You've finished this phase Next phase: Have I got the day-1 policies?

Next up: CVD policy generator
Gap Analysis · Threat Modelling

Threat Modelling & CRA: Only 24% of SMEs Are Doing It

The ENISA SME CRA Survey 2026 identifies threat modelling and Software Bills of Materials as the two areas with the biggest gaps between current SME practice and what the CRA expects. This page explains the CRA obligation, the size of the gap, and shows a free, no-login STRIDE-light wizard that closes it in about 10 minutes.

24%
of SMEs implement threat modelling

The lowest adoption rate for any technical practice tracked by the survey — well below secure coding (43%) or code review (42%).

Source: ENISA SME CRA Survey 2026, Figure 7 (p. 17) and Table 12 (p. 22).

49%
of microcompanies sit at maturity level 1 or 2 in risk management & secure-by-design

Without structured threat modelling, security is treated as an afterthought — inconsistent with the CRA's security-by-design mandate.

What the CRA actually asks for

Threat modelling is not a nice-to-have under the CRA — it is the foundation for demonstrating that a product was designed with cybersecurity in mind.

  • Annex I, Part I — essential cybersecurity requirements

    Products with digital elements must be designed, developed and produced to ensure an appropriate level of cybersecurity based on the risks. That risk assessment IS your threat model.

  • Annex VII — technical documentation

    The technical file must include a description of the cybersecurity risk assessment. A notified body cannot certify a Class I or Class II product without seeing this.

  • Security by design and by default

    The CRA requires products to be secure by design — which is impossible to prove without a documented understanding of the threats you defended against.

How CRA Studio closes the gap

You get two things: a free, browser-only STRIDE-light wizard that produces a usable threat model in about 10 minutes, and a persistent workspace once you sign up.

Free, no login

Answer the guided questions about your product, deployment context and data. The wizard produces attack surface, threat actors, attack vectors and derived security requirements — all downloadable as Markdown or JSON.

Registered plan value

A threat model attached to a product dossier participates in the compliance score, is versioned in the audit log and can be reviewed by teammates — everything you need to hand to a notified body.

Related deep dives

01Scope03Foundations04Reporting05Technical file06Maturity