What is Aura?

Aura is Linuscent’s product security and compliance workspace.

It helps engineering, security, product, and compliance teams work from the same product and release evidence when managing software components, vulnerabilities, security decisions, and compliance activities.

Aura connects products and their releases with software inventory, security findings, documented decisions, and supporting evidence.

What can you do with Aura?

You can use Aura to:

create workspaces and products for product-security work;
upload supported SBOMs and create product releases;
maintain software inventory for each release;
identify vulnerabilities associated with software components;
review vulnerability, license, and policy information;
document vulnerability assessments and decisions;
monitor active releases for changes in findings;
maintain traceable evidence for security and compliance work;
export evidence for review, reporting, and audit preparation.

Some capabilities may depend on your Aura plan or workspace configuration.

Why use Aura?

Product security information often exists across different tools, teams, and documents.

For example, an engineering team may maintain build information in one system, vulnerability findings in another, and compliance evidence in tickets, spreadsheets, or shared folders.

Aura provides a shared workspace that connects this information to the product and release it belongs to.

This helps teams answer questions such as:

What software components are included in this release?
Are any known vulnerabilities associated with those components?
Has each relevant finding been reviewed?
What decision was made and why?
Was the issue remediated?
What evidence supports that decision?
Has the security posture of an active release changed?

Who uses Aura?

Aura is designed for teams involved in building, securing, and maintaining products with software components.

Typical users may include:

Engineering teams managing product releases and software dependencies;
Product security teams reviewing vulnerabilities and remediation;
Compliance teams maintaining evidence for regulatory requirements;
Product teams coordinating security and compliance work across releases.

The exact responsibilities available to you may depend on your organisation, workspace configuration, and Aura plan.

Aura and the EU Cyber Resilience Act

Aura can support work related to the EU Cyber Resilience Act (CRA) by helping teams maintain software inventory, manage vulnerability-handling activities, and preserve traceable evidence throughout the product lifecycle.

Aura supports this work but does not by itself determine whether a product is compliant with the CRA.

Your organisation remains responsible for determining which requirements apply to its products and for meeting its regulatory obligations.

Key concepts

You will see several important concepts throughout Aura:

Workspace — the top-level area used to organise work in Aura.
Product — the main unit used to organise releases, SBOMs, and related security data.
Release — a release created from an SBOM upload to a product.
SBOM — a machine-readable inventory of software components associated with a release.
Component — a software package, library, framework, module, or other item included in the inventory.
Finding — information that may require review, such as a vulnerability or policy result.
Vulnerability decision — a documented assessment of how a vulnerability applies to a product release.
Evidence — records that support security, compliance, and review activities.

You do not need to understand all of these concepts before getting started.

Next steps

Continue with: