Start a free trial
Download Our Free Security Law Guide

CRA compliance doesn't end at product launch.
Neither does Lucerna.

AI-led, audit-ready vulnerability management for your products: built by engineers who live with the same challenge every day.

EU Cyber Resilience Act: reporting duties in force since 11 September 2026
Start a free trial
Download Our Free Security Law Guide

Rufilla is trusted by teams building smart products for:

Visual Portfolio, Posts & Image Gallery for WordPress
Curtiss Wright Logo

The problem.

Embedded products live for years in the field. The CVE databases that affect your platform update every single day. Without a clear, documented record of which vulnerabilities you reviewed and what you decided, you’re either redoing the same triage work every sprint, or flying blind.

And if a regulator, a customer’s procurement team or an auditor asks you to prove your security decisions, a spreadsheet won’t cut it.

Smart products live for years.
Vulnerabilities never stop.

That’s exactly why we built Lucerna.
red partnership icon

Every CVE decision recorded, timestamped and retrievable

red arrow

AI that reads your actual build, not just a generic CVE list

The rules have changed. Security compliance is now
a legal requirement.

Connected products are now subject to mandatory cybersecurity obligations in both the UK and EU. Regulators increasingly expect manufacturers to prove how vulnerabilities are identified, assessed and managed over time. If you sell products with digital elements into the EU and you learn of an actively exploited vulnerability in one of them, you have 24 hours to file an early warning with your CSIRT and ENISA. It applies to products already on the market, not just new ones. Reporting duties have been in force since 11 September 2026, with full obligations following in December 2027. Lucerna is built to have you ready.
Everything You Need to Know About the New Smart Product Security Laws

Download our free guide

Get the guide

Try Lucerna free

7 days, every feature, no card needed. See exactly how Lucerna fits into your workflow and what your audit trail would look like.

Start a free trial

What Lucerna actually does

Lucerna gives you a single, persistent home for every CVE decision your team makes across your product’s entire lifetime.

It’s AI-led. Lucerna reads your actual software build, your hardware configuration where available and your product spec, so it can show whether a CVE genuinely applies to your product, and explain why. The AI advises. Your engineers decide.

Every triage action is recorded with who made the call, when, why, and what the AI said at the time, creating the documented audit trail that EU CRA auditors look for.

It’s not another scanner that floods you with alerts. It’s the place where those alerts get turned into defensible decisions.

Upload and baseline in minutes

Upload and baseline in minutes

Automatic for Yocto teams
A custom meta layer, built by Rufilla, feeds every software build into Lucerna automatically. No manual step: Lucerna builds your baseline from the first scan.
Works with SPDX and SBOMs too
Prefer to work another way? Import a Yocto-style CVE JSON manifest, a standard SPDX format, or upload a software bill of materials (SBOM) directly. Lucerna also generates SBOM downloads and PDF status reports, so information flows both in and out.
Stop reviewing old vulnerabilities twice
Future uploads become deltas, helping teams focus on newly introduced risk instead of repeating old triage work.
Upload and baseline in minutes
Triage App
Triage that actually sticks

Triage that actually sticks

Every decision is recorded
Each CVE action includes rationale, timestamp and ownership, alongside the AI’s assessment at the time you made the call.
Previously reviewed issues stay closed
Triaged vulnerabilities only reappear if upstream statuses change or your team intentionally reopens them.
Four clear actions
Untriaged, patched, accepted risk, not applicable. When you triage a CVE, you choose a status and record your reasoning. Every call is documented, versioned and retrievable, so your team always knows where each decision came from and why.
Your AI Triage Assistant

Your AI Triage Assistant

It knows your product
Ask the AI Triage Assistant about any CVE and it explains why the vulnerability does, or doesn’t, apply to your build.
Tell it something once, and it remembers
Tell the AI Triage Assistant a fact about your product, such as “we don’t use Bluetooth”, and its assessments update from there. It will flag things back to you too, for instance if Bluetooth is switched on in the software but never used.
Context-aware scoring with the Lucerna Scoring System
A vulnerability might carry a generic industry score (CVSS) of 9.8 out of 10, but if your product doesn’t have the affected interface, the Lucerna Scoring System (LSS) might rate it 5.0. It works the other way too: knowledge of your platform can make a vulnerability more serious than its CVSS rating suggests. The AI recommends. The engineer decides.
Joe at Rufilla on a support call with clients

Filter for what actually matters

Prioritise genuine risk
Filter by Lucerna Score (LSS), CVSS, EPSS percentile, attack vector, package or other criteria, and sort straight to the vulnerabilities attackers are actively exploiting right now. Under the CRA, these are the ones that start the 24-hour reporting clock.
Share views across teams
Generate a PDF report to share with internal teams and subcontractors, so everyone works from the same picture.
Joe at Rufilla on a support call with clients
red box icons

Overnight alerts without the noise

Behind the scenes, Lucerna’s own vulnerability engine works through around 380,000 published CVEs, and rising daily, combining multiple data sources and running deep AI analysis to filter that down to the roughly 1,600 that attackers are actively exploiting right now. It refreshes overnight, every night.

Once a product has shipped, Lucerna keeps tracking it. Every release is rechecked daily as new CVEs appear, with an email alert the moment something dangerous lands in your software, and a daily reminder of anything still needing attention for CRA reporting.

You can also integrate Lucerna into CI workflows, preventing critical unresolved vulnerabilities from passing through builds unnoticed.

CRA reporting, without the blank page

The 24-hour early warning, handled
Learn of an actively exploited vulnerability and the clock starts. The AI CRA Assistant drafts your early warning to CSIRT and ENISA from inside Lucerna, ready for your engineer to check and submit within the 24-hour window.
The 14-day final report, tracked
The final report is due within 14 days of an actively exploited vulnerability landing, and Lucerna won’t let you mark it complete until every required field is filled in. From the report, jump straight back to triage to check whether the CVE is still applicable before you submit.
Incident reporting, covered
Report against a known CVE that’s been used to attack your product, or against something brand new that isn’t catalogued yet. It applies whether the product shipped last week or five years ago. The AI CRA Assistant auto-fills the CSIRT and ENISA forms either way.


Generate evidence instantly

Export a compliance report in PDF at any point
Every report includes open vulnerabilities, dismissed issues and recorded rationale: a clear, defensible snapshot of exactly where your product stands.
Built for real-world audits
The goal isn’t certification. It’s a security process that stands up when it’s asked to.

Core capability

Yocto-style JSON and standard SPDX formats, including automatic upload through Rufilla's Yocto meta layer
AI Triage Assistant with context-aware scoring through the Lucerna Scoring System (LSS)
Persistent CVE triage with mandatory rationale
Multi-product vulnerability tracking
Role-based access and audit history
REST API for CI integration and build gating
Overnight high-severity alerts and daily post-release monitoring
CSIRT and ENISA reporting with the AI CRA Assistant, early warning within 24 hours
Bulk triage operations
PDF compliance reporting and SBOM generation
red box icons

Built By People Who Actually Use It

We built Lucerna because we needed it ourselves.


We work on long-life embedded products where security audits can happen years after deployment. Explaining every vulnerability decision through spreadsheets and disconnected processes simply wasn’t sustainable.

So we built the platform we wanted to use ourselves, then gave it the AI we wished we’d had from day one.

Lucerna is used internally across Rufilla projects every day, which means the roadmap is driven by real engineering needs, not abstract feature lists or marketing trends.

Try Lucerna free

7 days, every feature, no card needed. See exactly how Lucerna fits into your workflow and what your audit trail would look like.

Start a free trial

Try Lucerna free
for 7 days.

Bring an SBOM or a Yocto build and run it through Lucerna yourself.

You’ll see exactly how Lucerna fits into your workflow and what your audit trail would look like.

Every feature. No card needed.

Enter your name, work email and company and we’ll email you a link to set your password.

Start a free trial

Prefer to talk first? Call us on +44 (0)1865 601201 or email hello@rufilla.com