SuperSimple
Illustration of a release evidence workflow for software security.

CRA Evidence Pilot

How the CRA Evidence Pilot works

A focused, two-week evidence exercise for one product and one real software release.

01

Start with a short technical intake.

We agree the product, an exact release and the people who own its engineering context.

02

Connect existing technical facts.

Repository provenance, SBOMs, observations and decisions stay tied to that exact release.

03

Review the retained record.

Your technical owner reviews what is present, what is missing and what needs a decision.

04

Close with a reusable evidence package.

You leave with a factual technical record your team can revisit after the pilot.

What we need from you

  • One product team that can explain its release process.
  • One real release, not a fabricated demo.
  • Existing repository, CI/CD or security evidence where available.
  • A technical owner for the final review.

Free practical guide

From Software Release to CRA Evidence

A practical, eight-page guide to help software teams understand the release-evidence model before a pilot conversation.

Download the guide (PDF)

One product. One real release. Two weeks.

Request a pilot conversation