Receive
Reports arrive through your channel and stay intact—from attachment to evidence-linked review.
PSIRT operations · product security
From report to response. One place to do it right.
REMEDiS gives your PSIRT one operating record for every report—so teams can establish impact, coordinate response, and show why each decision was made.
Product teams shipping software, devices, or services
See the workflow in action
A clearer way to run response.
One response workspace for every report, decision, and handoff.
REMEDiS · Response DeskHUMAN REVIEW
Response deskKnow what needs your attention.
EvidenceLinkedOwnershipHumanDecisionsTraceable
Establish affected product scope Evaluate Confirm component exposure Coordinate Approve the advisory Decide
Case Room · Linked caseIN REVIEW
Next accountable decisionEstablish affected product scopeEvidence shown · Engineering review pending
Response ownerPSIRT lead
Lifecycle stageEvaluate
Decision stateOpen
Evidence basis
Product contextIN SCOPE
Product in scopeProduct
Supported releaseRelease
Affected componentComponent
SBOM evidenceEvidence
See the workflow here. Your workspace holds the real records and approvals.
How it works
What happens to a report.
Evaluate
PSIRTling proposes product, release, component, and SBOM context for your team to confirm.
Coordinate
Everyone works from one case: owner, deadline, evidence, and the next decision.
Disclose
Prepare reviewed advisories and customer notices with the evidence needed for coordination.
Why now
Three forces are colliding at once.
The vulnerability tsunami
Tens of thousands of new vulnerabilities a year, and AI-assisted research is multiplying the reports that reach product teams. Manual response cannot keep pace.
The capacity gap
Response still runs on spreadsheets, email threads, and ticketing systems never designed for this. Teams lack purpose-built tools.
The regulatory hammer
The EU Cyber Resilience Act, FDA §524B, NIS2, and SEC Item 1.05 turned disclosure into a legal requirement with real clocks, penalties, and market access at stake.
Finding vulnerabilities faster does not protect customers faster, not without response infrastructure built to match.
Most companies don't have a security workflow. They have a thrash cycle: heroics, fragmentation, and a record nobody can reconstruct when the board, a regulator, or a customer asks.
An overlooked category
Product security is not a red team, and it isn't the CISO's org chart.
Executives and boards routinely conflate the three. The distinction is the whole business case.
| Dimension | Product security (PSIRT) | Internal red team | CISO / corporate infosec |
|---|---|---|---|
| Protects | The shipped product | The internal network | The compliance program |
| Triggered by | External vulnerability reports | Simulated internal attacks | Board and audit reporting |
| Runs against | Regulatory disclosure clocks | No external deadline | Quarterly reporting cycles |
| Worst case | Public CVE, lost market access | Missed internal finding | Audit finding, compliance gap |
Our solution
PSIRTling: the senior PSIRT expert in the room.
The AI does the hard, exacting work. Your team stays in command of every consequential decision.
Old model: a tool the human operatesREMEDiS: a colleague that does the work
Human re-keys vulnerability data from email and portalsReports arrive from your verified form and connected programs, preserved as evidence
Human hunts for the affected products and versionsPSIRTling proposes product, release, and component context from your own evidence, for you to confirm
Human drafts every brief from scratchPSIRTling prepares the cited brief and the next step; people review, decide, and approve
Human tracks timelines by handDeadlines run from your SLAs; warnings and breaches are recorded and can reach Slack or Teams
One engineer, one case at a timeOne record per case, so a small team can carry many, with the audit trail already written
PSIRTling never publishes, sends, or closes anything on its own. Every answer is grounded in your workspace's evidence, cited, and never used to train a shared model.
Who it's for
A tier for every team that answers the report.
Solo developers and open-source maintainers
Free. A full vulnerability disclosure program and triage with zero setup.
Small product teams
Subscription. Roles, response SLAs, chat and ticketing integrations, and the shared record.
Enterprise PSIRTs and portfolios
Subscription. Compliance packs for CRA, FDA, NIS2, and SEC clocks, with sovereign options.
Squadron and Citadel pricing is being validated with design partners now. Large OEMs spend millions a year building this in-house; REMEDiS is a fraction of that.
Need help building the program, not just the tool? REMEDiS also designs PSIRT programs and runs readiness exercises.
Talk to a PSIRT expertGet started
Let’s get started.
Start with your website, repository, or package. PSIRTling suggests the setup details for you to review; ownership can wait.