Features included from Professional: Vulnerability management, compare packages
Vulnerability management
Find known vulnerabilities in your assets, prioritise them in the context of your plants and work through them traceably.
Tens of thousands of vulnerabilities are published every year. What matters is which ones affect your plants and what to do first.
How Complass helps
Matching without data leaving
The software and firmware of your asset inventory is matched against public vulnerability data (NVD, CISA KEV, EPSS, ENISA EUVD). The data is mirrored on the server; your information does not leave the portal.
Imports from scanners, SBOM and VEX
Adopt results from common scanners, software bills of materials (CycloneDX, SPDX) and VEX documents, with preview and undo.
Priority in context
P1 to P4 from severity, exposure and criticality of the asset, active exploitation (KEV) and EPSS, each with reasoning and a deadline.
Recommended measures with source
Vendor advisories and updates from the reference data, added to the action plan as a task with one click.
Vendor security advisories (CSAF)
Upload vendors’ CSAF advisories or have them loaded from selected public feeds: signature and checksum are verified, matches on model and firmware version become findings with the vendor’s measures, without duplicate findings for the same CVE.
Notification and CRA reporting
Email above a threshold, actively exploited vulnerabilities always. If such a vulnerability affects one of your own products, you create the incident under Art. 14 CRA pre-filled.
Legal and normative basis
- § 30 Abs. 2 Nr. 5 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …Open original (gesetze-im-internet.de) ↗
- Anhang I Teil II CRAAnnex I Part II Cyber Resilience Act Vulnerability handling requirementsManufacturers of products with digital elements shall: (1) identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products; (2) in relation to the risks posed to products with digital elements, address and remediate …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- Art. 14 CRAArticle 14 Cyber Resilience Act Reporting obligations of manufacturers1. A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16. 2. For the purposes of …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- ISO/IEC 27001:2022, A.8.8
Prioritise, decide, prove
Not every critical vulnerability is urgent for you. Complass justifies the order and records decisions.
Decision with SSVC
Exploitation, exposure and impact lead to a decision such as “act now” or “fix as scheduled”; the EU list of actively exploited vulnerabilities is taken into account.
Exceptions with four-eyes approval
Rules for justified exceptions, approved by a second person and with an expiry date.
Software catalogue
Define once what a program or device type is called; every new asset is then matched correctly, even without a CPE.
Deadlines with escalation
Reminder before the due date and escalation when it is exceeded.
Linux distribution advisories
Debian, Ubuntu, Alpine, AlmaLinux and Rocky Linux are matched with the package manager’s version comparison. If a fix has been backported, Complass closes the finding itself.
Hardening and detection
Auditors want to see that systems are hardened and that attacks would be noticed. You prove both with data from your tools.
Hardening comparison included from Professional: Hardening comparison, compare packages
Import results from SCAP (XCCDF, ARF), Wazuh SCA or CSV: compliance per asset and baseline, approved deviations with justification.
Log sources included from Professional: Log sources, compare packages
Which systems log where and for how long, as a register with coverage per asset.
Detection coverage with MITRE ATT&CK included from Professional: Detection coverage, compare packages
Your detection use cases per technique as a heatmap: you see where an attack would go unnoticed.
Hardening comparison and log sources belong to the asset management module, detection coverage to the vulnerability management module.
Legal and normative basis
- Art. 21 Abs. 2 lit. b und e NIS2-RichtlinieArticle 21 NIS 2 Directive Cybersecurity risk-management measures1. Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other …Open original (EUR-Lex) ↗
- ISO/IEC 27001:2022, A.8.9, A.8.15, A.8.16
- IEC 62443-3-3, SR 6.2, SR 7.6
Frequently asked questions
Is my asset data sent to the NVD or other services?
No. The portal downloads the public data to its own server and matches there. No information from your inventory is sent out.
Do I need asset management for this?
Yes, matching refers to the software and firmware of the assets. Scanner imports also assign findings to assets.
How do I handle findings that do not apply?
You set the status with a reason, e.g. “not affected”. You adopt vendor statements via VEX import, with the reason.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.