Security testing for manufacturing and connected products
Continuous testing mapped to the EU Cyber Resilience Act and NIS2, with the SBOM and vulnerability-disclosure evidence those regulations expect.
RedStrike is a continuous security testing and cloud posture platform for manufacturers and companies shipping products with digital elements. It maps findings to the EU Cyber Resilience Act (Regulation (EU) 2024/2847, Annex I), the NIS2 Directive (Article 21(2)), ISO/IEC 27001:2022, and the OWASP Top 10, and generates software bills of materials in CycloneDX and SPDX with OpenVEX applicability statements. Both the CRA and NIS2 are mapped on findings from application, API, and network testing; neither has native cloud-resource checks, and the coverage table below says so.
The problem
Why connected products changed the compliance question
Regulation moved from how you run your IT to what you ship, and how you tell customers about it afterwards.
The Cyber Resilience Act regulates the product
Annex I sets security requirements for products with digital elements and expects vulnerability handling across the supported lifetime — including a software bill of materials and a way to report and disclose vulnerabilities.
You inherit your suppliers' vulnerabilities
A connected product is mostly other people's code. Without a current bill of materials, a disclosed vulnerability in a component turns into an audit of your own build system to find out whether you shipped it.
NIS2 pulls manufacturers into scope
The directive covers manufacturing sectors as important entities, with Article 21(2) setting risk-management measures and management accountability behind them.
Product teams and IT security use different tools
The estate that builds the product and the product itself are usually secured by separate teams with separate evidence, and the regulator increasingly asks about both.
How RedStrike helps
Product-security evidence, generated rather than assembled
SBOM generation, applicability statements, and control mapping are shipped features.
SBOM generation
Software bills of materials are produced in CycloneDX and SPDX and correlated with scan findings, so the component inventory and the vulnerability list are the same artefact rather than two that disagree.
OpenVEX applicability
OpenVEX documents record which disclosed vulnerabilities actually affect your build. A CVE present in a dependency but not reachable in your product is stated as such, in a format your customers' tooling can read.
CRA and NIS2 mapping
Findings carry Cyber Resilience Act Annex I and NIS2 Article 21(2) references, so testing output lines up with the requirement text rather than needing a translation layer.
Container and IaC scanning
Container images and infrastructure-as-code are scanned alongside the application, covering the build and deployment path that the product ships through.
Exploitability-weighted triage
CISA KEV membership and EPSS probability weight the queue, so a supported product's finite maintenance capacity goes to the vulnerabilities being exploited.
Continuous over the supported lifetime
Scheduled scanning keeps testing running for as long as the product is supported, which is the window the Cyber Resilience Act's vulnerability-handling obligations actually cover.
Compliance coverage
Which frameworks this maps to — and exactly how far the mapping goes
The Cyber Resilience Act and NIS2 are mapped on findings from application, API, and network testing. Neither has native cloud-resource checks — cloud accounts are graded against CIS Foundations benchmarks, and Prowler does not currently ship CRA or NIS2 rulesets.
| Framework | Edition mapped | Cloud coverage |
|---|---|---|
| Cyber Resilience ActEuropean Union | 2024/2847 | Mapped on findings from application, API, and network testing. No native cloud-resource checks — pair with CIS benchmark grading for cloud evidence. |
| NIS2European Union | 2022/2555 | Mapped on findings from application, API, and network testing. No native cloud-resource checks — pair with CIS benchmark grading for cloud evidence. |
| ISO/IEC 27001ISO/IEC | 2022 | Native cloud-resource checks on AWS. Azure and GCP are graded against CIS benchmarks instead. |
| OWASP Top 10OWASP Foundation | 2025 | Mapped on findings from application, API, and network testing. No native cloud-resource checks — pair with CIS benchmark grading for cloud evidence. |
| OWASP API Security Top 10OWASP Foundation | 2023 | Mapped on findings from application, API, and network testing. No native cloud-resource checks — pair with CIS benchmark grading for cloud evidence. |
| SOC 2AICPA | 2017 | Native cloud-resource checks on AWS. Azure and GCP are graded against CIS benchmarks instead. |
Every cloud account is graded against CIS Foundations benchmarks on AWS, Azure, GCP, and Kubernetes clusters against the CIS Kubernetes benchmark, regardless of which frameworks above apply to you. Evidence can be exported as a report or pushed into Vanta or Drata.
How it works
From connected to evidence in four steps
Define scope
Add the domains, APIs, and cloud accounts in scope, with rules of engagement recorded before any test runs.
Test continuously
Application, API, network, container, and cloud checks run on a schedule instead of once a year, so drift is caught within a scan cycle.
Verify & de-duplicate
Findings from multiple tools are correlated into one issue, evidence is collected, and severity is scored so the list you read is the list that matters.
Export evidence
Results are mapped to framework controls and exported as a report, or pushed into Vanta or Drata.
Outcomes
What changes once this is running
- Hold a current software bill of materials for every product build, in CycloneDX or SPDX.
- Answer 'are we affected by this CVE' with an OpenVEX document instead of an investigation.
- Map testing output directly to Cyber Resilience Act Annex I and NIS2 Article 21(2).
- Keep vulnerability handling running across a product's supported lifetime, not just at launch.
- Cover the product and the infrastructure that builds it in one programme.
Related
Go deeper on the parts that matter to you
Continuous Pentesting
Always-on, verified offensive testing across apps, APIs, and network — not a once-a-year snapshot.
Learn more →Cloud Security (CSPM)
CIS-benchmarked posture across AWS, Azure, and GCP, with drift caught inside a scan cycle.
Learn more →Compliance
How findings become control-mapped audit evidence, and which editions are pinned to your engagement.
Learn more →FAQ
Frequently asked questions
Common questions about RedStrike for Manufacturing.
Does RedStrike make my product Cyber Resilience Act compliant?
No product does. The CRA places obligations on manufacturers covering design, vulnerability handling, reporting, and documentation across the support period. RedStrike addresses the testable and evidenceable parts: continuous security testing mapped to Annex I requirements, software bills of materials in CycloneDX and SPDX, and OpenVEX statements recording which vulnerabilities apply. Conformity assessment and reporting duties remain yours.
Are CRA and NIS2 checked against cloud resources?
No. Both are mapped onto findings from application, API, and network testing. Prowler, which performs the cloud-resource auditing, does not currently ship CRA or NIS2 rulesets — cloud accounts are graded against CIS Foundations benchmarks instead. When those rulesets exist, they are added to the registry and this page updates with it.
What formats are the SBOMs produced in?
CycloneDX and SPDX, the two formats customers and regulators most commonly ask for. SBOMs are correlated with scan findings so component inventory and vulnerability status stay consistent with each other.
Can RedStrike test embedded devices or firmware directly?
Not directly. The engine covers web applications, APIs, network services, containers, infrastructure-as-code, cloud accounts, and mobile applications. A connected product's cloud backend, management interfaces, and APIs are in scope; firmware binary analysis is not. If your product's risk sits in firmware, say so early — we would rather scope it honestly than oversell.
How does this help with supplier and customer questionnaires?
A current SBOM plus an OpenVEX applicability statement answers most of what a customer questionnaire asks about component risk, and control-mapped reports export in PDF, HTML, JSON, CSV, SARIF, and OSCAL.
Does the ISO 27001 mapping use the current edition?
The application-side mapping uses ISO/IEC 27001:2022 Annex A by default. Note that the native cloud ruleset for ISO 27001 is the 2013 edition, because that is the edition Prowler ships; the coverage table and reports label superseded editions explicitly rather than printing a bare framework name.
Ship connected products with evidence attached
CRA and NIS2 mapping, SBOMs, and applicability statements from one continuous programme.