Who we are
SecureByDesignLabs is a security engineering lab. We measure what software makers actually publish and ship, put the results out in the open, and help app and connected-product teams turn security obligations into evidence they can file.
Most of our work today is on the EU Cyber Resilience Act (CRA): what it asks of app and software teams, who it covers, and what evidence shows that an obligation is met.
What we do
Measure and publish
Every month we check thousands of app publishers and connected-device makers for basic security readiness, and publish the results with the method and its limits.
Build free tools
Tools that answer a specific question from data: whether the CRA applies to your product, how connected-device makers compare, and whether a dependency or a patch is safe to take on.
Produce evidence for your app
A gap report that traces every obligation to its article or annex, a register of the third-party components you ship, and the documents the regulation expects you to keep.
Who it’s for
- App and software teams that sell into the EU, including UK companies.
- Makers of connected devices whose app is part of the product.
- Engineers making patch and dependency decisions who would rather decide from data than from opinion.
How we work
- Quote the regulation, don’t paraphrase it. Each finding sits next to the clause it answers, quoted from the Official Journal text of Regulation (EU) 2024/2847.
- Measure from the outside, and say so. Our datasets come from what makers publish themselves: store listings, websites and security.txt files. Each yes or no is a check that either found something or didn’t. When a site blocks our request for its security.txt file, that answer is left out rather than counted as a failure. A few other failed checks, such as a request that times out, are currently recorded as not found, which can make a published rate lower than the real one.
- Date every number. Each figure carries the date it was measured and the method behind it. Advisories are checked against OSV and the CISA known-exploited catalogue, with the date of the check.
- Measure again. Our readiness datasets are re-measured every month, and the published figures are refreshed after each run.
- Engineering, not law. We produce engineering evidence and plain-English guidance. That is not legal advice or a conformity assessment, and it confers no CE marking.
What we publish
Data
- Security contacts across European app publishersOver 5,000 publishers in 30 European App Store markets, measured monthly
- Connected-Device Readiness ExplorerReport routes, support periods and DMARC for over 500 device makers, measured monthly
- IntelligenceSecurity patch impact, dependency adoption and commercial vendor retention
- The Engineering Data Products DirectoryAn objective comparison of the data tools engineers use
Guides and samples
- CRA compliance checklist for software and app teamsWhat applies now, and what applies from December 2027
- Your mobile SBOM is wrong in three specific waysWhat we found when we checked our own
- All Cyber Resilience Act articles and toolsGuides, data and free tools in one place
Talk to us
Questions about our data, a correction, or a project you’d like evidence for: email support@securebydesignlabs.com.
Engineering evidence and plain-English guidance on Regulation (EU) 2024/2847, not legal advice.
SecureByDesignLabs Ltd, a company registered in England and Wales, company number 17543312. Registered office: 66 Paul Street, London, England, EC2A 4NA.