To set up a PSIRT, a hardware company needs a published way to receive vulnerability reports (a disclosure policy and a security.txt file), a named owner who triages every report, a process to fix and disclose in coordination with the reporter (ISO/IEC 29147 and 30111), and, for products sold in the EU, the Cyber Resilience Act reporting route: an early warning within 24 hours and a notification within 72 hours. SoftWSP runs that process for you as a service.
The PSIRT service connects to the rest of the loop: scan, AI-assisted fix, re-scan as proof, and monitoring that feeds new vulnerabilities into your queue. Case records cite their evidence, and Netbase JSC, the company behind SoftWSP, can connect your own AI tools to your case data as a custom service. Selling connected products brings a duty that has nothing to do with engineering a new model: when someone finds a vulnerability, you must receive it, judge it and respond, sometimes within hours. Most device makers do not have a team for that. We provide one.
At a glance
Early warning within 24 hours, full notification within 72 hours
Draft disclosure policy and security.txt included
Combines with firmware scanning and monitoring
Delivered remotely, worldwide
The problem
R&D teams are busy building the next product, and the old products still need care for the whole support period you have promised. Meanwhile the rules expect a working process.
- The EU Cyber Resilience Act introduces reporting duties for actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours and a fuller notification within 72 hours. These reporting duties apply from September 2026.
- The UK product security rules require a way to report vulnerabilities and a published support period.
- Importers, distributors and retailers are starting to ask which process stands behind a product.
A shared mailbox that nobody watches is not a process. A report that arrives on a weekend still has a clock running.
Delivery timeline
We review your products, your current process and your support promises. We agree on the policy, contact route and escalation contacts on your side. Reports arrive through the channel you publish. We triage them and notify you. You decide on the response. We draft the communications and help prepare the fix. If reporting criteria are met, we prepare the early warning inside the 24-hour window and the follow-up within the 72-hour window, for your approval. We close the case with a record you can show to a customer or regulator.
What do you need to prepare?
- A named contact at your company who can make decisions out of hours, or a clear rule for who decides.
- A list of your products and firmware versions, or firmware files we can analyse to produce one.
- Your declared support period for each product.
- Agreement on how and when you want to be notified.
What we do
Intake
We help you publish a vulnerability disclosure policy and a security.txt file, and set up a dedicated reporting address and page.
Triage
We acknowledge each report, reproduce or assess it, and classify its severity and exposure.
Researcher contact
We stay in touch with the reporter, agree timelines and follow coordinated disclosure.
Impact analysis
We check which of your products and firmware versions contain the affected component, using the SBOMs you hold or that we generated.
Regulatory reporting support
If a vulnerability is actively exploited, we prepare draft early-warning and follow-up reports for you to review, sign and submit.
Remediation links
Where you hold the source code, the same team can prepare the fix through our firmware services.
What you receive
- A published disclosure policy and security.txt, ready to host on your own site.
- A documented process with roles, response times and templates.
- Case records for every report: what arrived, what was decided, what was done, and when.
- Draft regulatory reports when a case meets the reporting criteria.
- A periodic summary of open cases and component exposure across your range.
What is in scope?
Supported
- A vulnerability disclosure policy, a security.txt file and a dedicated reporting address and page
- Triage, researcher contact and coordinated disclosure
- Impact analysis across your products and firmware versions
- Draft early-warning and follow-up reports when a case meets the reporting criteria
Not included
- Submitting and signing reports to a regulator or authority, which stays with you
- Releasing fixes
- Publishing unfixed issues in your products without your agreement
- A guarantee that no vulnerability will be exploited
Extra services
- Firmware scans and monitoring that feed new vulnerabilities into your PSIRT queue
- Fix preparation through our firmware services, where you hold the source code
See a sample report
Sample Machine SBOM & Vulnerability Report
Scope and responsibilities
We provide the process, the analysis and the drafts. You make the decisions, you release fixes, and you submit and sign any report to a regulator or authority. We do not guarantee that no vulnerability will be exploited, and the quality of our impact analysis depends on the accuracy of the information you give us. We follow coordinated disclosure: we do not publish issues in your products without your agreement unless they are already public from another source. See our terms and disclaimer.
How does a quote work?
RequestSend the quote form with PSIRT as a Service for Device Makers preselected, or use the email and WhatsApp options on this page. Tell us about your product or site and what you need. Scoping callA short call with our engineer to confirm the inputs, the scope and what is not included. Fixed quoteYou receive a written quote for the agreed scope. Contracts and invoices are issued by Netbase JSC. DeliveryWe agree the timing with you before work starts, then deliver as set out in the delivery timeline above.
Delivered by Netbase Solution Services
- Founded
- 2012
- Reach
- Clients in around 80 countries
- Delivery model
- Remote, worldwide
- Parent company
- A brand of Netbase JSC (Netbase Enterprise Solutions and Applications Joint Stock Company)
Frequently asked questions
What is a PSIRT?
A product security incident response team. It is the group that receives vulnerability reports about your products, assesses them and coordinates the response.
Do you file the CRA report for us?
We draft the reports required by Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847). The European Commission's own CRA reporting page states manufacturers must submit "an early warning within 24 hours of becoming aware" of an actively exploited vulnerability "and a full notification within 72 hours." The manufacturer remains responsible for submitting and signing them.
Do we need to publish a vulnerability policy?
Yes. Annex I Part II points (5) and (6) of the Cyber Resilience Act (Regulation (EU) 2024/2847) require a coordinated vulnerability disclosure policy and a contact address for reports, and the UK Product Security and Telecommunications Infrastructure (PSTI) regime requires one too. We help you publish a clear policy and a security.txt file.
Will you contact researchers on our behalf?
Yes, if you want. We acknowledge reports, ask for details and keep the researcher informed, while you stay in control of decisions.
Can this be combined with firmware analysis?
Yes. Firmware scans and monitoring feed the same process, so new vulnerabilities in components you have shipped can enter your PSIRT queue.
Do you publish vulnerabilities?
Only in line with coordinated disclosure and your agreement. Public disclosure of an unfixed issue is not part of the service.
How do you set up a PSIRT and vulnerability disclosure process for a hardware company?
Publish a disclosure policy and security.txt, name an owner who acknowledges and triages each report, agree fix and disclosure timelines with the reporter in line with ISO/IEC 29147 and 30111, and prepare the Cyber Resilience Act route for actively exploited vulnerabilities and severe incidents.
Can SoftWSP deliver the PSIRT service to a company in my country?
Yes. The PSIRT service is delivered remotely, worldwide: you send the inputs over an encrypted channel and we do the work from our side. Netbase JSC, the company behind SoftWSP, has worked with clients in 80 countries.
Do you work with companies in my industry?
Yes, if you make or sell connected products: cameras, routers, access control, chargers, inverters, smart-home and industrial IoT devices, including brands that hold only a binary firmware file from an ODM.
How do I pay for the PSIRT service?
Contracts and invoices are issued by the company, Netbase JSC. You pay by bank transfer to the company account or by PayPal Business. Unless the order says otherwise, invoices are payable within 15 days.
Who do I talk to about the PSIRT service?
Huy Nguyen (David), CEO of Netbase JSC, by WhatsApp at +84 937 869 689 (wa.me/84937869689) or by e-mail at [email protected].