Machine builders: know what is inside your machines

Last updated: 2026-10-19

Softwsp covers the whole loop for the software you own: scan, AI-assisted fix, re-scan as proof, and monitoring of machines you have sold. Findings cite their evidence, and MCP access for your own AI agents is coming. Your automation team is good at electrics, mechanics and PLC programming. Security questions from buyers and regulators are a different skill, and most machine builders do not have a security team. We fill that gap, starting from a list you already have.

The problem

From January 2027, the EU Machinery Regulation 2023/1230 applies. It asks that machines sold in the EU be protected against corruption, including through their software and network connections. The EU Cyber Resilience Act adds vulnerability handling and an SBOM for products with digital elements. Large plant owners increasingly write IEC 62443 into their purchase contracts, and send suppliers security questionnaires.

A typical machine contains parts from many vendors: a PLC from one, an HMI from another, drives, a gateway, an industrial PC. Each has its own firmware and its own list of published vulnerabilities. Few builders can say what the whole machine contains, and fewer can say what is known to be wrong with it. Machines then stay in service for ten to twenty years, often with a remote access tool that nobody reviews.

What we do

Starting from the electrical bill of materials for one machine line, we work out:

• Which digital components are inside. PLC, HMI, drives, gateways and industrial PC, with model and firmware.
• Which published vulnerabilities affect them. We use CISA ICS advisories, vendor PSIRT notices and the CVE database.
• What to do first. Items are ranked by what attackers actually exploit today, with the official fix or a mitigation.
• Where you stand. An indicative matrix against the Machinery Regulation, the Cyber Resilience Act and IEC 62443-4-2.

Beyond the first report, we can also:

• Analyse software you wrote yourself, such as a Linux gateway, an HMI application or a cloud connector, which you own and can patch.
• Review PLC and HMI project files you export, for weak passwords, unnecessary services and unencrypted protocols.
• Design a safer remote service setup with strong authentication, approved sessions and logging.
• Prepare draft technical documentation and answers to customer security questionnaires.
• Monitor the components in machines you have already sold and alert you when a new vulnerability appears.

What you receive

• A Machine SBOM and Vulnerability Report for one machine line, in plain language for management and in detail for engineers.
• An indicative readiness matrix for the regulations above.
• A short call with our engineer to walk through the report.

How it works

1. You send the component list for one machine line.
2. We identify each component and match it to published advisories.
3. An engineer reviews the result and writes the report.
4. You receive the report within 72 hours of a usable list, and we go through it together.

What you prepare

• The component list of one machine line: manufacturer, model, and firmware where known. Photos of device labels also help.
• One engineer who can answer a few questions by email or call.

Scope and responsibilities

The report is based on the information you share. It does not test your machine and it is not a certification. We do not patch the firmware of third-party PLCs, robots or CNC controllers; we show you the vendor’s fix or a mitigation. You stay in charge of decisions about your machines and of your compliance filings. Where a fix involves changing a running machine, your own engineers decide and carry it out under your safety procedures.

Next step

The first five machine builders receive this report free of charge in our Design Partner programme.

Join the Design Partner programme