To report an exploited vulnerability under the CRA, from 11 September 2026
Regulation (EU) 2024/2847
Cost of the Jaguar Land Rover attack to the UK economy
Cyber Monitoring Centre, 2025
Of automotive open-source dependencies carry a known vulnerability
DerScanner Automotive Benchmark 2026
Of the critical flaws we found were transitive
DerScanner Automotive Benchmark 2026
Four things that decide whether an audit costs a release.
In-house code, supplier binaries and open-source packages each need a different kind of check: SAST, SCA, DAST, binary analysis. One platform runs all of them on a single severity scale, so four tools and four severity models collapse into one count of open findings.
The source stays with the supplier, so acceptance testing runs on trust. Binary analysis reads the deliverable itself, and two suppliers become comparable on the same numbers.
An advisory lands on a component that shipped two model years ago. A CycloneDX SBOM sits on every scan in the project history, so the affected-versions answer takes minutes.
An audit asks what was scanned, who reviewed it and when. Every finding already carries all three, so audit preparation becomes a download.
Static analysis of manufacturing execution systems, plant SAP pipelines and dealer management platforms.
A supplier ships a binary and a promise, and acceptance testing has nothing to measure. Binary analysis reads the deliverable directly, so procurement compares two suppliers on the same numbers.
We resolved 13,205 dependencies across 61 automotive open-source components and found 257 critical vulnerabilities, every one of them transitive and none declared in a manifest. Call-graph analysis narrows that list to the paths carrying risk into the vehicle, and remediation starts there.
Read the benchmarkHover any card to see how DerScanner handles it.
Select a framework to see which capability produces the artifact.
A certified Cybersecurity Management System covering the lifecycle and the supply chain. Mandatory for all new vehicles in UNECE markets since July 2024.
Scanning across embedded, infotainment, backend and supplier code, with an event log on every finding.
Scan history and event log per project.
A certified Cybersecurity Management System covering the lifecycle and the supply chain. Mandatory for all new vehicles in UNECE markets since July 2024.
Scanning across embedded, infotainment, backend and supplier code, with an event log on every finding.
Scan history and event log per project.
61 components from KUKSA, COVESA and Velocitas, resolved to full dependency depth. Every finding traces to a public advisory, and the full report ranks all 61 by name.
Read the benchmarkdependencies resolved
critical vulnerabilities found
of them transitive, none in a manifest
separate dependency chains pulled in each critical flaw on average
critical flaws per npm component on average
of components resolved completely clean
The type approval holder answers for code that dozens of suppliers wrote.
Review supplier deliverables without asking for the source code.
Talk to us about type approvalEvery OEM contract now carries a security clause, and every review asks what was scanned.
Hand the OEM a scan report along with the delivery.
Talk to us about supplier evidenceA head unit on Android Automotive, AGL or QNX ships with an OTA channel straight into the field.
Ship a head unit release without a separate mobile security cycle.
Talk to us about infotainmentOne API holds position, diagnostics and driver identity for the entire installed base.
Catch an API flaw before it reaches the whole fleet.
Talk to us about connected servicesCharge points sit outside the vehicle, carry payments, and drew fire at Pwn2Own Automotive three years running.
Cover firmware, backend and payments without three separate tools.
Talk to us about charging systemsTeams already shipping with DerScanner
When looking for the scanner to build our secure development process on, we evaluated the capabilities of global leading vendors. We were surprised with the very convenient licensing model along with the impressive capabilities of the product. DerScanner is an optimal solution to our main challenge of checking the health of our product's code.
DerScanner discovered potential weaknesses that would have been difficult or even impossible to find, even in long-standing, mature code. I definitely recommend DerScanner if you are serious about the security of your code and the apps you create.
We use DerScanner to support our secure code review and SAST services. Its broad language support, reliable static analysis, and actionable findings help our consultants deliver consistent, high-quality security assessments.
Yes. DerScanner deploys fully on-premise, including air-gapped environments with no outbound access. Scanning, AI triage and code fix generation all execute inside the perimeter, which matters when a joint development agreement restricts where pre-production source code may travel. DerTriage and DerCodeFix are local modules, and no code or finding is sent to an external model.
Binary analysis reads .dll and .exe components built from C and C++, iOS packages, and Java, Kotlin, Scala and Android bytecode. The deliverable goes in as the supplier shipped it, and findings come back mapped to CWE and OWASP, in the same report and on the same severity scale as in-house code. Two suppliers then measure against the same benchmark, which gives an acceptance review something concrete to reference at contract renewal.
No tool grants type approval. R155 asks for a certified Cybersecurity Management System covering the lifecycle and the supply chain, and DerScanner supplies the software verification evidence inside it: scan records tied to commits, findings with named owners and timestamps, a CycloneDX SBOM per release, and export-ready reports. ISO/SAE 21434 names static code analysis among software verification methods in Section 10.4, and that is the part DerScanner covers. Reports download or go out by e-mail to a list of recipients straight from the interface.
C and C++ on Linux and Windows targets, plus Rust. The same 43-language platform covers Java and Kotlin in infotainment, Go and Python in telematics backends, and Swift, Kotlin and Dart in companion apps. Inter-module analysis follows data across compilation units, so a tainted value passed between modules stays visible where a file-level review would lose it.
Scans run incrementally on changed files at commit, so scan time tracks the size of the change. A full pass stays on the schedule set per release branch. DerScanner integrates with GitHub, GitLab, Bitbucket, Jenkins and Azure DevOps, and plugins for VS Code and JetBrains show findings in the editor, so a fix lands before the code reaches the build.
CycloneDX, generated on every scan from the project manifest. Coverage spans Java, Kotlin and Scala through Maven, Gradle and Ivy; JavaScript and TypeScript through npm, yarn and pnpm; Python, Go, Rust, Dart, Ruby, PHP, C# and VB.NET, Objective-C and Swift through CocoaPods, Erlang, and C and C++ through Conan. The dependency tree resolves to full depth, which matters on this stack: in our automotive benchmark every critical vulnerability was transitive and no manifest declared any of them. Reports export to PDF, HTML, CSV and JSON.
A CVE in a dependency does not always mean the application calls the vulnerable function. Hybrid SAST and SCA analysis builds a call graph from application code through to transitive dependencies and confirms which vulnerable functions are reachable. With hundreds of open advisories in the backlog, that separates the handful of paths leading into a shipped vehicle.
From 11 September 2026, a manufacturer of a product with digital elements sends an early warning within 24 hours of learning that a vulnerability in that product is being actively exploited, a full notification within 72 hours, and a final report within 14 days. Meeting a 24-hour window means already knowing which shipped release contains which component. SCA generates that inventory as a CycloneDX SBOM on every scan and keeps checking it against new CVE disclosures.
Request a demo, or run a proof of concept on one codebase. The component nobody has been able to scan makes the best candidate: the supplier binary with no source, the C module in the gateway, the dependency tree behind the head unit. That component says more about coverage in a week than a greenfield service says in a month.
Prefer email? company@derscanner.com