To report an exploited vulnerability under the CRA, from 11 September 2026
Regulation (EU) 2024/2847
Cost of the Jaguar Land Rover attack to the UK economy
Cyber Monitoring Centre, 2025
Of breaches involve the supply chain, up 60% in twelve months
Verizon DBIR 2026
Unique zero-days disclosed at Pwn2Own Automotive 2026
Pwn2Own Automotive 2026
Four things that decide whether an audit costs a release.
In-house code, supplier binaries and open-source packages each need a different kind of check: SAST, SCA, DAST, binary analysis. One platform runs all of them on a single severity scale, so four tools and four severity models collapse into one count of open findings.
The source stays with the supplier, so acceptance testing runs on trust. Binary analysis reads the deliverable itself, and two suppliers become comparable on the same numbers.
An advisory lands on a component that shipped two model years ago. A CycloneDX SBOM sits on every scan in the project history, so the affected-versions answer takes minutes.
An audit asks what was scanned, who reviewed it and when. Every finding already carries all three, so audit preparation becomes a download.
Static analysis of manufacturing execution systems, plant SAP pipelines and dealer management platforms.
A supplier ships a binary and a promise, and acceptance testing has nothing to measure. Binary analysis reads the deliverable directly, so procurement compares two suppliers on the same numbers.
Most critical advisories sit several layers below the package a team declared. SCA resolves the full dependency tree, call-graph analysis keeps only the paths the application reaches, and remediation starts there instead of on every advisory in the backlog.
Hover any card to see how DerScanner handles it.
Select a framework to see which capability produces the artifact.
A certified Cybersecurity Management System covering the lifecycle and the supply chain. Mandatory for all new vehicles in UNECE markets since July 2024.
Scanning across embedded, infotainment, backend and supplier code, with an event log on every finding.
Scan history and event log per project.
A certified Cybersecurity Management System covering the lifecycle and the supply chain. Mandatory for all new vehicles in UNECE markets since July 2024.
Scanning across embedded, infotainment, backend and supplier code, with an event log on every finding.
Scan history and event log per project.
An OEM answers for software that dozens of suppliers wrote.
Review supplier deliverables without asking for the source code.
Talk to us about type approvalA supplier signs security terms in every OEM contract and answers for them at every review.
Hand the OEM a scan report along with the delivery.
Talk to us about supplier evidenceA head unit on Android Automotive, AGL or QNX ships with an OTA channel straight into the field.
Ship a head unit release without a separate mobile security cycle.
Talk to us about infotainmentOne API holds position, diagnostics and driver identity for the entire installed base.
Catch an API flaw before it reaches the whole fleet.
Talk to us about connected servicesCharge points sit outside the vehicle, carry payments, and drew fire at Pwn2Own Automotive three years running.
Cover firmware, backend and payments without three separate tools.
Talk to us about charging systemsTeams already shipping with DerScanner
When looking for the scanner to build our secure development process on, we evaluated the capabilities of global leading vendors. We were surprised with the very convenient licensing model along with the impressive capabilities of the product. DerScanner is an optimal solution to our main challenge of checking the health of our product's code.
DerScanner discovered potential weaknesses that would have been difficult or even impossible to find, even in long-standing, mature code. I definitely recommend DerScanner if you are serious about the security of your code and the apps you create.
We use DerScanner to support our secure code review and SAST services. Its broad language support, reliable static analysis, and actionable findings help our consultants deliver consistent, high-quality security assessments.
Yes. DerScanner deploys fully on-premise, including air-gapped environments with no outbound access. Scanning, AI triage and code fix generation all execute inside the perimeter, which matters when a joint development agreement restricts where pre-production source code may travel. DerTriage and DerCodeFix are local modules, and no code or finding is sent to an external model.
Binary analysis reads .dll and .exe components built from C and C++, iOS packages, and Java, Kotlin, Scala and Android bytecode. The deliverable goes in as the supplier shipped it, and findings come back mapped to CWE and OWASP, in the same report and on the same severity scale as in-house code. Two suppliers then measure against the same benchmark, which gives an acceptance review something concrete to reference at contract renewal.
No tool grants type approval. R155 asks for a certified Cybersecurity Management System covering the lifecycle and the supply chain, and DerScanner supplies the software verification evidence inside it: scan records tied to commits, findings with named owners and timestamps, a CycloneDX SBOM per release, and export-ready reports. ISO/SAE 21434 names static code analysis among software verification methods in Section 10.4, and that is the part DerScanner covers. Reports download or go out by e-mail to a list of recipients straight from the interface.
C and C++ on Linux and Windows targets, plus Rust. The same 43-language platform covers Java and Kotlin in infotainment, Go and Python in telematics backends, and Swift, Kotlin and Dart in companion apps. Inter-module analysis follows data across compilation units, so a tainted value passed between modules stays visible where a file-level review would lose it.
Scans run incrementally on changed files at commit, so scan time tracks the size of the change. A full pass stays on the schedule set per release branch. DerScanner integrates with GitHub, GitLab, Bitbucket, Jenkins and Azure DevOps, so a finding lands in the pipeline that produced it and the fix goes in before the next build.
CycloneDX, generated on every scan from the project manifest. Coverage spans Java, Kotlin and Scala through Maven, Gradle and Ivy; JavaScript and TypeScript through npm, yarn and pnpm; Python, Go, Rust, Dart, Ruby, PHP, C# and VB.NET, Objective-C and Swift through CocoaPods, Erlang, and C and C++ through Conan. The dependency tree resolves to full depth, so transitive packages that never appear in a manifest still show up in the inventory. Reports export to PDF, HTML, CSV and JSON.
A CVE in a dependency does not always mean the application calls the vulnerable function. Hybrid SAST and SCA analysis builds a call graph from application code through to transitive dependencies and confirms which vulnerable functions are reachable. With hundreds of open advisories in the backlog, that separates the handful of paths leading into a shipped vehicle.
From 11 September 2026, a manufacturer of a product with digital elements sends an early warning within 24 hours of learning that a vulnerability in that product is being actively exploited, a full notification within 72 hours, and a final report within 14 days. Meeting a 24-hour window means already knowing which shipped release contains which component. SCA generates that inventory as a CycloneDX SBOM on every scan and keeps checking it against new CVE disclosures.
Request a demo, or run a proof of concept on one codebase. The component nobody has been able to scan makes the best candidate: the supplier binary with no source, the C module in the gateway, the dependency tree behind the head unit. That component says more about coverage in a week than a greenfield service says in a month.
Prefer email? company@derscanner.com