PCA Cyber Security launches CERVUS for device risk

PCA Cyber Security has launched PCA CERVUS, a vulnerability monitoring and threat intelligence platform for embedded and connected products.

The system is designed to give product security teams visibility of cyber risks across individual devices, product lines and wider portfolios.

The launch is aimed at manufacturers, importers and operators of connected products such as payment terminals, industrial controllers, vehicles and other internet-enabled devices. PCA CERVUS links vulnerability disclosures, threat intelligence and security research with product architecture, software components and software bills of materials, or SBOMs.

This is intended to help security teams identify which newly disclosed vulnerabilities affect specific products, where the exposure sits within a device and what action is needed. The platform gathers 25,000 new records a day through continuous monitoring of vulnerability disclosures, threat intelligence and security research.

Device focus

PCA CERVUS is built around a device-level view of risk rather than a broad network or enterprise perspective. Users can examine exposure across a single device, a product family or an entire portfolio, including software dependencies and third-party components.

It also tracks remediation work. The platform allows teams to monitor identified vulnerabilities, validate patches and assess whether changes to affected components have addressed the security issue, rather than simply recording that a patch has been applied.

Another part of the product focuses on SBOM management. Organisations can import and validate an existing SBOM or generate one where none exists, creating a fuller picture of software components and external dependencies inside connected products.

Compliance push

PCA Cyber Security positioned the launch against rising regulatory scrutiny of product security across the full lifecycle of connected devices. It said the platform can support compliance processes linked to the EU Cyber Resilience Act, as well as other standards and regulations including PCI DSS, PCI PTS, RED and UNECE R155.

These rules have increased pressure on manufacturers to document software components, assess vulnerabilities, track remediation and retain evidence that security issues have been addressed. The platform is aimed at helping organisations assemble that evidence, while leaving responsibility for compliance with the manufacturer or operator.

The product is aimed at sectors where embedded systems are widely used, including financial services and payments, automotive and mobility, industrial automation, energy and utilities, manufacturing, consumer IoT and medical devices.

Budapest-based PCA Cyber Security was founded in 2019 and specialises in embedded cybersecurity work including penetration testing, threat intelligence and continuous monitoring. The company says it works with original equipment manufacturers and Tier 1 suppliers on systems including payment platforms, vehicle electronic control units and industrial networks.

Gianfranco Vinucci, Chief Operating Officer at PCA Cyber Security, said: "Today's world is connected. Businesses rely on millions of payment devices, industrial controllers, and connected vehicles to keep commerce moving and critical infrastructure running. Manufacturers, importers and operators responsible for these devices need continuous visibility of which products are exposed and where to act. PCA CERVUS connects vulnerabilities and threats with the components inside each device, helping teams prioritise risk, track remediation and demonstrate if security issues have been addressed."

PCA Cyber Security said the platform can be used from product development and certification through to deployment and maintenance, with continuous monitoring intended to show how exposure changes over time as new vulnerabilities are disclosed.

It added that the platform is designed to help users identify common dependencies and recurring vulnerabilities across product ranges, giving security teams a way to assess whether a disclosed issue may affect multiple devices built on shared software components.

That reflects a wider challenge in embedded security, where products often remain in the field for years and rely on layers of proprietary and third-party code. In these environments, identifying the impact of a newly disclosed flaw can be difficult when manufacturers do not have a current inventory of components or a clear view of inherited dependencies.

PCA Cyber Security said PCA CERVUS addresses that problem by correlating software component data with vulnerability intelligence and continuously monitoring those components for newly disclosed risks.