Step 1 of 2 in What could go wrong with my product?
Research: referenced in the ENISA SME CRA Survey 2026.
The Cyber Resilience Act requires a risk assessment that maps your product's attack surface, threat actors and attack vectors, and derives security requirements from them. This guided STRIDE-light tool walks you through it in four steps and produces a documented threat model — including the methodology — that you can keep with your technical documentation. No sign-up.
Scoped to software/cyber security (CRA Annex I, Part I). Pick the attack surfaces that apply to your product; we suggest concrete STRIDE threats and a mitigating requirement for each, which you rate by likelihood and impact.
Step 1 of 3
Describe the product and select the surfaces an attacker could reach.