WeAreFabbrik's 2-week EU Cyber Resilience Act (CRA) readiness audit for software companies in Greece and across the EU. Fixed scope. Fixed price. Board-ready output.
The EU Cyber Resilience Act enters reporting enforcement on 11 September 2026, with full compliance mandatory by 11 December 2027. Penalties run to €15 million or 2.5% of global turnover — whichever is higher.
Most European software companies — even those with strong engineering teams — have no defensible answer to the question their investors, acquirers, or auditors will ask first: "Are you ready?"
The gap isn't awareness. It's translation — between what regulators wrote and what your engineering team actually ships. That's the work this audit does.
24-hour reporting of actively exploited vulnerabilities to ENISA. Applies to all in-scope products, including legacy.
Full compliance: SBOM, secure-by-design, lifecycle vulnerability handling, technical documentation.
Maximum penalty under Article 64. Whichever is higher. Applied per infringement.
Two weeks of senior engineering leadership applied to your codebase, your processes, and your team. The output is what a fractional CTO would produce after their first 60 days — compressed into a fixed-scope engagement with no ramp.
Article-by-article assessment of where you stand, mapped to your products. No regulatory copy-paste.
Full software bill of materials in CycloneDX or SPDX, with vulnerability and license risk surfaced.
Plain-English assessment of your real risks, not a CVE dump. Triaged by business impact.
Where the codebase will resist scaling, where it will hold, and what must change first.
Honest read on delivery capability, ownership gaps, and whether your team can execute the remediation.
Sequenced, costed, and ownership-tagged. The thing your board will actually approve.
Repo access, automated scans, kickoff with your CTO and engineering leads. Stakeholder interviews scheduled.
Architecture review, SBOM generation, security triage, process and team assessment. Live working sessions, not surveys.
Findings consolidated. Roadmap drafted with effort estimates and dependency ordering. Internal review.
Live presentation to your leadership and board. Final deliverables. Optional: follow-up retainer scoped.
You need a defensible answer for your board, your auditors, or your next investor. You can't afford to discover the gap during diligence.
You know there are gaps. You need an external senior voice to validate priorities and unlock budget for the work you've been pushing for.
You're evaluating a target or a portfolio company. You need engineering ground-truth that goes beyond a vendor's deck and a Snyk dashboard.
You need an independent technical assessment that translates engineering risk into financial and regulatory terms — with a credible plan attached.
Best for: early-stage SaaS, single-product startups
Best for: Series A/B scale-ups, growing platforms
Best for: established software companies, PE portfolio targets
All tiers include the full deliverable set and live readout. Travel for on-site readout (if requested) is invoiced at cost. Multi-engagement pricing for PE firms with portfolio rollouts available on request.
I'm Konstantinos Tsolakidis — Fractional CTO and engineering advisor based in Athens, Greece, working with software companies across the DACH region, Luxembourg, and the wider European market. I run this engagement personally end-to-end. No junior associates, no offshore handoff.
SaaS sits primarily under NIS2, not CRA — but CRA captures any "product with digital elements" you ship to the EU, including downloadable software, embedded firmware, and IoT. Most companies have at least one product in scope. We’ll establish that on day one of the engagement.
Yes — the team is based in Athens, and we run the audit remotely or on-site anywhere in Greece. The CRA is a directly applicable EU regulation, so Greek manufacturers face the same obligations and the same 11 September 2026 reporting deadline as everyone else in the single market, with no national transposition to wait for. In-scope Greek products cluster in marine and shipping tech, industrial IoT and hardware, defence, and payment devices. Working sessions run in Greek or English; deliverables are in English so they travel to boards, acquirers, and notified bodies. Worth noting: ENISA — the EU agency the CRA routes vulnerability reports through — is itself headquartered in Greece.
Those tools generate data. They don't tell you whether your engineering org can pass a regulatory audit, survive due diligence, or execute the remediation. That's the gap this audit fills. We'll work alongside whatever tooling you already have.
€9,500 covers a single product / single repo / team up to 15 engineers and 500K LOC. Multi-product orgs, monorepos over 1M LOC, or teams above 30 engineers move to €14,500 or €19,500 depending on scope. Quoted before signature, never after.
A pen test finds vulnerabilities in production. A code audit assesses code quality. This audit is broader: it answers whether your engineering organisation — codebase, processes, people, and documentation — can pass CRA scrutiny and survive technical due diligence. It's an organisational assessment, not just a technical one.
Read access to your primary code repositories, two hours of CTO/engineering lead time across the engagement, and one stakeholder interview each with security, product, and operations leads. We sign a mutual NDA before any access is granted.
You own the deliverables outright. About half of audits convert into a follow-up fractional CTO retainer to execute the remediation; the other half are handed back to internal teams. There's no obligation either way — the audit stands alone.
Book a 30-minute scoping call. No deck, no pitch — just whether this is the right engagement for you.
info@wearefabbrik.com · Athens, Greece · Berlin · Munich · Zurich · Luxembourg · Tallinn