Vulnerability handling for connected products

Hundreds of vulnerabilities a month. Almost none are yours.

Firmpath figures out which ones actually reach the firmware you've shipped, and drafts the customer notices, VEX statements and disclosure records that go with them. Someone on your team looks over each call before anything goes out.

Try it free Book fifteen minutes

Free for one product: upload an SBOM, see what reaches it. No card, no password — we email you a code.
Built for teams shipping on ESP-IDF, Zephyr, STM32Cube, Yocto and Buildroot.

This week's queue Illustration
Memory safety issue in a wireless stack Affected reaches two field builds · feature enabled in config
Buffer overflow in a TLS library Not affected your release sits outside the affected range
Auth bypass in an HTTP server component Not affected component is not linked into any shipped image
Parsing flaw in a vendored JSON library Needs you local copy was patched · one question for an engineer
Privilege escalation in a filesystem driver Not affected driver is disabled at build time

One thing to decide, and four "not affected" statements ready to send — already written up and dated.

What it does

It works out which advisories actually matter to you.

Most tools will tell you a component has a vulnerability. The harder questions are whether it reaches a product you've already shipped, what to tell the customer who asks, and how to show a year later what you decided and why.

Step one

It keeps track of what went into each build

A small step in your CI picks up what the build actually contained — which SDK release, what got linked, which options were switched on — and keeps a component list for every product, revision and firmware version. It only ever sends metadata, so your source and your images stay where they are.

Step two

It reads the advisories so nobody on your team has to

Public vulnerability feeds, the exploited-in-the-wild lists, and the PDF and email notices your chip vendors send out instead of machine-readable ones. Everything gets checked against your actual builds rather than a general list of components.

Step three

It shows you what it found and how it got there

Whether the vulnerable code was even compiled in, which builds and units are involved, and which customers have them. You get a short queue with the reasoning laid out, and you can agree with it or say otherwise.

Step four

It drafts the paperwork along the way

Customer advisories in whatever format each one asks for, VEX statements for the ones that don't affect you, a disclosure entry when the fix goes out, and a dated trail you can hand to an auditor.

The deadline

The Cyber Resilience Act is already in effect.

It covers anything with digital elements sold into the EU, wherever it was built, and penalties go up to €15M or 2.5% of worldwide turnover. Most of the work isn't the emergency reporting. It's the ongoing expectation that you know what's in your products, deal with what turns up, and can show your working later on.

The regulation came into force

Manufacturer obligations became law and the phase-in began.

Reporting duties started

An actively exploited vulnerability starts a 24-hour clock, then 72 hours, then a final report. Affected users have to be told as well.

Everything else, plus CE marking

A machine-readable SBOM, a disclosure policy and contact, security updates across a support period of at least five years, published fixes, and documentation kept for ten.

What you get

Things you can hand to a customer or an auditor.

"Not affected" statements

Most of a security questionnaire is asking whether you're exposed to things you're not. These answer that once, in a format your customer's tools can read, so a review takes an afternoon rather than a fortnight.

OpenVEX · CycloneDX VEX · CSAF

Customer advisories

Written in the format each customer's procurement team asks for, with a record of who was told, when, and who acknowledged it.

email · PDF · CSAF · portal

A bill of materials per build

One for every firmware version, hardware revision and release you have out in the world, rather than a single file standing in for the whole product.

CycloneDX · SPDX

A public disclosure page

Fixed vulnerabilities go up with their impact and remediation when the update ships, alongside your security contact and disclosure policy.

hosted · security.txt

Evidence for the technical file

Your vulnerability-handling process, support periods, update history, and every decision with its reasoning and who signed it off.

CE documentation bundle

Re-checks on the ones that do affect you

Anything known to touch your builds gets checked against the exploited-in-the-wild lists as those change. If one shows up there, you hear about it that morning and the report is already drafted.

24-hour clock · ready to file

Works with

It fits around what you already use.

If you run a firmware scanner already, Firmpath picks up its findings and carries on from there. If you don't, the CI step is enough on its own — it reads the vendor SDKs directly, including what a given release bundles and what your configuration turned on.

You won't need to replace a scanner, change build systems, or upload firmware anywhere.

Findings in

Firmware scannersDependency-Trackcve-bin-toolCycloneDXSPDX

Builds

ESP-IDFZephyrnRF Connect SDKSTM32CubeYoctoBuildroot

Fits your pipeline

GitHub ActionsGitLab CIJenkinsJiraLinear

Where we're at

We're early, and looking for a few teams to build this with.

The advisory pipeline is running now. The rest we'd rather work out alongside people who do this job than guess at on our own, so if you get in touch, expect questions from us as much as answers.

  • Bring one product line and we'll show you what the last month of advisories would have said about a build like yours.
  • You keep what comes out of that — the matching, the statements, the disclosure setup — whether or not you end up as a customer.
  • What we'd like back is your honest reaction, and a reference if we've earned one.
Ask us about it

Pricing

Start with one product. Pay when you want it watched.

A product is one thing you ship. Uploading its next release replaces the last one, so keeping it current never counts against you.

Free

€0

1 product

  • Upload an SBOM and see every advisory that reaches it — including the ones with no CVE that your scanner can't see
  • The vendor's own document behind every finding
  • Re-analyse whenever you like
Try it free

Pro

€200/month

up to 5 products · or €2,000 a year · excl. VAT

  • Everything in Free, for five products
  • Watched daily: an email when a new advisory reaches one of your builds
  • Export the evidence: VEX statements and a report you can hand to a customer or auditor
Get early access to Pro

Pro is opening to early customers now — tell us what you ship on.

Larger teams

Let's talk

more than 5 products

  • Everything in Pro, for your whole portfolio
  • Help setting up your SBOM pipeline and disclosure process
  • Invoicing, and a contract your procurement team will recognise
Talk to us

Questions

Things people ask us.

We don't have an SBOM. Our firmware is a vendor SDK and things people copied in years ago.
That's where most teams are, and it's the part we've put the most work into. Identifying the SDK and its release settles most of what's bundled. The linker map tells us what was actually linked and the build configuration tells us what was switched on. Copied-in and patched directories get matched against upstream releases, and we flag the ones we're unsure about. Then someone on your side confirms that handful — once per product line, not once per advisory.
What leaves our network?
Metadata, hashes and symbol names — no source and no firmware images. The CI step can also run offline and write its output to a file, so you can read exactly what would be sent before you turn uploading on.
Is an AI deciding whether we're affected?
It suggests an answer and shows how it got there, then a named person confirms it, and that confirmation is what goes into the record. Nothing with legal weight leaves without someone's name on it. An assessor will expect that, and it's also how we'd want it if we were the ones signing.
We sell to the US, not Europe.
Anything placed on the EU market is covered no matter where it was made, so it's worth checking whether a distributor puts you there. Either way, the same things — a bill of materials, "not affected" statements, a disclosure policy, update commitments — are what US medical device rules, the UK regime and your larger customers' security questionnaires are already asking for. The deadline is European, but the paperwork isn't.

Get in touch

Tell us what you ship on.

Send us a note and one of us will get back to you, usually within a couple of working days. If it doesn't sound like a fit, we'll tell you that too.

Prefer email? Write to [email protected]. We'll only use your address to reply to you.