The problem
Machine software contains many third-party libraries: in the operating system, in the containers, in the operator app. When a vulnerability becomes known in one of them, you need to know whether your machines are affected and ship an update.
At many manufacturers this depends on individual people. Which version runs where is not written down anywhere. Updates are installed when a technician happens to be on site. The Cyber Resilience Act turns this into an obligation with deadlines and a support period that, as a rule, lasts at least five years.
SBOM, vulnerability scans and security updates
Every release automatically produces a software bill of materials (SBOM) in the build pipeline. For every version it is documented what is inside.
The pipeline checks every version against known vulnerabilities, and the check keeps running afterwards, including for versions already in the field. We assess each finding by whether the affected function is reachable and how urgent an update is. In addition, we use AI-assisted reviews of code and dependencies, with tools by agreement.
If an update is needed, we build and test it and roll it out over the air. The device inventory shows which devices already have it. Logs record which version reached which device and when.
What you get
- a pipeline that produces an SBOM and a vulnerability report for every version
- a defined process for handling vulnerabilities that are found
- security updates, built, tested and rolled out
- a regular report on the state of your fleet
- as an ongoing service for the support period if you want it
Limits
We implement technical requirements in software. Whether your product complies is for your legal and standards experts or a notified body to assess. We do not offer legal advice, risk assessment under the Machinery Regulation, CE marking or certifications, and no 24/7 on-call service.