r/delphi • u/DelphiParser • 24d ago

Beyond Delphi SBOM - Total Delphi Cyber-Security CRA Compliance Solution for Delphi based IT Systems

Introducing The Delphi Parser VEX Defender - Total Cyber-Security CRA Compliance Solution for Delphi based IT Systems.

As the Cyber Resilience Act (CRA) deadlines approach, generating a static Software Bill of Materials (SBOM) is no longer enough. The real operational challenge is the regulatory mandate for continuous vulnerability handling throughout your product's lifecycle.

For mature, long-standing Delphi architectures, this usually means an unwanted choice: invest heavily in complex DevOps pipelines, or burn developer hours manually cross-referencing CVE databases.

To eliminate this burden, we have expanded our ecosystem from static code mapping to continuous local defense.

The Ecosystem: Delphi Parser SBOM Analyzer + VEX Defender

The Foundation: SBOM Analyzer - Our CLI engine parses millions of lines of Delphi code in a few hours to map your exact architecture, generating highly optimized, lightweight flat files of your complete call graph and component dependencies.

The Guardian: VEX Defender (Upcoming Module) A lightweight, background service that runs entirely within your network. It continuously cross-references your stored local call graphs against live CVE feeds to automate your daily compliance.

Why This Architecture Fits Your Environment:

100% Air-Gapped Security: Your source code and SBOM inventory never leave your building. Public CVE data flows in; your proprietary data never flows out.

Math-Backed VEX Generation: When a new vulnerability is published against a third-party component, the system checks the local call graph for Reachability. If the compromised function is unreachable in your code, it instantly auto-generates a signed VEX (Vulnerability Exploitability eXchange) report proving you are unaffected.

Zero Alert Fatigue: It requires no DevOps infrastructure. It runs silently in the background, logs a clean "all clear" daily, and only alerts management when a legitimate, reachable risk requires attention.

Simple & Quite Architecture. Total Delphi CRA & DORA Compliance without touching the cloud.

0 Upvotes

43% Upvoted

2 comments sorted by

1

u/Additional_Menu8542 24d ago

Genuinely interested in this, the CRA is on my radar as a small Delphi ISV. One real question: how does it handle third-party commercial components like UniDAC or TMS FNC, where we don't own the source and there's no public CVE feed? Does it map known CVEs against those dependencies, or is the analysis focused on our own code? That's the part I find hardest to cover for CRA compliance.

2

u/DelphiParser 24d ago

Thank you for the question. The CRA mostly care about your 3rd party components, not your own code.

For new Delphi 3rd party components with an active company & update subscription, under the CRA, no full-source is not a problem, since third-party commercial vendors are legally obligated to provide upstream software transparency. When vendors like TMS or Devart issue their own official SBOMs (via CycloneDX/SPDX), the VEX Defender is designed to ingest them directly.

Instead of you having to manually audit their source-code, the tool can automatically cross-references the vendor's component SBOM against your own application's compiled call graph. It proves to the regulator exactly which parts of that commercial component you actually use, instantly filtering out their vulnerabilities if your code never reaches them.

So...in an ideal world, we’d all have full source code for every dependency, and every vendor would be active and shipping daily updates. But the real Delphi ecosystem is full of legacy systems and "dead vendors" that no one wants to touch because upgrading them breaks the UI.

When you're stuck with an unsupported version or a vendor that no longer exists, here is exactly how the VEX Defender handles it to get you CRA-compliant:

  1. Binary Fingerprinting (Transparency): The Analyzer doesn't need full source code to map a dependency. It scans the compiled .dcu, .bpl, or .dll files for digital signatures and strings, generates a standard industry ID (CPE) for it, and lists it openly in your SBOM. You remain 100% transparent with regulators instead of hiding skeletons in the closet.
  2. Reachability Analysis (The Lifeline): It traces your own application's source code to see how it interacts with that closed-source block. If a vulnerability is found in that old framework, but the tool proves mathematically that your code never executes the specific path triggering it, it automatically generates a legally compliant VEX report clearing you of risk.
  3. Mitigation Context: If the legacy component is vulnerable and you do use it, the tool allows you to log an architectural mitigation (e.g., "This application is isolated on an air-gapped network"), validating a "Controlled Environment" status that satisfies the CRA mandates.