About Softwsp
Softwsp is a brand of Netbase JSC. It exists for one purpose: to make the security of connected products, firmware and industrial software something a manufacturer can prove and keep proving, with AI doing the heavy work and engineers standing behind the result.
Our mission
To let any manufacturer of connected devices and machines show, with evidence, that their products are handled responsibly, and to give them the engineering to improve those products, without first building a security department.
Why this field needs a new approach
Connected products now carry software that has to be maintained for years. Regulation has arrived: vulnerability-reporting duties under the EU Cyber Resilience Act apply from September 2026, radio equipment has been subject to the RED delegated act and EN 18031 since August 2025, and the Machinery Regulation applies from January 2027. Most existing tools produce a list of findings and stop. The hard part, making the fix, proving it and watching afterwards, is left to the manufacturer, who often does not hold the source code or the people.
Softwsp is built around the whole path: analyse, explain, fix what the customer owns, test, re-scan, hand over and monitor.
What we are building
- A closed loop for firmware. Scan, AI-assisted fix, re-scan as proof, and continuous monitoring of every version you have shipped.
- AI-native reports and tools. Findings written by AI cite their evidence and are reviewed by an engineer. MCP tools let customers’ own AI agents query Softwsp.
- Coverage of emerging risks. AI models and API keys inside firmware, MCP servers and AI-enabled machines, which older checklists do not yet address.
- Remote-first delivery worldwide. Your engineer works with our guide; we work from our side.
Our principles
- Evidence first. Every finding points to what produced it: a file, a version, a configuration, a packet. If we cannot show the evidence, we do not report it as a finding.
- No “100% secure” claims. No honest provider can promise that. Our reports describe what is known on the day of analysis and what remains outside the scope.
- Coordinated disclosure. If we find a vulnerability in a customer’s product, we tell the customer first and do not publish it without agreement. If we find one in a third-party product, we follow coordinated disclosure with the vendor.
- The customer keeps the signing keys. Firmware is signed with the customer’s keys, under the customer’s control. We do not hold production signing keys.
- Remote-first, customer-controlled. Anything that touches your devices happens through a lab you set up or a session your engineer approves, and every session is logged.
- We stay in our lane. We do not operate production machines or plant networks, and we do not patch the firmware of third-party PLCs, robots or controllers. We tell you where the official fix is.
- Plain language. Reports are written so that a plant manager or a product director can act on them, with detail for engineers underneath.
How AI is used
AI speeds up unpacking, matching, report drafting and documentation, and it assists in preparing fixes. AI output is a first draft. An engineer checks the findings, the evidence and the recommendations before you see them. We do not use your files to train public models, and we say so in our privacy notice.
Who we serve
Device makers, brands and importers selling into the EU, UK and US; machine builders; and plants that supply larger manufacturers or face customer and insurer audits. We work in English first and plan to add other languages.
Work with us
We are opening Softwsp through a Design Partner programme. If you make connected products or machines, or run a plant, we would be glad to look at your first case.