Cyber Resilience Act Penetration Testing. Evidence for Your CRA Technical File.
StealthNet delivers Cyber Resilience Act penetration testing for connected products: devices, firmware, companion apps and the cloud APIs behind them. Every finding is mapped to Annex I, and the report is formatted for your Annex VII technical documentation. First report in 48 hours, human-validated, at a fixed fee. The CRA does not use the words penetration test. It requires products to ship with no known exploitable vulnerabilities and requires effective and regular tests and reviews of security across the support period. A pentest report is the most direct evidence for both.
Last reviewed:
Reporting obligations live since 11 Sep 2026 · Full application 11 Dec 2027
Get Your CRA Pentest Scoped in 24 Hours
Share a few details and pick a time to chat right after.
Rather skip the form?
Book a 30-minute scoping call insteadTrusted by Companies Where Security Isn't Optional
What customers say
Highly recommend StealthNet AI
"StealthNet AI performed a thorough and comprehensive pen test, fast turnaround on conducting the test, they were very responsive, and it was great value."
Richard B.
Founder · Avara Software · Health, Wellness & Fitness
The best choice for penetration testing
"The testing was thorough and the reports were structured precisely for the regulatory requirements. Explanation of issues along with steps to reproduce and remediation advice were detailed and clear, making corrections a breeze."
Jeremy M.
Director · IKO Corp · Medical Devices
Does the Cyber Resilience Act require penetration testing?
Not by name. The CRA requires products with digital elements to ship with no known exploitable vulnerabilities (Annex I Part I) and requires manufacturers to apply effective and regular tests and reviews of security for the whole support period (Annex I Part II). A dated penetration test report is the most direct evidence for both, and it belongs in the technical documentation described in Annex VII.
What is the EU Cyber Resilience Act?
The Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity requirements for products with digital elements placed on the EU market, including the remote data processing solutions they need to function. It entered into force on 10 December 2024 and applies in stages.
When does the CRA apply?
10 Dec 2024
Regulation enters into force
11 Jun 2026
Provisions on notification of conformity assessment bodies apply
11 Sep 2026
Article 14 reporting obligations apply
11 Dec 2027
All remaining obligations apply
Which products are in scope?
- IoT and consumer electronics
- Industrial and OT equipment
- Drones and robotics
- Firmware
- Desktop and mobile software
- The cloud backends and APIs those products depend on
What is out of scope?
- Medical devices and IVDs. See FDA medical device penetration testing.
- Motor vehicles
- Certified civil aviation products and marine equipment
- Products developed exclusively for national security or defence
- Pure SaaS that is not part of a product, which falls under NIS2 instead
EU financial entity testing sits under DORA. See DORA penetration testing.
What must be reported under the CRA, and how fast?
Actively exploited vulnerabilities and severe incidents, reported through ENISA's single reporting platform.
24 hours
Early warning
72 hours
Notification
14 days / 1 month
Final report: 14 days after a corrective measure is available (vulnerabilities), or one month (incidents)
How a Pentest Maps to CRA Requirements
Why CRA Testing Can't Wait Until 2027
2027 sounds far off. Reporting is live now.
Article 14 obligations have applied since 11 Sep 2026. An exploitable flaw found by an attacker first starts a 24 hour reporting clock.
Standards aren't final.
No harmonised standards are cited in the Official Journal yet, so your evidence has to stand on its own.
Product security labs are slow and priced for enterprises.
StealthNet returns a fixed-fee quote in 24 hours and a first report in 48 hours.
From product scope to Annex I mapped evidence in days
Scope the device, firmware, app and cloud, AI agents map the attack surface, a senior tester validates exploitability, and you receive an Annex I mapped report for your technical file.
Confidential · Sample
From kickoff to auditor-ready report, delivered in 48 hours.
What We Test for CRA
Device and firmware
Firmware, interfaces and local protocols on the product itself.
Companion and desktop apps
Mobile and desktop software that controls or configures the product.
Cloud backend and APIs
The remote data processing the CRA covers: the services your product needs to function.
Update and provisioning path
How updates are built, signed, distributed and installed, and how devices are onboarded.
SBOM known-vulnerability check
The components you declare, checked against known vulnerabilities.
Authentication and secure defaults
Default credentials, access control and out-of-the-box configuration.
How Much Does a CRA Penetration Test Cost?
Fixed fee, quoted before any work begins.
Hybrid (AI + Human) Pentest
$5,000 to $10,000
Fixed fee, quoted before any work begins
- AI attack simulation plus senior US-based OSCP tester validation
- Device, firmware, companion app and cloud API surface
- Findings mapped to Annex I
- Report formatted for Annex VII technical documentation
- Free retest included
Best for: Pre-release evidence for your CRA technical file
StealthStrike (AI-Only)
$1,500
Single small scope: 1 role, one target. Larger or multi-role scopes move to Hybrid or a custom quote.
- 48-hour delivery, AI-only testing
- Exploit-validated findings
- App and API surface coverage
- Useful between releases
Best for: Regular testing between releases
Quarterly / Continuous Bundle
Custom quote
- Scheduled testing across the support period
- Retest after every fix
- Dated report series for your technical file
Best for: Support-period testing for product lines
What moves the number
Single app or API
One companion app or one API. Lands near the bottom of the range.
Device + app + cloud
The device, its companion app and the cloud backend it needs. The most common CRA scope.
Product family
Several products or a full line. Quoted above the range.
Which one counts as technical file evidence?
StealthStrike is good for regular testing between releases. It is AI-only, so we do not position it as standalone evidence for your technical file, and we will tell you so on the call. For evidence you put in front of a notified body or a market surveillance authority, use Hybrid.
CRA Readiness Checklist
Twelve Annex I Part I requirements. Tick what you can already prove.
Annex I Part I readiness
0 of 12 confirmed
Items drawn from Annex I Part I of Regulation (EU) 2024/2847. Not legal advice.
Is StealthNet a notified body?
No. StealthNet is not a notified body. We do not issue conformity assessments, EU declarations of conformity or CE marks, and we do not give legal advice. Our report is evidence you place in your technical file or hand to your notified body. Confirm your product class and obligations with counsel or a notified body.
Cyber Resilience Act Questions
Connected Product Penetration Testing Services
Every compliance pentest pulls from these test-type services as needed. Scope is sized to your environment, not padded with hours.
Get Your CRA Pentest Scoped in 24 Hours
Share a few details and we'll follow up within one business day.
Rather skip the form?
Book a 30-minute scoping call instead