KROMSE
KROMSE is a cybersecurity platform that scans software, firmware, and SBOMs to identify known vulnerabilities and prepare fixes with documented evidence. The platform translates technical findings into plain-English explanations, generates CRA-ready compliance workflows, and uses an AI assistant called Rook to draft pull requests that require human approval before merging.
- Cybersecurity
- Regulatory & Compliance Technology
- Developer Tools
- Software Only
- Artificial Intelligence
- AI Agents
Funding
Founders
Founder details are not available yet.
Product
Problem
Product security teams shipping software and firmware face pressure to demonstrate compliance with regulations like the EU Cyber Resilience Act (CRA), which requires documented evidence of vulnerability handling. Traditional vulnerability scanners generate raw technical findings that lack the context needed for compliance decisions, forcing teams to manually reconcile scanner output with affected products, legal review, and audit-ready records.
Solution
KROMSE connects repositories and SBOMs to vulnerability intelligence, producing findings with evidence and coverage limits that teams can trace back to the source. The platform generates SBOMs in CycloneDX format, matches components against vulnerability advisories, and presents findings in plain English rather than raw technical output. Workflows structure the results into CRA response cases, report drafts, and audit trails, with human review and approval built into every stage before anything moves externally. The service is hosted in the EU and offers AI-assisted review as an optional layer, subject to usage allowances.
Target Audience
Primary customers are product security engineers, legal reviewers, and compliance teams at small and mid-sized software organizations preparing for CRA compliance, as well as freelancers and enterprises with product portfolios.
Features
- Connect a repository at a pinned commit with read-only access, or upload an SBOM to generate a traceable vulnerability scan
- Automatic SBOM generation in CycloneDX format from resolved dependency trees
- Findings written in plain English with sourced evidence paths from source file to affected version
- CRA-focused workflow tools for product impact review, response cases, report drafts, and audit history within an organization's own tenant
- Optional scheduled OSV checks for supported SBOM components on paid plans
- AI-assisted review for priority findings, chat, and verdicts with deterministic-only mode that never sends source code to AI providers
- Free plan supports one product with two scans per rolling 30 days and a 7-day retention of scan artifacts