01Services02Case studies03About us04Blog 05Contact Versione italiana
Security

Report a vulnerability

How to report a vulnerability in our products or services. Last updated: 2 October 2026.

To report a vulnerability, write to

security@dalbenautomation.com

We acknowledge receipt within 5 working days. If the report concerns a plant in active production, say so in the subject line.

At Dal Ben Automation, the security and reliability of the automation systems we design are a priority, not an afterthought. We recognise the role cybersecurity plays in our customers' operational technology (OT) environments, and for this reason we encourage the responsible reporting of any security vulnerability found in our products, software or integrated solutions.

In accordance with the Cyber Resilience Act (Regulation (EU) 2024/2847), this is the contact point for reporting security vulnerabilities in our website, the automation software and the network infrastructure we develop. The contact address is also published in machine-readable form, following RFC 9116, at /.well-known/security.txt.

How to report a vulnerability

If you believe you have found a security issue in one of our solutions, write to us at security@dalbenautomation.com. Supported languages: Italian, English.

Where possible, please include:

  • Affected product: software name, hardware model or firmware version.
  • Description of the issue: a technical explanation of the vulnerability.
  • Reproduction steps: clear instructions, screenshots or sample code (PoC).
  • Estimated impact: the risk scenario this vulnerability could cause.

Our handling process

  1. We acknowledge receipt of the report within 5 working days.
  2. We analyse and verify the vulnerability in a test environment.
  3. We gather any further details with you, keeping you updated on the status of the analysis.
  4. We develop and release a fix or a mitigation guide as quickly as possible.
  5. If you wish, we credit your contribution in any security bulletin we publish, provided disclosure has been coordinated with us.

Responsible disclosure and good-faith research

We ask that vulnerability details are not disclosed publicly until we have had time to develop and test a fix: this protects the people using the affected plants. We do not pursue legal action against anyone who reports a vulnerability in good faith, without accessing or altering data beyond what is needed to demonstrate the issue, and without disrupting our services or those of our customers.

This channel is reserved for security reports: for technical support or commercial enquiries see Contact; for personal data, the privacy policy.