Avalue partners with Exein for CRA-ready embedded cybersecurity

Avalue Technology has announced a strategic partnership with physical AI security firm Exein to integrate advanced firmware vulnerability analysis into its industrial computing platforms. By embedding the Exein Analyzer into its product security and lifecycle management processes, Avalue aims to help original equipment manufacturers (OEMs) navigate the stringent requirements of the European Union’s upcoming Cyber Resilience Act (CRA). The collaboration merges Exein’s threat detection technologies with Avalue’s deep expertise in hardware design, board support packages (BSPs), and embedded operating systems.

Moving beyond standalone CVE scanning
Unlike standard cybersecurity tools that merely generate extensive, unfiltered lists of Common Vulnerabilities and Exposures (CVEs), Avalue correlates Exein Analyzer’s software bill of materials (SBOM) scans directly with the product’s specific system architecture. Drawing on its experience with x86- and Arm-based platforms, Avalue assesses whether identified vulnerabilities actually impact the deployed environment. When actionable risks are confirmed, the company coordinates directly with OS and component suppliers to evaluate updates, patch BSPs, adjust security configurations, or implement targeted risk mitigation measures prior to deployment.

Runtime protection and lifecycle compliance
The partnership also extends into active, post-deployment defense through the integration of Exein Runtime on applicable platforms, which validates on-device security policies and event detection. Because the CRA mandates continuous cybersecurity responsibilities across a product's entire lifecycle, Avalue provides ongoing vulnerability monitoring, version management, and security advisories. This end-to-end framework allows customers in healthcare, manufacturing, energy, and transportation to accelerate global deployments while seamlessly maintaining the technical documentation required for regulatory compliance.

Additional Context: The CRA and the challenge of SBOM false positives
This section details technical specifications and regulatory analysis not included in the original partnership announcement.

The EU Cyber Resilience Act (CRA) fundamentally shifts liability for software security onto hardware manufacturers, mandating that commercial products with digital elements maintain a dynamic Software Bill of Materials (SBOM) and guarantee active vulnerability handling for a minimum of five years (or the expected product lifetime). A critical challenge in embedded Linux and RTOS environments is the sheer volume of "false positive" CVEs generated by automated scanning tools. Because industrial BSPs often strip out unused software modules, drivers, and libraries to optimize footprint and performance, a CVE flagged in a standard open-source package might target a subsystem that doesn't physically exist or execute on the specific edge device. By filtering raw vulnerability data through the lens of the actual hardware architecture and the compiled BSP, system integrators can eliminate these phantom threats and focus patching efforts solely on exploitable attack vectors, drastically reducing engineering overhead and compliance fatigue.

Edited by an industrial journalist, Lekshman Ramdas, with AI assistance.

www.avalue.com