PSIRT as a service: a vulnerability process you do not have to staff

Last updated: 2026-10-19

The PSIRT service connects to the rest of the loop: scan, AI-assisted fix, re-scan as proof, and monitoring that feeds new vulnerabilities into your queue. Case records cite their evidence, and MCP access for your own AI agents is coming. Selling connected products brings a duty that has nothing to do with engineering a new model: when someone finds a vulnerability, you must receive it, judge it and respond, sometimes within hours. Most device makers do not have a team for that. We provide one.

The problem

R&D teams are busy building the next product, and the old products still need care for the whole support period you have promised. Meanwhile the rules expect a working process.

• The EU Cyber Resilience Act introduces reporting duties for actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours and a fuller notification within 72 hours. These reporting duties apply from September 2026.
• The UK product security rules require a way to report vulnerabilities and a published support period.
• Importers, distributors and retailers are starting to ask which process stands behind a product.

A shared mailbox that nobody watches is not a process. A report that arrives on a weekend still has a clock running.

What we do

• Intake. We help you publish a vulnerability disclosure policy and a security.txt file, and set up a dedicated reporting address and page.
• Triage. We acknowledge each report, reproduce or assess it, and classify its severity and exposure.
• Researcher contact. We stay in touch with the reporter, agree timelines and follow coordinated disclosure.
• Impact analysis. We check which of your products and firmware versions contain the affected component, using the SBOMs you hold or that we generated.
• Regulatory reporting support. If a vulnerability is actively exploited, we prepare draft early-warning and follow-up reports for you to review, sign and submit.
• Remediation links. Where you hold the source code, the same team can prepare the fix through our firmware services.

What you receive

• A published disclosure policy and security.txt, ready to host on your own site.
• A documented process with roles, response times and templates.
• Case records for every report: what arrived, what was decided, what was done, and when.
• Draft regulatory reports when a case meets the reporting criteria.
• A periodic summary of open cases and component exposure across your range.

How it works

1. We review your products, your current process and your support promises.
2. We agree on the policy, contact route and escalation contacts on your side.
3. Reports arrive through the channel you publish. We triage them and notify you.
4. You decide on the response. We draft the communications and help prepare the fix.
5. If reporting criteria are met, we prepare the early warning inside the 24-hour window and the follow-up within the 72-hour window, for your approval.
6. We close the case with a record you can show to a customer or regulator.

What you prepare

• A named contact at your company who can make decisions out of hours, or a clear rule for who decides.
• A list of your products and firmware versions, or firmware files we can analyse to produce one.
• Your declared support period for each product.
• Agreement on how and when you want to be notified.

Scope and responsibilities

We provide the process, the analysis and the drafts. You make the decisions, you release fixes, and you submit and sign any report to a regulator or authority. We do not guarantee that no vulnerability will be exploited, and the quality of our impact analysis depends on the accuracy of the information you give us. We follow coordinated disclosure: we do not publish issues in your products without your agreement unless they are already public from another source. See our terms and disclaimer.

Next step

If your products are on sale in the EU, the reporting duties are already a practical question. The Design Partner programme is a low-risk way to test how this would work for you.

Join the Design Partner programme