Contact us
EN

Vulnerability assessment

Find the flaws first. Fix them. Ship the patch.

For connected devices, robots, chargers, apps and their cloud. When a buyer, a distributor or a researcher asks about security, you have the answer, the fix and the record.

Get a free exposure reviewTalk to us

Sounds familiar?

  • A buyer's IT team sends a long security questionnaire.

    We test the product, app and cloud, write the answers from real results, and keep them current for the next deal.

  • Someone reports a flaw, and nobody owns it.

    One reporting address, triage with your engineers, a CVE and an advisory, a fix and a patch signed with your keys. Since September 11, 2026 the EU wants actively exploited flaws reported within 24 hours; we prepare the report for you to submit on time.

  • Your distributor asks for a test report you don't have.

    Accredited labs run the formal test. We prepare the product, coordinate the lab and fix what it finds before the retest.

In 2025 a state-backed group let an AI agent run 80 to 90% of an intrusion campaign. New vulnerabilities rose 51% in the first half of 2026. Source: The Hacker News, Nov 2025, Forescout, Jul 2026

What we do

  • Security review of device, app and cloud
  • Penetration tests through accredited labs
  • Vulnerability intake, triage and CVE coordination
  • Fixes and patches signed with your keys, with rollback ready
  • EU Cyber Resilience Act 24- and 72-hour reports

What you get

  • An assessment report with findings ranked by risk
  • Answers for buyer security questionnaires
  • A lab test report from an accredited lab
  • Patches signed with your keys
  • A dated record in your evidence file

Assessment, response and fixes are three different things

So you know what a monthly plan covers and what is a project.

  • Assessment

    A project to find weaknesses, once or when the product changes.

    Readiness audit, first-pass test or lab test: quoted on request

  • Response

    An ongoing service: reports received, assessed, coordinated and reported on time.

    Respond plan US$990 a month

  • Fixes

    Engineering work on your code: the fix, the signed patch, the retest.

    Small fixes: credits in Respond and Secure · bigger work quoted first

The plan for it

Monthly, per product line. Start with the free snapshot or a one-time audit.

Vulnerability assessment

Respond

US$990 a month per product line

US$990 setup · minimum 6 months

Choose it when

  • Researchers, customers or a buyer's IT team can report a flaw any day, and nobody on your side owns the answer.
  • You sell in the EU: since September 11, 2026, actively exploited flaws must be reported within 24 hours.
  • New flaws turn up in the components you ship every week.

Included

  • A public address for vulnerability reports
  • Reports received 24/7, weekends included: an engineer on call starts triage and drafts the EU 24-hour early warning for you to submit
  • Triage with your engineers, CVE coordination and advisories
  • EU Cyber Resilience Act 24-hour, 72-hour and 14-day reports prepared for you to submit
  • Watch on known flaws in your components (SBOM)
  • 2 fix credits a month: small fixes an agent drafts and an engineer approves
  • One new buyer questionnaire a quarter

Priced separately

  • The first assessment is a project: our first-pass test with one retest, or an accredited lab test at cost
  • Fixes beyond your credits, quoted first

All three services

Secure

US$3,490 a month per product line

US$3,200 setup · minimum 12 months

Choose it when

  • Buyer contracts ask for patch timelines, a named incident contact and yearly tests (lab tests quoted at cost).
  • You run a fleet in the field, where one bad update reaches every device.
  • You must show security evidence to regulators: EU CRA, FDA 524B, FCC.
  • You want one accountable team instead of three vendors.

Included

  • Everything in Respond (vulnerabilities) and Operate (data privacy)
  • Up to two new buyer questionnaires a month
  • Data passport for the product line, built in the setup and refreshed twice a year
  • A named security lead and a monthly 45-minute call
  • A buyer-ready report every quarter
  • 6 fix credits a month for small fixes; bigger work quoted first
  • A scan of every release and device monitoring, up to 2,000 devices
  • Incident plan and a yearly drill
  • Evidence file for buyers and regulators: EU CRA, FDA 524B, FCC
  • A first answer within one business day

Priced separately

  • Accredited lab tests at cost, quoted before each test
  • Fixes beyond your credits, quoted first
  • Devices above 2,000: from US$0.90 each a month

All plans and prices

What we commit to

  • Written scope before work starts.
  • Every deliverable dated and kept in your evidence file.
  • Vulnerability reports acknowledged within one business day; on Respond and Secure, received 24/7 with an engineer on call.
  • A first answer to any request within one business day, Vancouver time.
  • A named lead you can escalate to.

You own your product and its security. We own the work we deliver, in writing. No one can promise a site or product will never be hacked. Doing nothing is far riskier. We shorten the time you stay exposed, and we keep the record.

Tell us what you run, and what keeps you up at night.

Write in your language or in English. We reply within one business day with first questions and a time to talk; calls in English, by appointment.

Talk to ushello@norvoya.com
Contact