CyberWhiz – Implement Your VDP Now: The reporting obligations for security vulnerabilities and incidents under the Cyber Resilience Act (CRA) became active on 11 September 2026.
CyberWhiz helps manufacturers of connected products embed cybersecurity effectively and transparently throughout the entire product lifecycle. The company combines extensive experience in embedded, IoT, mobile and cloud security with a practical, product-development-focused approach.
With its in-house solutions, CyberWhiz addresses the growing requirements imposed by regulatory frameworks such as the Cyber Resilience Act (CRA), the RED Delegated Act (RED DA), and UNECE R155/R156.
CyberWhiz – Implement Your VDP Now: VDP Manager for Structured Vulnerability Reporting
With VDP Manager, CyberWhiz provides a platform for implementing and managing a Vulnerability Disclosure Policy (VDP). It establishes a centralised, controlled process for security reports from researchers, customers and other external parties—an essential building block for manufacturers looking to make their vulnerability-management processes CRA-compliant.
One of its core functions is the integration of an existing security email inbox into a central, intelligent platform. Incoming reports are analysed using AI, while irrelevant messages and spam are filtered out and potentially relevant vulnerability reports are prioritised. This enables critical information to be identified more quickly and reduces the risk of security-relevant reports being overlooked amid day-to-day communications.
The VDP Manager also supports defined handling and communication workflows within the prescribed response timeframes—for example, reporting an actively exploited vulnerability within 24 hours. Reports can be tracked seamlessly from initial receipt through to final remediation. A complete audit trail, status updates for reporters and management-ready compliance reports provide transparency for development, security and compliance teams. The required reporting to ENISA can also be supported through automation.
Meeting CRA Requirements Together
A robust VDP involves more than simply publishing a security email address: it requires clear responsibilities, documented timeframes, reliable processes and transparent communication.
Ineltek and CyberWhiz are happy to help you translate CRA requirements into practical processes—from establishing a Vulnerability Disclosure Policy through to the appropriate technical implementation with VDP Manager. Contact us by phone or submit your enquiry directly here.
