- Where KONFORMA is stronger, the row says so.
- “Not publicly documented” means the vendor's public material is silent - not that a capability is missing.
- Prices are as published, with the unit each one is charged in.
Comparison · last verified 24 August 2026
Source-backed CRA evidence, or release-security operations.
Both products are CRA software, and both are straightforward about what they do. They simply start in different places: ConformOps starts from the evidence inside your repository and release, KONFORMA starts from the inventory of what a release contains. That single difference explains most of what follows.
The short answerChoose ConformOps when Choose KONFORMA when
Which one fits, in two paragraphs.
The problem is turning what you already ship into a defensible CRA record.
When a reviewer challenges a requirement six months from now, you can reproduce what evidence supported it, from which release and which file and line span, what was missing at the time, and who made the accountable decision. ConformOps builds that record out of the repositories, releases, CI and documentation you already ship, ties every conclusion to a cited CRA requirement, keeps the gaps named rather than smoothed over, and hands a reviewer controlled working documents instead of an assertion.
The problem is running release inventory and product-security operations.
Your product is embedded, firmware, or C/C++ heavy and component identification is the hard part. You want frequent vulnerability monitoring against several feeds, a pre-filled incident draft when something is known-exploited, a verification page and evidence pack customers can check, supplier evidence exchange, and enterprise workflow: teams, advanced roles, SSO, API, audit logs, SLA.
Two architectures
What each product actually reads.
This is the deliberate trade-off at the centre of the choice. It is not a security ranking - read the section below the table before you decide which side of it you want.
InputBounded repository subset + supplied SBOM
Docs, config, CI/build files, source. Secrets redacted before storage, indexing or model use. Code never executed.
Bound toSanitized snapshot with spans
Repository, ref, commit, release, run, path, line and code-point span, hashes, collector and redaction policy.
Mapped toCited requirement state
Evidenced, partial, gap or not applicable - against versioned rules with a legal citation.
OutputHuman decision + controlled artifact
Approval gates, gap and risk registers, Annex-oriented drafts, reviewer share.
InputGitHub-generated software inventory
Publicly stated to fetch the inventory GitHub generates rather than your source code. CycloneDX/SPDX import also accepted.
Bound toOne inventory per release
Completeness and readiness state, with curated deep C/C++ and embedded matching.
Checked againstOSV, NVD, CISA KEV
Actively exploited vulnerabilities prioritised; VEX-style statements recorded per release.
OutputReport, evidence pack, exchange
CRA Report, Evidence Pack, release timestamp and hash, verification page, Supplier Exchange.
Side by side
26 buyer questions.
ConformOps column: implemented behaviour. KONFORMA column: publicly documented behaviour as of 24 Aug 2026.
QuestionConformOpsKONFORMA
Approach and evidence input
ApproachCRA evidence operations: source and release material mapped to cited legal requirements, with human decisions recorded.“CRA Product Operations”, positioned for connected and embedded products.
Evidence inputRead-only GitHub App import, whole-repository upload, or focused files. Supplied CycloneDX/SPDX SBOM as release evidence.GitHub inventory import and CycloneDX/SPDX upload.
GitHub modelFetches a bounded text subset of the repository; redacts secrets before persistence, indexing or model use; never executes code.States that it fetches the software inventory GitHub generates, not the customer's source code.
Reads repository source evidenceYes - documentation, configuration, CI/build material and common source extensions. This is how a requirement gets a file and a span behind it.Not part of the documented GitHub model; source is described as staying in the customer's environment.
CycloneDX / SPDXCycloneDX JSON and SPDX JSON read as release evidence, retained with their own hash. XML and tag-value are refused rather than half-understood. Accepting is never validating.CycloneDX and SPDX import documented, with inventory completeness and readiness state.
Release-specific inventoryYes. Inventory, findings, affectedness decisions and artifacts are bound to the release they describe.Yes - one inventory per release is a headline part of the model.
Native / embedded C/C++ depthConservative: vcpkg.json, conanfile.txt, MODULE.bazel. Native builds are reported as partially observable, and a supplied SBOM stays the preferred path.Curated deep C/C++, firmware and embedded matching is a core documented capability.KONFORMA stronger
Vulnerabilities and decisions
Vulnerability sourcesOSV across eleven ecosystems. Components without an exact version and package URL stay in the inventory and are reported as not correlatable; an outage shows as degraded, never as “no vulnerabilities”.OSV, NVD and CISA KEV.Broader documented feed coverage
Known exploitation (KEV)CISA KEV context refreshed hourly, three-valued per CVE - listed, delisted, unseen. A stale or failed catalog renders as degraded rather than cleared.Components checked against KEV, with actively exploited vulnerabilities prioritised.
Affectedness / VEX decisionsUnder investigation, affected, not affected, fixed - per release, component and vulnerability, append-only, with justification and evidence, keyed to an identity that survives a re-run.VEX-style statements recorded per release.
Monitoring frequencyDaily dependency and OSV monitoring on Continuous; the KEV catalog itself refreshes hourly.Weekly, daily or every six hours depending on plan.
Requirements, provenance and documentation
CRA requirement mappingA requirement register per release: evidenced, partial, gap or not applicable, each with the evidence or the missing work named.CRA readiness and reporting built around release inventory and vulnerability state; requirement-level mapping is not documented at this granularity.
Exact source provenanceRepository, ref, commit, release, snapshot, run, source path, 1-based line and code-point span, collector version, redaction policy, hashes.ConformOps strongerRelease timestamp and hash on the report. Source-span provenance does not apply to an inventory-based model.
Legal-source provenanceVersioned rules carrying authority kind, legal effect, publisher, citation, URL, locator, retrieval date and content fingerprint. Binding law and guidance are labelled apart.Not publicly documented at this granularity.
Documentation and evidence outputsAnnex V declaration draft, Annex II working draft, Annex-VII-oriented working record, CycloneDX inventory, evidence and secret traceability, gap and risk registers, XLSX workbook, audit-events export - each hashed, versioned, with approval state. Drafts stay visibly incomplete.CRA Report and Evidence Pack, unlimited on higher plans.
Gaps vs security riskTwo registers. Unresolved CRA requirements are remediation work; product-security risk keeps likelihood, impact and residual risk UNASSESSED until a human sets them.Not publicly documented as separate registers.
What requires human judgmentScope, classification, risk values, affectedness, documentation and declaration gates need a person with approval authority. An AI proposal can never mark a requirement met or sign anything.The manufacturer reviews and submits incident drafts. The wider decision model is not publicly detailed.
Reporting, sharing, enterprise, price
Article 14 workflowCase records running the 24-hour, 72-hour and final-report clocks, a named runbook per product, drill cases kept marked as drills, and a workspace-wide register.A KEV match can trigger a pre-filled incident draft with product, release and known facts populated for review.More automated
Awareness-clock semanticsAwareness is recorded deliberately by a person, and actively-exploited cases are kept separate from severe incidents. A scanner event never starts a legal clock by itself.Draft preparation is triggered from KEV; timing and submission stay with the manufacturer.
Who files the reportYou do. ConformOps never submits to a CSIRT, to ENISA, or through the Single Reporting Platform.You do. KONFORMA states explicitly that it does not submit on your behalf.
External reviewer / customer verificationReviewer share links: token stored hashed, shown once, email gate, twelve-hour session. The payload carries counts, requirement states and cited locators - never source paths or evidence excerpts.Public or private verification page tied to a release timestamp and hash, plus the Evidence Pack.Stronger for customer-facing verification
Supplier evidence exchangeNot in the product. Evidence leaves as a controlled export or a reviewer share.Supplier Exchange and Supplier Workspace, with buyer and supplier evidence workflows.KONFORMA stronger
API and enterprise capabilitiesContinuous includes a documented product-scoped CLI/API for release evidence, assessments, engineering gates and signed events. Owner, Admin and Member roles; human approvals restricted to Owner/Admin; Google, Microsoft Entra or email sign-in; append-only audit CSV. No SAML SSO or SLA.Teams and roles, advanced roles, API, audit logs, SSO, custom branding and SLA depending on plan.Broader enterprise features
Release deltas and historyEnriched deltas: gaps closed with the evidence that closed them, conclusions the change re-opened, new components, new OSV matches, plus on-demand comparison of any two completed runs.Release history and alerts from the entry paid plan up.
Pricing modelPer product, or a five-product Portfolio. No seats, no scan credits; releases are unlimited within a product.Annual tiers bundling product count, release count, monitoring cadence and enterprise features.
Best fitA software manufacturer that needs the evidence and provenance behind each CRA conclusion, and controlled documents a reviewer can follow.A manufacturer running release-security operations at scale - especially embedded or native - with customers and suppliers exchanging evidence.
On narrow screens each capability becomes a card with both answers stacked beneath it. Nothing is hidden behind a horizontal scroll.
01
The source trade-off is the real decision
Everything else is downstream of whether a CRA tool reads your material or only an inventory of it.
Reading source buys provenance
A requirement can point at SECURITY.md lines 8–24, or at the SBOM step in release.yml, and a reviewer can check it. That is only possible if something read the file. ConformOps bounds the exposure instead of avoiding it: read-only repository-scoped short-lived tokens, no execution, secrets redacted before persistence, indexing or model use, raw archives streamed rather than kept, and paths retained as provenance so the trail stays checkable.
Not reading source buys a smaller blast radius
KONFORMA's public position is that its GitHub integration takes the inventory GitHub generates and that source code does not leave your environment through it. For a security review, that is a genuinely easier sentence to sign off. The cost is that evidence for a requirement then has to come from elsewhere - an inventory, a questionnaire, or your own documentation.
02
Vulnerabilities: we record more about the decision, they list more feeds
Both directions are defensible. They are not the same product feature.
The decision record
A match is only worth anything if you can defend what you did with it. ConformOps writes an append-only affectedness decision per release, component and vulnerability, with justification and evidence paths, attributed to a person, keyed to an identity that survives a re-run, and exportable as a point-in-time history a reviewer can read months later.
Feed breadth
KONFORMA publicly lists OSV, NVD and CISA KEV. ConformOps correlates against OSV and adds KEV context. On documented feed coverage, KONFORMA is ahead, and a page that claimed otherwise would be lying to you.
Honest degradation
An OSV outage or a stale KEV snapshot is shown as degraded rather than as a clean result. “No listing found” while the catalog could not be confirmed current is not evidence of no exploitation, and the interface says so. A KEV listing means a CVE is exploited in the wild somewhere. It does not mean your product is exploited, that your release is affected, or that an Article 14 clock has started.
03
Article 14: a pre-filled draft, or a deliberately recorded clock
From 11 September 2026 this stops being theoretical. Neither product files for you.
ConformOps · a defensible clock
Awareness is recorded by a person, not inferred from a scanner event, because the awareness time is what the 24-hour and 72-hour deadlines run from. Cases carry a named runbook, actively-exploited and severe-incident cases are kept apart, drills stay marked as drills, and months later you can still show when the clock started and who started it.
KONFORMA · more proactive
A KEV match can trigger preparation of a pre-filled incident draft. Product, release and known facts are populated; the manufacturer reviews and submits. If your worry is “we will freeze on the day”, having the draft already written is a real advantage. The trade-off is speed against defensibility.
04
Getting evidence to people outside your company
Two different audiences: a reviewer assessing your conformity, or a supply chain exchanging packs. We build for the first.
What we give a reviewer
Reviewer share links, twice-gated, revocable. Counts, requirement states and cited locators only. Evidence workbook and CSV exports for reviewers. Hashed, version-stamped artifacts with approval state. Enough for an auditor to check a conclusion against its source, without handing over the repository behind it.
What they give a supply chain
CRA Report and Evidence Pack, release timestamp and hash, public or private verification page, Supplier Exchange and Supplier Workspace. A buyer-facing verification workflow ConformOps does not have.
Published prices, 24 August 2026
Read the units before the numbers.
The units are different. Read those first. ConformOps charges per Organization-owned coverage slot assigned to one product. KONFORMA sells annual tiers that bundle products, releases, monitoring cadence and enterprise features. A single percentage cannot compare those honestly, so we are not going to publish one.
ConformOps per product · monthly or annual
Free Preview€0
2 active preview products. Deliberately partial: readiness picture, route proposal, top three gaps, no downloads. Archiving releases the active Free allocation.
Full Assessment€99
One-time, per product. Complete package plus a 14-day remediation verification window.
Continuous€79 /mo · €790/yr
One assignable slot. Future releases, daily dependency and OSV monitoring, history and deltas, refreshed artifacts.
Portfolio€249 /mo · €2,490/yr
Five active Continuous products included; additional products €49/month or €490/year each.
KONFORMA annual tiers · bundled scope
Free Check€0
1 product, 1 release, GitHub import or inventory upload, readiness score, watermarked sample report, verification preview.
Basic€2,990 /yr · ≈€249/mo
Up to 3 products, 15 active releases, weekly monitoring, CRA report and Evidence Pack, private verification, release history and alerts.
Professional€4,990 /yr · ≈€416/mo
Up to 10 products, 50 releases, daily monitoring, teams and roles, Incident Cockpit and VEX, API and audit logs, unlimited reports.
Business€9,990 /yr · ≈€833/mo
Up to 30 products, 200 releases, monitoring every six hours, unlimited team, SSO and advanced roles, Supplier Workspace, SLA and custom branding.
Enterprise / Exchangeon request
Referenced in their material as a quoted arrangement. No price is published, so we do not print one.
Three products you still ship, kept current: ConformOps is three Continuous coverage slots - €237/month, or €2,370/year annually. KONFORMA Basic is €2,990/year and covers up to three products with 15 active releases and weekly monitoring. Those numbers are close, and the scopes are not: Basic includes a customer-facing verification page and evidence pack, while ConformOps includes unlimited releases, requirement-level mapping, source provenance and the Article 14 case machinery. Above five products, ConformOps Portfolio changes the arithmetic again. Compare the scope you actually need, not the headline number.
Decide
Choose on your hardest problem, not on the row count.
A reviewer will ask “what supports this conclusion, and where did it come from?”
Your evidence is scattered across repositories, CI and documentation rather than in one inventory. You want CRA requirements tied to versioned legal citations, not anonymous checklist lines. You want gaps and unassessed risk to stay visible instead of being rounded up to “done”. You need Annex-oriented working documents and an audit trail of who approved what, against which assessment. One or a few products, and per-product pricing suits you better than an annual tier.
Your product is embedded, firmware or C/C++ and component identification is the hard part.
Your security review will not accept a compliance tool reading repository contents. You want the broadest documented vulnerability feed coverage and six-hourly monitoring. Customers ask you to verify releases, and suppliers send you evidence to reconcile. You need SSO, advanced roles, an API, audit logs, custom branding or an SLA. Ten or thirty products make a bundled annual tier cheaper than per-product pricing.
Methodology and sources
Last verified 24 August 2026.
Statements about KONFORMA come from its own published product and pricing material on that date. Statements about ConformOps describe implemented behaviour in the current product.
Capabilities change
Both products ship. A row that was accurate on the date above may be out of date by the time you read it - check the vendor's current material before you buy.
“Not publicly documented” is not “no”
Where a vendor's public material does not describe a capability, we say so. We do not turn silence into a missing feature, a cross, or a claim that something cannot be done.
First-party sources only
KONFORMA's homepage and published pricing, plus its SBOM & Inventory, Vulnerability Management, Incident Readiness, Evidence Exchange and Reports & Verification pages. No competitor's comparison page is used as a source about anyone.
Corrections welcome
If something here is materially inaccurate, tell us and we will change it. Write to help@conformops.eu .
KONFORMA and other product and company names are trademarks of their respective owners. This comparison is published for information only and is not affiliated with, endorsed by, or produced in cooperation with any other vendor. Nothing here is legal advice; ConformOps does not certify products or issue declarations of conformity.
Free preview · 2 products · no card
Assess a product