Free tools

When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

• Article 14 deadline calculator

  Enter when you found out, see your Early Warning, 72-hour and Final Report deadlines.

• CSIRT coordinator finder

  Look up your country's CDaC: the specific national team ENISA has you report to.

• Is my product in scope?

  Three quick questions to check whether Article 14 reporting applies to you at all.