In short: SoftWSP, a brand of Netbase JSC, is responsible for the firmware analysis, reports, SBOM and the patching and re-scanning it agrees to do within scope; the customer is responsible for the source code, the test lab, operating its own devices and networks, and for any compliance filing it submits. SoftWSP's work is not a certification, carries no guarantee that a product is free of vulnerabilities, and does not extend to operating a customer's production systems. The table and numbered limits below set out the detail. This page forms part of our terms.
Who does what
| Area | SoftWSP | Customer |
|---|---|---|
| Firmware analysis, reports, SBOM | Responsible | Provides the file of the version actually sold |
| Source code and SDK that can be built, and the legal right to use them | Not applicable | Responsible |
| Patching within the agreed scope, emulated tests, re-scan | Responsible | Approves the scope |
| Test lab at the customer's site, sample devices, network access, coordinating engineer | Sends a checklist and checks the lab remotely | Responsible |
| Tests on real devices to the agreed test set | Carries them out remotely | Cooperates and confirms results |
| Firmware signing and key management | Supports the process | Responsible and holds the keys |
| Re-testing for radio or product approvals if a change affects them | Points out items that may be affected | Responsible |
| OTA release and mass rollout | Only if rollout service is purchased, following a plan the customer approves | Responsible by default |
| Operation of devices, machines, power and networks at the customer's site | Does not do this | Responsible |
| Compliance filings and reports to authorities | Drafts documents if purchased | Responsible for submitting and signing |
| Network recordings and changes to running networks (plants) | Gives guidance only | Records, decides and applies changes |
| Vulnerabilities found after hand-over | Alerts if a monitoring service is purchased | Decides and applies fixes |
Limits of our work
- No absolute assurance. Reports reflect the vulnerabilities and issues known on the date of analysis, for the firmware version or information provided. We do not guarantee that a product is free of vulnerabilities, and we make no claim of absolute security.
- Not a certification. Our reports and documents support compliance work. They are not certificates from a testing laboratory or competent authority. Compliance remains the responsibility of the manufacturer or importer.
- Information supplied by you. We are not responsible for errors that result from incorrect or incomplete files, source code, SDKs or information supplied.
- Scope. Fixes cover only the items in the signed scope. Anything else is a new request.
- Emulated environments. Tests in emulation do not fully represent real hardware. The customer confirms results of tests on real devices before release.
- Release and rollout. The customer decides on release, signing, rollout and rollback, except where a purchased rollout service was carried out according to the approved plan.
- Sample devices. Sample devices are supplied for testing. We are not responsible for damage to sample devices when the agreed procedure was followed.
- Re-certification. The cost and responsibility for any re-testing or re-certification lie with the customer.
- Liability. Our total liability is limited as set out in the terms and does not cover indirect loss such as lost revenue, recalls or business interruption.
- Confidentiality and data. Customer material is used only for the job, stored encrypted and deleted at the agreed time, under a mutual confidentiality agreement.
- Disclosure. Vulnerabilities found in a customer's firmware are not published without the customer's agreement, unless already public from another source.
- Rights in the material. The customer warrants that it has the legal right for us to analyse and, where agreed, modify the material provided.
Additional limits for industrial and plant work
- Passive recordings only. A network recording reflects only the traffic seen during the recording period. Devices that did not communicate in that time will not appear, and identification of models and firmware from traffic may be incomplete.
- No operation of production systems. We do not operate on running machines or production networks, and we do not run active scans on production networks. Active testing happens only on a lab or sample machine with written agreement.
- No patching of third-party controllers. We do not patch the firmware of PLCs, robots or CNC controllers made by other vendors. We point to the vendor's official fix or to a mitigation.
- Recommendations need local review. Recommendations must be assessed by a qualified engineer at the customer under the plant's safety procedures before they are applied. SoftWSP is not liable for production interruption, damage to machines or safety incidents that arise when recommendations are applied.
Website content
Guides and articles on this website are general information, not legal advice. Please check the current official text of each regulation and obtain advice for your own situation.
Image credits
Photos on this site that are not our own content are stock or public-domain photos used under the licence named below, with full source and licence details for every file in our third-party attribution notice. The people in stock photos are not SoftWSP or Netbase JSC staff.
- Home page hero: photo by ThisIsEngineering (Pexels), Pexels License, cropped.
- Device Firmware Security service photo (also the Services page hero): photo by ThisIsEngineering (Pexels), Pexels License, cropped.
- Machine Builders service photo: photo by Mikhail Nilov (Pexels), Pexels License, cropped.
- OT Snapshot service photo (also the Industries page hero): photo by Shameer Vayalakkad Hydrose (Pexels), Pexels License, cropped.
- PSIRT service photo: photo by Mikhail Nilov (Pexels), Pexels License, cropped.
- Medical devices page: U.S. Food and Drug Administration, public domain, cropped.
- Building automation page: photo by Shixart1985 (Wikimedia Commons), CC BY 2.0.
- Energy and utilities, consumer IoT and industrial automation OEM pages: photos by ThisIsEngineering (Pexels), Pexels License, cropped.
- Pricing page: photo by Vitaly Gariev (Pexels), Pexels License, cropped.
- Contact page and the About page team photo: photos by Mikhail Nilov (Pexels), Pexels License, cropped.
- Meeting-room photo on other pages: photo by Thirdman (Pexels), Pexels License, cropped.
- Footer photo: photo by Kateryna Babaieva (Pexels), Pexels License, cropped.
- About page hero (Hanoi skyline): photo by Quangnlnhe182394 (Wikimedia Commons), CC0.
Sample-report and advisory-page screenshots are our own content.
Contact
Questions about this page: see the contact page.
Frequently asked questions
Does a SoftWSP report guarantee a product is free of vulnerabilities?
No. Reports reflect the vulnerabilities and issues known on the date of analysis, for the firmware version or information provided. SoftWSP does not guarantee that a product is free of vulnerabilities and makes no claim of absolute security.
Is a SoftWSP report a certification?
No. SoftWSP reports and documents support compliance work, such as CRA or Machinery Regulation filings, but they are not certificates issued by a testing laboratory or a competent authority. Compliance remains the responsibility of the manufacturer or importer.
Who operates my devices, network or production systems during a SoftWSP engagement?
The customer does. SoftWSP does not operate production machines or plant networks, does not run active scans on production networks, and does not patch the firmware of third-party PLCs, robots or CNC controllers. Active testing happens only on a lab or sample machine with written agreement, and recommendations need review by a qualified engineer at the customer before they are applied.