Cogiscan software runs inside live electronics manufacturing operations: Track, Trace & Control, Factory Insights, and the machine connectivity that links equipment across SMT and PCBA lines. Because these systems sit between production equipment and our customers' networks, we treat the security of our products, and of the data they handle, as part of their basic quality.
Cogiscan is part of the Dürr Group, and the Group's central security team handles vulnerability intake for every company in the Group, Cogiscan included. The Cyber Resilience Act (Regulation (EU) 2024/2847) sets out how manufacturers of products with digital elements are expected to receive and act on reports of vulnerabilities in them. This page explains how to reach us and what happens after you report.
If you believe you have found a security vulnerability in a Cogiscan product, service or website, please tell us, whether you are a customer, an EMS provider, an OEM partner, a supplier or an independent researcher. Use the Dürr Group vulnerability reporting form linked below, which opens on the Dürr Group website, or write to psirt@cogiscan.com. Either channel reaches us. A useful report names the affected product and version, gives the steps needed to reproduce the issue, and says what an attacker could do with it. Include any logs, screenshots or proof-of-concept material, and a way for us to contact you.
We acknowledge every report, assess whether it affects our products, and keep you informed of progress until the matter is closed. Reports are treated as confidential: the details are shared only with the people who need them to resolve the issue, and we will not name you without your agreement, except where we are required by law to report a vulnerability to the authorities. We ask that you give us a reasonable opportunity to fix the issue before disclosing it publicly. Cogiscan will not take legal action against anyone who reports in good faith and who does not disrupt live production systems or equipment, or access, retain or alter data beyond what is needed to demonstrate the issue.
