices are starting points in euro, excluding VAT. You get a fixed quote after the diagnostic.

Free

CVE snapshot

€0one product, for the first ten device makers. 2 working days
  • Every known CVE in your image, from the SBOM or package list you send
  • Which of them are listed as exploited in the wild
  • The five to fix first, with the versions that close them

We use your SBOM only for this report and delete it afterwards. No commitment to order anything.

CRA reporting readiness

from €9,000per product line, up to 20 working days
  • SBOM for every version you have on the market
  • CVE and VEX analysis built into your CI
  • Disclosure policy and a channel for incoming reports
  • Response runbook, report drafts, ENISA platform registration
  • A 24-hour drill with your team on a real product version

Each further product line on the same build system: from €2,500.

CVE monitoring

from €900per month, per product line
  • Weekly scan of your SBOM against vulnerability databases
  • Monthly triage with VEX: affected or not, and why
  • Same-day alert when a vulnerability in your image is exploited
  • Monthly report and engineering hours for fixes

Six-month minimum. Set-up is free after a diagnostic or integration project.

Secure Boot starts here

Secure Boot diagnostic

€600launch price for our first three clients, then €1,500. 3 working days
  • Your boot chain and trust boundaries as they actually are
  • Bypass attempts and test results
  • Review of U-Boot and every boot interface
  • Fix plan with a fixed quote for integration

You pay after you receive the report. The fee is credited in full against Secure Boot integration if you order it.

Secure Boot integration

from €4,500per board, up to 15 working days
  • Yocto layer that signs bootloader, device tree and kernel on every build
  • U-Boot hardening: no shell, fixed environment, closed boot interfaces
  • Key procedure: generation, storage, backup, revocation
  • Documented eFUSE / OTP procedure for production

Acceptance on your reference board: a signed image boots, a modified image is rejected, the shell is unreachable.

Platforms

Three silicon families, one method.

FamilyMechanismWhat to know
NXP i.MX 6, 7, 8, 8M, 93HABv4 / AHABSigning with the NXP Code Signing Tool, integrated into your Yocto build.
TI Sitara AM62x, AM64xHS-FS → HS-SETI supplies the OTP Keywriter under NDA. You request it from TI; we build the procedure around it.
Rockchip RK3399, RK3568, RK3588eFUSE key hash, signed FITVendor loader binaries need extra care. We plan a few more days for this.
Other SoCsafter diagnosticWe quote only once we have checked your board.
How it starts

No fuse is burned before you sign off.

  1. Tell us the basics

    Product, SoC, Yocto version, and where you sell it.

  2. Diagnostic

    Three working days on your board and build. You get a written report.

  3. Fixed quote

    Scope, timeline and the acceptance tests we will run.

  4. Integration

    Tests pass on your reference board first. Production provisioning follows your approval.

Where our work stops

Clear limits

  • We do not certify products or give legal opinions on CRA conformity.
  • We do not file reports with ENISA for you. Deciding that a vulnerability is exploited and submitting the report stay with you as the manufacturer.
  • We do not burn keys into production units until the procedure has passed on your reference board.
Work you can check

Public record

  • SELinux policy module for the RAUC update service, written by our founder and merged into the SELinux Reference Policy: PR #1181.
  • TactiQ OS public build: SPDX 3.0.1 SBOM, keyless Sigstore signing, Rekor transparency log, 99.94% reproducible builds: repository.

Shipping a Linux device into the EU?

Send your SBOM for a free CVE snapshot. Or tell us the SoC and the product, and we reply with what a Secure Boot diagnostic would cover on your board.

hello@tactiqprovision.com