SoftWSP vs Finite State

Last updated:

SoftWSP vs Finite State comes down to how you want to work. Finite State is a product security platform: your team uploads firmware, manages SBOMs and VEX across many products and uses its CRA features in-house. SoftWSP is an engineer-delivered service: we analyse the firmware, an engineer reviews each finding, and where you hold the source code we prepare, build and test the fix, at a published price of $1,500 per firmware version.

Disclosure. This page is published by SoftWSP, which is built by Netbase JSC. Facts about Finite State come from finitestate.io, read on 26 October 2026. Where Finite State does more, we say so.

Side-by-side

Finite State SoftWSP
Model Self-service platform (SaaS or on-prem) Engineer-delivered service, remote, worldwide
Binary firmware, no source Yes, 50+ instruction sets Yes
SBOM CycloneDX, SPDX, living SBOM per release Included in the report, one per firmware version
Prioritisation Reachability, exploit intelligence, policy thresholds CVE database, CISA KEV, FIRST EPSS, engineer review
VEX Yes Not offered yet
CRA Drafts Article 14 notifications, technical file and declaration template, evidence packs PSIRT service drafts Article 14 early-warning and follow-up reports
Fixing Not publicly listed Prepares, builds and tests fixes when you hold the source, then re-scans as proof
OT / industrial Claims PLC/SCADA and IEC 62443 coverage Separate passive OT Snapshot service for plants
Target Device makers in automotive, medical, energy, government, industrial Small and mid-size device makers, machine builders, plants
Price Not publicly listed Firmware Scan Report $1,500; OT Snapshot $900; first report free for the first five Design Partners

Choose Finite State if

  • you manage many product lines and want your own team to run the analysis every release;
  • you need VEX documents and SBOM management at scale;
  • you want CRA notification drafting and technical-file assembly inside one platform.

Choose SoftWSP if

  • you have no security team and want findings explained in plain language;
  • you hold the source code and want someone to prepare and test the fix, not just report;
  • you want to know the price before a sales call, or start with one firmware version.

How SoftWSP works

  1. You send a firmware image under a confidentiality agreement over an encrypted channel.
  2. We unpack it, build the SBOM and match components to published vulnerabilities.
  3. An engineer reviews every AI-written finding before you receive the report.
  4. Where you hold the source, we prepare the fix, build and test it, and scan again.
  5. New vulnerabilities in components you shipped are flagged as they appear.

Details: device firmware security, PSIRT service, pricing.

Related

Frequently asked questions

What is the main difference between SoftWSP and Finite State?

Finite State is a product security platform that device makers use themselves across many products. SoftWSP is an engineer-delivered service: we analyse your firmware, review every finding and, where you hold the source code, prepare and test the fix. SoftWSP publishes its prices; Finite State does not.

Is SoftWSP cheaper than Finite State?

SoftWSP publishes its prices, for example $1,500 for a Firmware Scan Report of one firmware version. Finite State does not publish prices, so a direct comparison needs a quote from Finite State.

Which is better for CRA Article 14 reporting?

Both help with drafts. Finite State states that its platform drafts Article 14 notifications for the customer to decide on and file. SoftWSP's PSIRT service drafts the early-warning and follow-up reports for the manufacturer to submit. In both cases the manufacturer files and stays responsible.

Does SoftWSP support VEX like Finite State?

Not yet. Finite State supports VEX statuses; SoftWSP does not yet export VEX documents.

Is SoftWSP a credible vendor for small device makers?

SoftWSP is a young brand of Netbase JSC, a Hanoi software company founded in 2012 that has worked with clients in 80 countries. Its guides, advisories, free tools and prices are public, and every finding is reviewed by an engineer. Small device makers can start with one report and judge the result.

Who wrote this comparison?

SoftWSP, built by Netbase JSC. Facts about Finite State come from finitestate.io, read on 26 October 2026.

Sources

  1. Finite State: home and platform pages (read 26 Oct 2026)
  2. Finite State: EU Cyber Resilience Act page (read 26 Oct 2026)
  3. Finite State: industrial page (read 26 Oct 2026)
  4. Finite State: reachability-driven vulnerability prioritisation (read 26 Oct 2026)
  5. Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 14, EUR-Lex