SoftWSP's device firmware security service scans your binary firmware image, even without source code, builds its software bill of materials (SBOM), matches every component to published vulnerabilities from the CVE database, CISA KEV and FIRST EPSS, and ranks what to fix first. Where you hold the source code, we prepare the fix, test it, scan again as proof and monitor every version you ship.
SoftWSP closes the loop: scan, AI-assisted fix, re-scan as proof, then monitoring of every version you ship. AI-written findings cite their evidence and an engineer reviews them. If you want your own AI tools to query findings and alerts, Netbase JSC, the company behind SoftWSP, builds that connection as a custom service. If you sell connected products, your firmware is a product in its own right. It contains open-source components that age, settings that were convenient in development, and update mechanisms that must be right the first time. We analyse it, explain what we find, and help you fix it.
At a glance
Works from the binary image — no source code needed
Scan, fix, re-scan as proof, then monitoring
Delivered remotely, worldwide
The problem
Many device makers cannot easily keep firmware up to date, and the reasons are practical rather than careless.
- Economics. Margins are thin, a model sells for a year or two, and updates add cost but no revenue.
- No source code. Branded products often come from an ODM, and the brand holds only a binary file.
- Frozen SDKs. The chip vendor stops supporting an SDK, and the kernel is stuck on an old version.
- No way to rebuild. The engineer who built the release has left, and nobody can reproduce what is on the market.
- Fear of a bad update. Without rollback, one faulty update can mean thousands of returned devices.
At the same time, rules now ask for more. The EU Cyber Resilience Act brings vulnerability handling and an SBOM. Radio equipment in the EU falls under the RED delegated act and the EN 18031 standards. The UK product security rules have applied since April 2024. Buyers, retailers and importers are starting to ask for proof.
Delivery timeline
You upload the firmware under a confidentiality agreement. Our engine analyses it automatically and an engineer reviews the output. You receive the report and a short walkthrough call. If you choose remediation, we agree the scope in writing, then patch, build, test in an emulated environment and scan again. When real hardware testing is needed, you set up a small lab and we work through it remotely. We hand over the result. You sign and release the firmware with your own keys.
What do you need to prepare?
- The firmware image of the version you actually sell.
- For remediation: the source code or SDK, and the build instructions if they exist.
- For hardware testing: two or three sample devices, a computer that stays on during the job, a network connection, and one engineer who can attend the test sessions. We send a checklist.
What we do
Firmware scan
We unpack the image, identify the components and versions inside, and list the published vulnerabilities that affect them.
Configuration checks
We look for hard-coded passwords, embedded keys, debug services left on, open network services and update mechanisms that are not signed.
AI-BOM and secrets checks
We look for AI models, inference runtimes and API keys or tokens embedded in the image, and list them in an AI bill of materials alongside the software SBOM.
Compliance mapping
We map findings to the relevant requirements, such as EN 303 645, EN 18031 and the UK rules, as an indicative view.
Remediation
Where you hold the source code and can build it, we update vulnerable components, harden the configuration, write the patches and rebuild.
Maintenance
We can look after older models for the support period you have promised, so your own R&D team can focus on the next product.
Monitoring
When a new vulnerability affects a component in firmware you have already sold, we alert you, ranked by how likely it is to be exploited.
What you receive
- A summary report for management and a detailed report for engineers, with evidence for each finding.
- A software bill of materials in a standard format, which you can reuse for customers and regulators.
- A prioritised fix list with the official fix or a mitigation for each item.
- For remediation jobs: patches, a rebuilt image, a changelog, and a before-and-after scan, plus a rollout and rollback guide.
What is in scope?
Supported
- Binary firmware images such as .bin, .img and .zip, with no source code needed for the scan
- Remediation when you hold the source code and can build it
- Testing in an emulated environment
- Real-device testing through a small lab you set up at your site, reached remotely
Not included
- Encrypted firmware images, which cannot be unpacked
- Changing firmware without the source code and build environment
- Holding or operating your devices
- Signing and releasing the firmware, rollout, radio-approval re-testing and regulatory filings, which stay with you
- A compliance certificate: the report supports your compliance work
Extra services
- Maintenance of older models for the support period you have promised
- Monitoring of firmware you have already sold, with alerts ranked by how likely a vulnerability is to be exploited
- PSIRT as a service, fed by the same scans and monitoring
See a sample report
Sample Machine SBOM & Vulnerability Report
Scope and responsibilities
We are responsible for the analysis, the reports and the agreed fixes. You are responsible for the right to share the code with us, for signing and releasing the firmware, for rollout, for any re-testing needed for radio approvals, and for regulatory filings. Emulated tests are not a substitute for tests on real devices, and a report reflects the known vulnerabilities on the day of analysis. See our disclaimer.
How does a quote work?
RequestSend the quote form with Device Firmware Security Analysis and Remediation preselected, or use the email and WhatsApp options on this page. Tell us about your product or site and what you need. Scoping callA short call with our engineer to confirm the inputs, the scope and what is not included. Fixed quoteYou receive a written quote for the agreed scope. Contracts and invoices are issued by Netbase JSC. DeliveryWe agree the timing with you before work starts, then deliver as set out in the delivery timeline above.
Delivered by Netbase Solution Services
- Founded
- 2012
- Reach
- Clients in around 80 countries
- Delivery model
- Remote, worldwide
- Parent company
- A brand of Netbase JSC (Netbase Enterprise Solutions and Applications Joint Stock Company)
Frequently asked questions
Can you analyse firmware if we do not have the source code?
Yes. The scan works on the binary firmware file. Fixing is different: we can only change firmware when the source code and build environment are available. If they are not, we help you request them from your ODM.
What file formats do you accept?
Common firmware images such as .bin, .img and .zip. Encrypted images cannot be unpacked, so please send an unencrypted build if you can.
Will you publish what you find?
No. Findings in your firmware are not published without your agreement, unless the issue is already public from another source.
Do you test on real devices?
Yes, when a job needs it. You set up a small lab at your site with sample devices and give us remote access. We never hold or operate your devices.
Does the report make us compliant?
No. It supports your compliance work. Under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), it is not a certificate, and the manufacturer or importer remains responsible for compliance.
How long does a scan take?
It depends on the firmware and how well it unpacks. We confirm the timing when you send the file.
Can SoftWSP deliver firmware security analysis to a company in my country?
Yes. Firmware security analysis is delivered remotely, worldwide: you send the inputs over an encrypted channel and we do the work from our side. Netbase JSC, the company behind SoftWSP, has worked with clients in 80 countries.
Do you work with companies in my industry?
Yes, if you make or sell connected products: cameras, routers, access control, chargers, inverters, smart-home and industrial IoT devices, including brands that hold only a binary firmware file from an ODM.
How do I pay for firmware security analysis?
Contracts and invoices are issued by the company, Netbase JSC. You pay by bank transfer to the company account or by PayPal Business. Unless the order says otherwise, invoices are payable within 15 days.
Who do I talk to about firmware security analysis?
Huy Nguyen (David), CEO of Netbase JSC, by WhatsApp at +84 937 869 689 (wa.me/84937869689) or by e-mail at [email protected].
Related reading
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text, EUR-Lex
- Commission Delegated Regulation (EU) 2022/30 (RED delegated act, EN 18031), EUR-Lex
- UK government: The UK Product Security and Telecommunications Infrastructure (PSTI) product security regime
- ETSI EN 303 645 V3.1.3, Cyber Security for Consumer Internet of Things: Baseline Requirements