System BOM Creation for Machine and Plant Engineering
Create a system bill of materials for your machines and plants – in under 20 minutes. With SANCTUARY Insight, you capture detailed information such as model, product number, firmware version, and much more – for industrial PCs and PLCs, but also for downstream devices connected via IO-Link or EtherCat, for example. Whether once at final acceptance or continuously at the customer's site.
Machines change with every delivery
Machines and plants increasingly consist of a heterogeneous network of interconnected devices: programmable logic controllers (PLCs), numerical controls, human-machine interfaces (HMIs), industrial PCs, edge gateways, sensors, and actuators. Each subsystem operates with software and firmware supplied by different manufacturers, updated at different intervals, and integrated late in the supply chain. This heterogeneity creates blind spots that undermine vulnerability management and lifecycle control. Once a machine is individually customized or reconfigured, the inventory quickly deviates from the design documentation. Operators and manufacturers therefore need a reliable mechanism to enumerate hardware and software components, including exact firmware versions and configuration context, without prior knowledge of the topology.
The EU Cyber Resilience Act is approaching
Did you know that by September 2026 you must already be able to report vulnerabilities in your machines and plants? Now is the right time to prepare your system BOM and set up the necessary internal processes!
CRA enters into force
The Cyber Resilience Act was published in the Official Journal of the European Union and has officially entered into force.
Impact: For all hardware and software manufacturers, the 36-month deadline for full implementation begins.
Reporting obligations
Manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA.
Impact: These obligations are subject to strict deadlines, including a 24-hour early warning requirement. An automated, real-time BOM is essential for immediate triage. Without automation, these deadlines can hardly be met in practice.
The ideal time to roll out automated asset inventory solutions such as SANCTUARY Insight Insight uses passive network observation and active device communication to capture exact firmware and topology data and to automate BOM creation ahead of upcoming deadlines.
Full enforcement
All core CRA product requirements and obligations apply.
Impact: Products placed on the market require conformity assessments and CE marking. Manual documentation is not sufficient. To be able to provide continuously up-to-date vulnerability reports, automation of the device and vulnerability status is indispensable.
CRA enters into force
The Cyber Resilience Act was published in the Official Journal of the European Union and has officially entered into force.
Impact: For all hardware and software manufacturers, the 36-month deadline for full implementation begins.
Reporting obligations
Manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA.
Impact: These obligations are subject to strict deadlines, including a 24-hour early warning requirement. An automated, real-time BOM is essential for immediate triage. Without automation, these deadlines can hardly be met in practice.
The ideal time to roll out automated asset inventory solutions such as SANCTUARY Insight Insight uses passive network observation and active device communication to capture exact firmware and topology data and to automate BOM creation ahead of upcoming deadlines.
Full enforcement
All core CRA product requirements and obligations apply.
Impact: Products placed on the market require conformity assessments and CE marking. Manual documentation is not sufficient. To be able to provide continuously up-to-date vulnerability reports, automation of the device and vulnerability status is indispensable.
System BOM and Vulnerability Management with SANCTUARY Insight
Within a machine or plant, SANCTUARY Insight identifies OT devices and their software stacks via passive network observation and selective, protocol-based queries. To do this, the Insight Sensor combines standardized IT and OT protocols such as PROFINET with manufacturer-proprietary protocols such as the S7 protocol used by Siemens. This keeps devices and the network unburdened while ensuring high data quality.
The unique scope of manufacturer-proprietary protocols enables SANCTUARY Insight to capture not only PLCs, HMIs, and industrial PCs, but also cameras, other sensors, and even real-time fieldbus devices connected via, for example, EtherCat, IO Link, or SERCOS III. All of these devices are captured along with manufacturer, model, product number, serial number, firmware, and operating system versions, and are then matched against vulnerability information based on that data.
The system then creates a system-wide BOM that integrates a hardware BOM and a software BOM and links software components to the executing devices to ensure unique traceability.
Whether at final acceptance or continuously at the customer's site, SANCTUARY Insight reliably captures your machine components!
The Foundation for Compliance – In Minutes
A scan of your machine typically takes less than 20 minutes, but provides all the data you need to fulfill your documentation obligations for your machine! This data includes a complete system BOM with
- IP and MAC
- Model name
- Serial number
- Product code
- Device type
- Manufacturer
- Firmware version
- Operating system
- Installed software
- Expansion cards / IO modules
- Network interfaces
- Connected ports (topology)
Our Insight sensors enable a complete and detailed OT asset visibility. SANCTUARY Insight supports all standardized OT protocols such as Modbus/TCP, OPC UA, PROFINET, a wide range of manufacturer-specific discovery protocols from, for example, Siemens, Beckhoff, Phoenix Contact, Schneider Electric, as well as peripherals such as cameras, barcode readers, printers, real-time fieldbus participants, and much more. Furthermore, SANCTUARY Insight burdens neither the network nor the devices by 1) reducing the protocols attempted per device based on prior device information and 2) using the protocols already employed by the manufacturer's software.
And for your Windows- or Linux-based embedded PCs, we offer our Insight Agent, which automatically collects a software BOM (SBOM) for you – or you upload existing SBOMs directly to integrate them into your system BOM.
Integrated Machine and Customer Management
Responsibility rarely ends with the delivery of a machine or plant. SANCTUARY Insight bridges the critical gap between in-depth technical asset management and customer management. Instead of managing your machine fleet in isolated data silos, it directly links security integrity with the business context.
- Centralized Fleet Management: Get a complete overview of the status of all scanned machines and plants over their entire lifecycle in a single, clearly structured console.
- Multi-Tenant Customer Assignment: Assign individual machines or complete plant complexes with one click to specific customers, projects, or plant areas. This ensures precise monitoring, even with hundreds of active field installations.
- Precise Risk-Customer Mapping: When a new vulnerability (CVE) is disclosed, every second counts. Identify the affected device, such as a specific PLC or I/O unit, deep within a machine, and immediately see exactly which customers are affected. Offer proactive security support and patch scenarios before your customer even becomes aware of the risk.
Automate your system BOM capture!
SANCTUARY Insight significantly reduces the cost and effort for compliance! A typical machine can be scanned by a technician in less than 20 minutes.
| Function | Manual / Design documents (status quo) | SANCTUARY Insight |
|---|---|---|
| Speed & Scalability | Manual inspection and vulnerability management will not be scalable for the upcoming requirements. | ✔ A full machine scan typically takes less than 20 minutes. |
| Data Quality | The inventory quickly deviates from the original design documentation upon customization or reconfiguration. | ✔ Real-time detection of hardware, exact firmware versions, and serial information via protocol-based queries. |
| CRA Compliance | Blind spots hinder documentation obligations and vulnerability lifecycle management. | ✔ Automatic generation of the system BOM required by the EU Cyber Resilience Act. |
| Device Traceability | Heterogeneous devices (PLCs, HMIs, gateways) from various manufacturers lead to fragmented documentation. | ✔ Integrated hardware and software BOMs link components to the executing devices for unique traceability. |
FAQ
Test Insight on your machine
Contact us for a test scan!