ComparisonIndustrial OT and IoT firmware security

ONEKEY vs CVD Portal

Automated firmware security analysis and CRA compliance verification for industrial OT and IoT. How does ONEKEY compare to CVD Portal for an EU manufacturer subject to the Cyber Resilience Act?

Headquarters
Düsseldorf, Germany
Category
Industrial OT and IoT firmware security
Pricing model
Enterprise subscriptions priced on request per firmware image or product family.

How they compare on CRA-critical features

Five differences between an industrial firmware security platform and an end-to-end CRA conformity workspace under Regulation (EU) 2024/2847. The first row is where ONEKEY is stronger.

Feature
ONEKEY
CVD Portal
Binary firmware decomposition and HBOM/SBOM extraction
Core strength. Native binary extraction without source code
Supported via SBOM import (SPDX / CycloneDX). Imports existing scanner output to attach to the Annex I Part II evidence record
Annex III / Annex IV product classification and Article 32 route
Not advertised or manual mapping
Free interactive classifier deciding Article 32 conformity route and applicable essential requirements
Article 13 whitelabel CVD intake portal and public SPOC
Not advertised
Included on Free tier with branded domain, PGP encryption, and 48-hour acknowledgment SLA
Article 14 ENISA SRP 24h / 72h / final reporting cascade
Vulnerability alerting without SRP-ready export packages
Built in with in-product countdown timers and SRP-ready manual filing packages
Annex VII Technical Documentation and EU Declaration of Conformity
Firmware scan evidence for the file, not the legal declaration
Generated per product version with 10-year audit trail and CE marking checklist

Where ONEKEY is strong

  • +Zero-knowledge binary extraction analyzing compiled firmware images and industrial RTOS.
  • +European company based in Germany with native EU data residency.
  • +Strong alignment with IEC 62443 industrial automation standards and ETSI EN 303 645.
  • +Automated compliance reporting and technical file evidence exports for industrial devices.

Where it is not a CRA fit

  • !Pricing is oriented around enterprise device lines and OT asset scanning budgets.
  • !No published free tier for SMEs needing an immediate Article 13 intake and disclosure baseline.
  • !Does not operate as a public whitelabel vulnerability intake portal (RFC 9116 SPOC) for external researchers.
  • !Focus is concentrated on binary and OT firmware rather than horizontal software, SaaS, or general PDEs.

The CRA gap

ONEKEY provides deep binary firmware analysis for industrial OT. The CRA requires an operational compliance system around the product: a public Article 13 disclosure policy and contact channel under the manufacturer's brand, statutory 24h/72h reporting to ENISA/CSIRTs, and the complete Annex VII legal declaration.

Why teams pick CVD Portal for CRA

Five reasons EU manufacturers combine ONEKEY firmware analysis with CVD Portal.

  1. 1

    Whitelabel Article 13 CVD intake portal with RFC 9116 security.txt hosting included on the Free tier.

  2. 2

    Article 14 reporting engine with 24h/72h countdown timers and SRP-ready filing packages.

  3. 3

    Covers pure software and cloud-connected products alongside embedded hardware.

  4. 4

    Generates the official EU Declaration of Conformity and CE marking verification checklist.

  5. 5

    Published transparent pricing starting at €0/month for SME manufacturers.

Frequently asked

How does ONEKEY compare to CVD Portal?
ONEKEY is a binary firmware analysis platform that inspects compiled code for vulnerabilities and generates SBOMs. CVD Portal is a CRA compliance and disclosure platform that manages the public Article 13 intake portal, Article 14 ENISA reporting, and the Annex VII technical file.
Can ONEKEY scan results be imported into CVD Portal?
Yes. ONEKEY produces CycloneDX SBOMs and vulnerability reports that can be uploaded into CVD Portal as verified evidence against CRA Annex I Part II requirements.
Are both ONEKEY and CVD Portal EU-based?
Yes. ONEKEY is based in Germany and CVD Portal is operated by Porta Regulus B.V. in the Netherlands. Both platforms provide native EU data residency.
Does ONEKEY manage researcher vulnerability submissions?
ONEKEY focuses on automated scanning of firmware rather than researcher intake. CVD Portal provides the public-facing single point of contact (SPOC) with PGP encryption and 48-hour acknowledgment tracking required by CRA Article 13.
What is the cost difference?
CVD Portal offers a published Free tier (€0/month) for Article 13 intake and tiered plans from €99/month for Article 14 and full CRA compliance. ONEKEY prices via enterprise quotes per monitored firmware stream.

Turn OT firmware scan results into signed CRA conformity files

Import your ONEKEY SBOM and vulnerability findings into CVD Portal to maintain the legal technical file, run public Article 13 intake, and file Article 14 reports. The Article 13 baseline is €0/month.