SoftWSP vs Finite State comes down to how you want to work. Finite State is a product security platform: your team uploads firmware, manages SBOMs and VEX across many products and uses its CRA features in-house. SoftWSP is an engineer-delivered service: we analyse the firmware, an engineer reviews each finding, and where you hold the source code we prepare, build and test the fix, with fixed-scope report prices on a published price list.
Disclosure. This page is published by SoftWSP, which is a brand of Netbase JSC, founded in 2012. Facts about Finite State come from finitestate.io, read on 26 October 2026. Where Finite State does more, we say so.
Side-by-side
| Finite State | SoftWSP | |
|---|---|---|
| Model | Self-service platform (SaaS or on-prem) | Engineer-delivered service, remote, worldwide |
| Binary firmware, no source | Yes, 50+ instruction sets | Yes |
| SBOM | CycloneDX, SPDX, living SBOM per release | Included in the report, one per firmware version |
| Prioritisation | Reachability, exploit intelligence, policy thresholds | CVE database, CISA KEV, FIRST EPSS, engineer review |
| VEX | Yes | Free VEX generator: CycloneDX and CSAF, one statement at a time |
| CRA | Drafts Article 14 notifications, technical file and declaration template, evidence packs | PSIRT service drafts Article 14 early-warning and follow-up reports |
| Fixing | Not publicly listed | Prepares, builds and tests fixes when you hold the source, then re-scans as proof |
| OT / industrial | Lists PLC/SCADA and IEC 62443 coverage | Separate passive OT Snapshot service for plants |
| Target | Device makers in automotive, medical, energy, government, industrial | Small and mid-size device makers, machine builders, plants |
| Price | Not publicly listed | Published price list: pricing |
Which one fits your team?
Choose Finite State if
- you manage many product lines and want your own team to run the analysis every release
- you need VEX documents and SBOM management at scale
- you want CRA notification drafting and technical-file assembly inside one platform
Choose SoftWSP if
- you have no security team and want findings explained in plain language
- you hold the source code and want someone to prepare and test the fix, not just report
- you want to know the price before a sales call, or start with one firmware version
How does SoftWSP work?
ScanWe unpack the binary firmware image, even without source code, build its SBOM and match every component to the CVE database, CISA KEV and FIRST EPSS. An engineer reviews every AI-written finding before you receive the report. AI-assisted fixWhere you hold the source code, we agree the scope in writing, then patch, build and test the firmware in an emulated environment. AI-written work cites its evidence and an engineer reviews it. Re-scan as proofWe scan the fixed build again, so the before-and-after result shows the vulnerability is gone. You sign and release the firmware with your own keys. MonitorWhen a new vulnerability affects a component in firmware you have already sold, we alert you, ranked by how likely it is to be exploited.
Details: device firmware security, PSIRT service, pricing.
What does a SoftWSP report look like?
Sample Machine SBOM & Vulnerability Report: sample report (hypothetical machine)
SoftWSP's sample deliverable, for reference: a component SBOM, real public vulnerabilities ranked by priority with the source of each one, an indicative compliance mapping and a plan of recommended actions. The other tools on this page were not assessed against it.
Frequently asked questions
What is the main difference between SoftWSP and Finite State?
Finite State is a product security platform that device makers use themselves across many products. SoftWSP is an engineer-delivered service: we analyse your firmware, review every finding and, where you hold the source code, prepare and test the fix. SoftWSP publishes a price list for its fixed-scope reports at softwsp.com/pricing/; Finite State lists no prices on finitestate.io (read 26 October 2026).
Is SoftWSP cheaper than Finite State?
SoftWSP publishes its fixed-scope report prices on its pricing page, softwsp.com/pricing/. Finite State lists no prices on finitestate.io (read 26 October 2026), so a direct comparison needs a quote from Finite State.
Which is better for CRA Article 14 reporting?
Both help with drafts. Finite State's own CRA page states its platform provides "draft notifications for each CRA deadline" for the customer to decide on and file. SoftWSP's PSIRT service drafts the early-warning and follow-up reports for the manufacturer to submit. In both cases the manufacturer files and stays responsible.
Does SoftWSP support VEX like Finite State?
In different ways. Finite State manages VEX statuses across many products inside its platform. SoftWSP offers a free VEX generator that creates a CycloneDX VEX statement and a CSAF VEX document in your browser, one product and one vulnerability at a time. SoftWSP service reports carry the SBOM and the reviewed findings that a VEX statement is based on.
Is SoftWSP a credible vendor for small device makers?
SoftWSP is a brand of Netbase JSC, a Hanoi software company founded in 2012 that has worked with clients in around 80 countries. Its guides, advisories, free tools and prices are public, and every finding is reviewed by an engineer. Small device makers can start with one report and judge the result.
Who wrote this comparison?
SoftWSP, built by Netbase JSC. Facts about Finite State come from finitestate.io, read on 26 October 2026.
Related reading
Sources
- Finite State: home and platform pages (read 26 Oct 2026)
- Finite State: EU Cyber Resilience Act page (read 26 Oct 2026)
- Finite State: industrial page (read 26 Oct 2026)
- Finite State: reachability-driven vulnerability prioritisation (read 26 Oct 2026)
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 14, EUR-Lex