ONEKEY Product Cybersecurity & Compliance Platform

ONEKEY GmbH is a product cybersecurity and compliance software company registered in Düsseldorf, Germany. It was launched in 2020 as IoT-Inspector, a spin-off from the penetration testing firm SEC-Consult, and rebranded to ONEKEY in 2022. It helps makers of connected devices find security flaws in their firmware and prove compliance with new regulations such as the EU Cyber Resilience Act.

The ONEKEY Platform analyses firmware and binary software without needing source code or network access. It generates and manages software bills of materials, detects known CVEs and zero-day issues, assesses their impact automatically and suggests mitigations. A Compliance Wizard maps results to the EU CRA, IEC 62443 and ETSI EN 303 645, and an AI Agent lets teams query vulnerability and component data in natural language. Users include product owners, PSIRT teams and compliance managers in manufacturing, automotive, medical, telecom and infrastructure.

• Binary firmware analysis: Scans firmware images without source code or network access.
• SBOM management: Creates, imports and overrides software component lists.
• Vulnerability management: Detects CVEs and zero-day issues and assesses their impact automatically.
• Compliance Wizard: Maps findings to the EU CRA, IEC 62443 and ETSI EN 303 645.
• Continuous monitoring: Watches released firmware for newly disclosed vulnerabilities.
• AI Agent: Answers questions about vulnerabilities, SBOMs and components in natural language.

A Vietnamese router or camera maker can scan each firmware release and produce CRA evidence before shipping to Europe. An electronics contract manufacturer can check supplier firmware for vulnerable components. A utility or factory can assess the firmware of industrial devices before purchase.

Manufacturers can check firmware from their own teams and suppliers without access to source code. Automated SBOM generation and impact assessment cut manual work: Swisscom reports 40% faster SBOM generation, 50% lower manual monitoring costs and 30% shorter vulnerability detection time. Compliance reports mapped to the EU CRA, IEC 62443 and ETSI EN 303 645 help products keep access to the European market.

The EU Cyber Resilience Act and the radio equipment directive now require connected products sold in Europe to ship with SBOMs, vulnerability handling and security evidence. Electronics and device makers in Vietnam and Southeast Asia that export to the EU or produce for European brands face the same obligations, which drives demand for automated firmware testing.

Launched in 2020 as IoT-Inspector, a spin-off of SEC-Consult, and rebranded ONEKEY in 2022; registered in Düsseldorf with teams in Germany, Hungary, Austria and Belgium. ISO/IEC 27001 certified in 2026. CRA Fast Start won a Best in Show award at embedded world 2026.