AI-native security
SoftWSP is an AI-native security service from Netbase JSC for device makers, machine builders and plants. We analyse firmware, machine component lists and passive shop-floor network recordings, report every finding with its evidence, help fix what you own, re-scan to prove the fix and keep monitoring. Work is remote and worldwide.
A Netbase JSC company
Facts of Netbase JSC as of . About the company
The firmware lead can tell a buyer or a regulator exactly what ships in the version on sale.
The engineering head answers a customer's security questionnaire without opening every cabinet.
The plant manager sees every talking device and every remote-access path, and production never stops.
A report that arrives on a Saturday has an owner, a clock and a draft ready by Monday.
Device makers and brands, machine builders, plant and grid operators, and the product security teams that answer for them.
EU CRA, ETSI EN 303 645 and UK PSTI.
FDA premarket and EU CRA for device makers.
IEC 62443-4-1/4-2 for machine and PLC makers.
NERC CIP and OT risk for grid operators.
BACnet, controllers and building OT risk.
Scan, AI-assisted fix, re-scan proof and monitoring, for firmware, in one service. Most tools in this field stop at the report.
Vulnerability-reporting duties under the EU Cyber Resilience Act apply from September 2026. The Machinery Regulation 2023/1230 applies from January 2027.
AI drafts every finding with the evidence behind it, and an engineer reviews it before it reaches you.
AI models and API keys embedded in firmware, MCP servers, and AI-enabled machines.
You do not need to host us. Your engineer follows our guide and we do the rest.
We report only what the evidence shows. No "100% secure" claims: every report states what it covers and what it does not.
Most security tools stop at the report. SoftWSP carries each finding through four steps, then starts again.
We unpack your firmware, read a machine component list or a passive network recording, and match every component against NVD, CISA KEV and FIRST EPSS.
For firmware you own, AI prepares, builds and tests the patch, and an engineer reviews it before it reaches you.
We scan the fixed build again, so your release manager signs off with a scan that shows the issue is gone.
When a new vulnerability appears in a component you have shipped, you hear about it, ranked by how likely it is to be exploited.
You send a firmware file, a component list or a network recording, under a confidentiality agreement and over an encrypted channel.
Our engine unpacks and inspects what you sent, then matches each component against public vulnerability sources such as the CVE database and CISA advisories.
You receive a summary for management and a detailed version for engineers, with the evidence behind every finding.
For firmware you own, AI-assisted engineering prepares, builds and tests patches, then we scan again to show the result.
When a new vulnerability appears in a component you have shipped, you hear about it, ranked by how likely it is to be exploited.
SoftWSP is delivered by Netbase JSC. These reviews are of Netbase JSC and its CMSmart products, quoted word for word as published on netbasejsc.com.
Client reviews of Netbase JSC
United Kingdom
“We've been using the NB designer over the last few years and had nothing but rave reviews from customers who use it. We've also received excellent and timely support from the team at Netbase.”
Client reviews of Netbase JSC
Spain
“Their commitment to meeting my needs promptly is commendable, and their patience in resolving issues sets them apart.”
Client reviews of Netbase JSC
United States
“From start to finish, the experience was exceptional, and I am thrilled to share my positive review about their outstanding services.”
Reads a passive network recording into a connection log
Decodes industrial protocols such as Modbus and S7comm
CVE records and CVSS scores
Vulnerabilities known to be exploited
Daily likelihood that a vulnerability is exploited
Advisories for industrial control systems
Drafts advisory and report text from cited evidence, reviewed by an engineer
Stores the knowledge graph and each organisation's data, isolated per tenant
Holds uploaded files and finished reports
Serves the platform API behind the dashboard and reports
The platforms, languages and clouds Netbase JSC builds with.
Source: Netbase JSC technology registry, attested 2026-09-15.
Names are trademarks of their respective owners, used only to name a technology or data source (nominative use). No endorsement or partnership is implied.
Enterprise
For enterprises and their supply chains: one scope, one team and one contract for every device, machine and site you need covered.
Several products, firmware versions or sites in one engagement, so your security lead sees one picture instead of a stack of reports.
API keys for your organisation, so your own tools can send inputs and read findings and reports without anyone copying files.
Work starts under a confidentiality agreement, and every file travels over an encrypted channel.
The same engineers across every product and site, so nobody has to explain your setup twice.
SoftWSP closes the loop that most security tools leave open. We scan firmware, machine components and plant networks, use AI to propose and prepare the fix, scan again to prove the result, and keep monitoring after release. Every AI-written finding cites its evidence, and an engineer reviews it before it reaches you.
Device firmware security. We unpack your firmware, build the software bill of materials, match it to published vulnerabilities and tell you what to fix first. Where you hold the source code, we make the fix, test it and scan again. Read more about device firmware security.
Machine builder reports. From the electrical component list of one machine line, we produce a Machine SBOM and Vulnerability Report that shows which digital components are inside and which published vulnerabilities affect them. Read more about Machine SBOM reports.
OT Snapshot for plants. Your engineer records 24 to 72 hours of shop-floor traffic from a mirror port. We turn the file into a device inventory, a vulnerability list and a map of remote access. Read more about OT Snapshot.
For device makers who need a way to receive and handle vulnerability reports, we also run a PSIRT service.
Four shifts are reshaping what manufacturers are expected to show. Our guides explain each one.
AI adds a fifth: firmware that ships with models, API keys and agent interfaces that older checklists never anticipated. Please check the current text of each rule for your own product.
The first five device makers or machine builders and the first five plants receive their first report free of charge, in return for feedback on the report. If you have a firmware file, a machine component list or a network recording you would like examined, we would like to hear from you.
Device makers and brands selling connected products into the EU, UK and US, machine builders, and manufacturing plants that need to know what is on their shop-floor network.
No. Our reports support your compliance work. Under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), they are not a certificate, and responsibility for compliance stays with the manufacturer or importer.
Almost all work is remote, worldwide. Your engineer prepares the inputs or a test lab on your premises, and we do the analysis and engineering from our side.
SoftWSP already works with AI on its side: AI drafts each finding with the evidence behind it, and an engineer reviews it before it reaches you. If you want your own AI agents or developer tools connected to your SoftWSP results, Netbase JSC, the company behind SoftWSP, scopes and builds that integration as a custom service.
Yes. A SoftWSP service is delivered remotely, worldwide: you send the inputs over an encrypted channel and we do the work from our side. Netbase JSC, the company behind SoftWSP, has worked with clients in 80 countries.
Device makers and brands of connected products, machine builders, and manufacturing plants of any industry. If your product or plant runs firmware, PLCs or connected devices, the services apply.
Contracts and invoices are issued by the company, Netbase JSC. You pay by bank transfer to the company account or by PayPal Business. Unless the order says otherwise, invoices are payable within 15 days.
Huy Nguyen (David), CEO of Netbase JSC, by WhatsApp at +84 937 869 689 (wa.me/84937869689) or by e-mail at [email protected].
Talk to an expert
Huy Nguyen (David)
Founder & CEO, Netbase JSC
Questions about this page?
