Tools

Free browser tools for product security teams. Nothing is uploaded. SoftWSP publishes six tools that run entirely client-side in your browser: a security.txt/VDP generator, a CRA readiness self-check, an SBOM viewer, a CVSS v3.1/v4.0 calculator, a VEX generator (CycloneDX + CSAF) and an SBOM diff.

Last updated:

Tools by task

4 groups: Disclosure, Compliance, SBOM & VEX, Scoring. Each tool does one job in minutes and keeps your data on your machine.

Disclosuresecurity.txt and VDP generatorA researcher who finds a flaw in your product knows where to report it, and the report reaches your team first.FreeComplianceCRA readiness self-checkA product owner sees which of 8 CRA Annex I items are still open, and which one to start first.FreeSBOM & VEXSBOM viewerAn engineer sees every component, version and licence in an SBOM without writing a script.FreeSBOM & VEXSBOM diffA release manager sees exactly which components changed between two builds before signing off.FreeSBOM & VEXVEX generator (CycloneDX + CSAF)A PSIRT lead tells customers in machine-readable form whether a CVE affects the product, in both formats their tools read.FreeScoringCVSS v3.1 / v4.0 calculatorA security engineer gets a CVSS v3.1 and v4.0 score and vector for one finding, ready to paste into an advisory.Free

From tool to finished report

The tools cover one step; our services cover the whole job, delivered by engineers and priced by quote.

Engineer working on a laptop connected to a device test rig, surrounded by wiring harnesses and test hardware

Device firmware security: find the problems, then fix them

Firmware scan, SBOM and vulnerability report for device makers and brands, with optional remediation, maintenance and monitoring.

Two engineers in safety glasses working on an automated machine module at a workbench

Machine builders: know what is inside your machines

A report on the digital components inside one machine line and the published vulnerabilities that affect them.

Engineer in a hard hat checking terminal wiring inside an open industrial control cabinet

OT Snapshot: see what is really on your shop-floor network

Record shop-floor traffic from a mirror port, upload it, and receive a device inventory, vulnerabilities and a map of remote access.

Two engineers at a desk reviewing code together on a large monitor

PSIRT as a service: a vulnerability process you do not have to staff

An outsourced vulnerability intake and response process for device makers, including support for CRA early-warning and incident reports.

Standards the tools implement

Standard names belong to their owners and are used only to identify the formats; nominative use, no endorsement implied.

Guides behind the tools

CRA Checklist for Device and Firmware Makers

A practical Cyber Resilience Act checklist for embedded and firmware teams: what to do before 11 December 2027, and what is already due.

Updated

Firmware SBOM Without Source Code: A Practical Guide

How to build an SBOM for embedded firmware from binaries, choose CycloneDX or SPDX, use VEX to cut noise, and meet the Cyber Resilience Act SBOM duty.

Updated

CVSS v4.0 vs v3.1: What Changed in Vulnerability Scoring

FIRST CVSS v4.0 explained: Attack Requirements, Vulnerable vs Subsequent System impact, Supplemental metrics, and the CVSS-B/BE/BT/BTE labels vs v3.1.

Updated

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Need more than a quick self-check?

Talk to an expertChat with David on WhatsApp