EU CYBER RESILIENCE ACT (CRA) · READINESS AUDIT

The €15M question your board will ask you in 2026.

WeAreFabbrik's 2-week EU Cyber Resilience Act (CRA) readiness audit for software companies in Greece and across the EU. Fixed scope. Fixed price. Board-ready output.

CRA REPORTING DEADLINE
11 September 2026
24-hour reporting of actively exploited vulnerabilities begins
THE PROBLEM

Your board is asking the question. Your engineering team doesn't have the answer.

The EU Cyber Resilience Act enters reporting enforcement on 11 September 2026, with full compliance mandatory by 11 December 2027. Penalties run to €15 million or 2.5% of global turnover — whichever is higher.

Most European software companies — even those with strong engineering teams — have no defensible answer to the question their investors, acquirers, or auditors will ask first: "Are you ready?"

The gap isn't awareness. It's translation — between what regulators wrote and what your engineering team actually ships. That's the work this audit does.

11 Sep 2026

24-hour reporting of actively exploited vulnerabilities to ENISA. Applies to all in-scope products, including legacy.

11 Dec 2027

Full compliance: SBOM, secure-by-design, lifecycle vulnerability handling, technical documentation.

€15M / 2.5%

Maximum penalty under Article 64. Whichever is higher. Applied per infringement.

WHAT YOU RECEIVE

A board-ready package, not a 200-page PDF.

Two weeks of senior engineering leadership applied to your codebase, your processes, and your team. The output is what a fractional CTO would produce after their first 60 days — compressed into a fixed-scope engagement with no ramp.

  1. 01

    CRA Gap Analysis

    Article-by-article assessment of where you stand, mapped to your products. No regulatory copy-paste.

  2. 02

    SBOM & Dependency Exposure

    Full software bill of materials in CycloneDX or SPDX, with vulnerability and license risk surfaced.

  3. 03

    Security Posture Summary

    Plain-English assessment of your real risks, not a CVE dump. Triaged by business impact.

  4. 04

    Architecture & Tech Debt Read

    Where the codebase will resist scaling, where it will hold, and what must change first.

  5. 05

    Team & Process Maturity

    Honest read on delivery capability, ownership gaps, and whether your team can execute the remediation.

  6. 06

    90-Day Remediation Roadmap

    Sequenced, costed, and ownership-tagged. The thing your board will actually approve.

HOW IT RUNS

Two weeks. Zero ambiguity.

  1. Days 1–3

    Discovery

    Repo access, automated scans, kickoff with your CTO and engineering leads. Stakeholder interviews scheduled.

  2. Days 4–7

    Deep analysis

    Architecture review, SBOM generation, security triage, process and team assessment. Live working sessions, not surveys.

  3. Days 8–11

    Synthesis

    Findings consolidated. Roadmap drafted with effort estimates and dependency ordering. Internal review.

  4. Days 12–14

    Readout

    Live presentation to your leadership and board. Final deliverables. Optional: follow-up retainer scoped.

WHO THIS IS FOR

Built for the leaders who own the answer.

CEOs & Founders

You need a defensible answer for your board, your auditors, or your next investor. You can't afford to discover the gap during diligence.

CTOs & VPEs

You know there are gaps. You need an external senior voice to validate priorities and unlock budget for the work you've been pushing for.

PE & VC Investors

You're evaluating a target or a portfolio company. You need engineering ground-truth that goes beyond a vendor's deck and a Snyk dashboard.

Boards & Audit Committees

You need an independent technical assessment that translates engineering risk into financial and regulatory terms — with a credible plan attached.

INVESTMENT

Three tiers. Quoted before signature, never after.

Single Product
€9,500
  • Single product / single repo
  • Team up to 15 engineers
  • Codebase up to 500K LOC
  • 14-day delivery

Best for: early-stage SaaS, single-product startups

Enterprise
€19,500
  • Multi-product / monorepo
  • 30+ engineers
  • Codebase 1M+ LOC
  • 14–18 day delivery (scope-dependent)

Best for: established software companies, PE portfolio targets

All tiers include the full deliverable set and live readout. Travel for on-site readout (if requested) is invoiced at cost. Multi-engagement pricing for PE firms with portfolio rollouts available on request.

WHY ME

20+ years of engineering leadership. Independent. Fast.

I'm Konstantinos Tsolakidis — Fractional CTO and engineering advisor based in Athens, Greece, working with software companies across the DACH region, Luxembourg, and the wider European market. I run this engagement personally end-to-end. No junior associates, no offshore handoff.

  • Senior engineering leadership across TypeScript/Node, React, Rust/Go, and distributed systems (Polkadot ecosystem)
  • Hands-on with the security and supply-chain stack: SBOM tooling, CVE workflows, ENISA reporting frameworks
  • Defense-tech and high-assurance background — built CryptoIFF at the European Defense Tech Hackathon
  • Active fractional CTO engagements with European startups and scale-ups; advisor to PE-backed software companies
  • Founder of WeAreFabbrik OÜ (Estonian-registered), Author of The Builder’s Edge on LinkedIn
FREQUENT QUESTIONS

The quick answers.

Does CRA actually apply to my SaaS product?

SaaS sits primarily under NIS2, not CRA — but CRA captures any "product with digital elements" you ship to the EU, including downloadable software, embedded firmware, and IoT. Most companies have at least one product in scope. We’ll establish that on day one of the engagement.

Do you run CRA audits for companies based in Greece?

Yes — the team is based in Athens, and we run the audit remotely or on-site anywhere in Greece. The CRA is a directly applicable EU regulation, so Greek manufacturers face the same obligations and the same 11 September 2026 reporting deadline as everyone else in the single market, with no national transposition to wait for. In-scope Greek products cluster in marine and shipping tech, industrial IoT and hardware, defence, and payment devices. Working sessions run in Greek or English; deliverables are in English so they travel to boards, acquirers, and notified bodies. Worth noting: ENISA — the EU agency the CRA routes vulnerability reports through — is itself headquartered in Greece.

We already use Snyk / Black Duck / GitHub Advanced Security. Why do I need this?

Those tools generate data. They don't tell you whether your engineering org can pass a regulatory audit, survive due diligence, or execute the remediation. That's the gap this audit fills. We'll work alongside whatever tooling you already have.

What does "From €9,500" mean? When does it go up?

€9,500 covers a single product / single repo / team up to 15 engineers and 500K LOC. Multi-product orgs, monorepos over 1M LOC, or teams above 30 engineers move to €14,500 or €19,500 depending on scope. Quoted before signature, never after.

How is this different from a traditional code audit or pen test?

A pen test finds vulnerabilities in production. A code audit assesses code quality. This audit is broader: it answers whether your engineering organisation — codebase, processes, people, and documentation — can pass CRA scrutiny and survive technical due diligence. It's an organisational assessment, not just a technical one.

What do you need from us to start?

Read access to your primary code repositories, two hours of CTO/engineering lead time across the engagement, and one stakeholder interview each with security, product, and operations leads. We sign a mutual NDA before any access is granted.

What happens after the readout?

You own the deliverables outright. About half of audits convert into a follow-up fractional CTO retainer to execute the remediation; the other half are handed back to internal teams. There's no obligation either way — the audit stands alone.

Reporting obligations start 11 September 2026. Full compliance by 11 December 2027.

Book a 30-minute scoping call. No deck, no pitch — just whether this is the right engagement for you.

info@wearefabbrik.com · Athens, Greece · Berlin · Munich · Zurich · Luxembourg · Tallinn