Testing and vulnerability handling
Find weaknesses before attackers do, and be ready when a vulnerability is reported.
Every product has vulnerabilities. What counts is finding them first and handling them fast.
Testing shows whether your security holds up against real attacks before release. Vulnerability handling makes sure that weaknesses found later, by your team, by researchers or by customers, are triaged, fixed, disclosed and reported on time, for the whole support period.
Under the CRA, manufacturers must report actively exploited vulnerabilities within 24 hours since 11 September 2026. That needs a product security incident response team (PSIRT) that is ready before the first report arrives. We test your products like an attacker and build the PSIRT that keeps them secure afterwards.
Who it is for
- Manufacturers before release or certification
- Companies without a PSIRT or with an informal one
- Teams preparing for CRA Article 14
- Operators preparing for incidents in production
What vulnerability handling must cover now
A PSIRT is more than an inbox. These are the capabilities regulators, customers and researchers expect.
Intake
A public reporting channel
Researchers need a clear way to report, with a disclosure policy and safe-harbour terms.
Triage
Fast, consistent rating
Every report is reproduced, rated and assigned within a defined time.
Impact
Which products are affected?
Without an SBOM per product and version, impact analysis takes days instead of hours.
Fix
Patches across variants
Fixes must reach every affected variant and version still in support.
Report
CRA reporting clock
Early warning within 24 hours, notification within 72 hours, final report later, through the single reporting platform.
Disclose
Advisories for customers
Clear, machine-readable advisories so customers can act.
Peacetime
Proactive work
Monitoring of component vulnerabilities and lessons learned between incidents.
Proof
Tested before it matters
Test reports and drills give evidence for technical documentation and audits.
Our principles for testing and response
Testing and vulnerability handling work best as one loop: what testers find feeds the PSIRT, and what the PSIRT learns feeds the next test.
1
Test what the TARA says
Test scope follows the rated attack paths, so time goes to real risk.
2
Think like an attacker
Hardware, interfaces, apps and backend tested as one system.
3
Know your components
An SBOM per product and version is the basis of every impact decision.
4
Clock-ready
Roles, templates and decisions prepared for the 24-hour deadline.
5
Coordinated disclosure
Researchers are partners, with clear rules on both sides.
6
Learn and repeat
Every finding improves requirements, tests and the process.
How we help
From pre-release testing to a running PSIRT. Each service has a clear scope and a defined result.
Penetration testing of products
Your product, attacked under controlled conditions.
What we do
- Hardware and interfaces such as debug, USB, CAN, Ethernet and radio
- Firmware analysis and update mechanisms
- Scope derived from the threat analysis
You receive
Report with findings, severity and fixes; retest
Backend, app and cloud testing
The parts of the product that live outside the device.
What we do
- Web interfaces, APIs and mobile apps
- Cloud configuration and authentication
- Device to backend communication
You receive
Report with findings and fixes; retest
PSIRT set-up
A team and process for incoming vulnerabilities.
What we do
- Roles, intake, triage, fix and disclosure based on the FIRST PSIRT Services Framework
- Coordinated vulnerability disclosure policy and security.txt
- Advisory templates and customer communication
You receive
PSIRT charter, process, policy, templates
SBOM and component monitoring
Know which products a new vulnerability affects.
What we do
- SBOM generation and quality checks per product
- Monitoring of component vulnerabilities
- Impact assessment workflow
You receive
SBOM process, monitoring set-up, impact workflow
CRA reporting readiness and drill
Ready for Article 14 before it matters.
What we do
- Map the reporting duties to your process
- Prepare early warning, notification and final report
- Rehearse with a realistic scenario
You receive
Reporting playbook, drill report
Incident readiness for OT
Prepared for incidents in production.
What we do
- Response plans for production environments
- Roles between IT, OT and suppliers
- Tabletop exercises
You receive
Response plan, exercise report
How we work
Step 1
Scope
Test targets and PSIRT scope from the risk assessment.
Step 2
Test or build
Testing, or setting up the PSIRT process.
Step 3
Fix
Findings with clear fixes, then a retest.
Step 4
Rehearse
Drill and hand-over to your team.
Standards and regulations
CRA Annex I Part II and Article 14
Vulnerability handling and reporting duties for manufacturers.
ISO/IEC 29147 and 30111
Receiving and disclosing vulnerability reports, and handling them internally.
FIRST PSIRT Services Framework
Reference for the services and capabilities of a PSIRT.
IEC 62443-4-1
Security testing and defect management in the development lifecycle.
ISO/SAE 21434 and UN R155
Vulnerability analysis and monitoring for vehicles in the field.
FDA postmarket guidance
Vulnerability management for medical devices on the US market.
Industries
Embedded devices, machines, vehicles, medical devices and the backends behind them.
Why Nord CS
Our team holds IEC 62443 Expert, TISAX and NIS2 implementer qualifications, and our founder serves on the ENISA Advisory Board. AITIGRITY generates test cases from requirements and links every vulnerability to its product, version and fix.
Talk to a consultantQuestions we often hear
Black box or white box testing?
Both are possible. White box testing with documentation usually finds more in less time.
Who do we report to under the CRA?
To the CSIRT designated as coordinator and to ENISA, through the single reporting platform.
Do small companies need a PSIRT?
You need the process. It can be run by a small team, as long as roles and deadlines are clear.
What is the difference between a CSIRT and a PSIRT?
A CSIRT protects your own IT. A PSIRT handles vulnerabilities in the products you sell. Under the CRA, manufacturers need the second.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.