Disclosure intake portal
A published, monitored channel where a researcher can report a flaw in your product and get an answer.
PSIRT AS A SERVICE // CRA & ENISA COMPLIANT
Solution 54 · Cyber Resilience Act
The CRA says you must have a PSIRT. We are one.
Every manufacturer selling a digital product in Europe must receive vulnerability reports, handle them, and notify ENISA of an actively exploited flaw within 24 hours. Thousands of mid-sized manufacturers cannot build that function and do not know where to start. We operate it for them.
The countdown is legal, not marketing
- Reporting duties bind
- Sept 2026
- Full obligations
- Dec 2027
- Notification window
- 24 hours
- Maximum fine
- €15M or 2.5%
Against those numbers, a monthly subscription is not really a decision.
What we operate on your behalf
Triage and assessment
Every report assessed for exploitability and impact against your actual product, not a generic CVSS score.
Researcher coordination
Managing the disclosure timeline with the finder — the part that goes publicly wrong when it is handled badly.
Advisory drafting
The customer-facing security advisory, written and versioned, in French, English and Arabic.
ENISA reporting
The 24-hour notification for actively exploited vulnerabilities, filed within the window on your behalf.
SBOM and update lifecycle
Product SBOMs maintained, embedded open-source monitored, and security updates tracked across the product lifetime.
Who this is for
Manufacturers of devices, software, IoT and machinery sold into the EU — the mid-sized ones with a real product team and no product-security function. If you ship firmware or software and you are not sure whether the CRA captures you, that is the conversation to have first.
Also relevant: solutions 21 (supply chain) · 12 (AppSec)Why almost nobody sells this
Consultants do one-off CRA readiness assessments. A PSIRT is not an assessment — it is a function that has to answer a researcher on a Sunday and file with ENISA inside 24 hours. Standing operation is rare, and that is exactly why we built it as a subscription rather than a project.
Competition: nearly none as a standing servicePSIRT ADVISORY HOTLINE
Twenty minutes tells you whether the CRA applies.
Bring your product list. We will tell you which products are in scope, what September 2026 requires of you, and whether you need us at all.
