Services.
Three packages that build on each other and can be commissioned individually.
From a baseline assessment through a pilot operation to an extended programme with security triage and patch research. Each package has a fixed reference scope, documented results and clearly stated limits. Deviations are agreed before commissioning.
- Packages
- Three, commissioned individually
- Duration
- 4 to 16 weeks per package
- Delivery
- Remote, Mon–Fri, documented
- Price
- Fixed price per reference scope, in the quote
Which package fits?
Package 1 creates transparency and an action plan. Package 2 tests the operation on real cases. Package 3 extends the operation with security triage and patch research. None requires the previous one.
- PACKAGE 1 · ANALYSIS
Open Source Governance & Risk Check
Baseline assessment of inventory, SBOM capability, governance and risks with a prioritised 90-day action plan.
- DURATION
- 4–6 weeks
- REFERENCE SCOPE
- up to 3 products or services with up to 20 repositories in total
- PACKAGE 2 · OPERATIONS
Managed Open Source Operations Pilot
Operational handling of lifecycle, vulnerability and upstream topics in a scoped pilot area.
- DURATION
- 8–10 weeks
- REFERENCE SCOPE
- up to 3 products or services with up to 20 repositories in total
- PACKAGE 3 · PROGRAMME
Secure Upstream Operations Program
Extended operation with security triage, patch research on your behalf and delivery of existing patches where available.
- DURATION
- 12–16 weeks
- REFERENCE SCOPE
- up to 5 products or services with up to 40 repositories in total
What we work on.
All packages cover the same three areas, at different depths.
Open-source governance & SBOM management
Capture the inventory, generate or consolidate SBOMs, assess licence and governance structures, clarify ownership.
Focus of package 1, foundation in packages 2 and 3
Vulnerability triage
Assess findings, clarify relevance for the scope, document decision and processing status.
Baseline in package 1, operational in packages 2 and 3
Patch research
Search for existing patches and deliver them if available. No patch development of our own.
Community requests from package 2, systematic research and delivery in package 3
Open Source Governance & Risk Check
Baseline assessment of inventory, SBOM capability, governance and risks with a prioritised 90-day action plan.
Teams that want to know where they stand before investing in processes, tools or an external operation.
Reliable transparency on open-source inventory, SBOM capability, licence and governance structures, vulnerability and lifecycle risks and organisational ownership.
- 01
Kick-off & scoping
- define scope, systems, repositories and contacts
- review existing SBOM, dependency and asset data
- clarify data access and security rules
- confirm assessment and reporting criteria
- 02
Inventory & evidence
- capture open-source components and dependencies
- generate or consolidate an SBOM (SPDX or CycloneDX) where technically possible
- structure licence and third-party information
- capture EOL, maintainer and release signals
- 03
Risk & governance
- vulnerability and lifecycle baseline
- assess ownership and escalation paths
- identify governance gaps and evidence deficits
- prioritise risks by criticality and effort
- 04
Report & action plan
- management summary
- technical findings report
- prioritised 30/60/90-day action plan
- closing readout with management and engineering
- OSS Inventory / SBOM Pack
Component overview, dependencies and available SPDX or CycloneDX artefacts.
- Risk Register
Prioritised security, lifecycle, governance and evidence risks.
- Governance Map
Roles, responsibilities, escalation and decision paths.
- Management Report
Concise basis for decisions with the key findings.
- 90-day action plan
Concrete, prioritised next steps.
- Closing readout
Remote presentation with questions and answers.
- business and technical contacts
- provide agreed access and artefacts on time
- answer questions within a reasonable time
- approve security-relevant access and data
- legal advice or binding licence opinions
- penetration tests or comprehensive secure code audits
- 24/7 monitoring or on-call
- development of customer-specific product features
- patch or pull request implementation
- migration or operation of production infrastructure
AFTERWARDS Operational implementation is a separate package, for example the Operations Pilot. ↓
Managed Open Source Operations Pilot
Operational handling of lifecycle, vulnerability and upstream topics in a scoped pilot area.
Teams that want to test an external operating model for open-source topics under real conditions before deciding on continuous operation.
Show how a managed open-source operation works with clear processes, response paths and evidence, on real cases from your scope.
- 01
Onboarding & operating baseline
- set up scope and service channels
- consolidate inventory and SBOM basis
- define severity and escalation model
- define contacts and approval paths
- 02
Monitoring & triage
- monitor CVE and vulnerability signals
- assess relevance for the pilot scope
- watch releases, EOL and maintainer activity
- technical reproduction and workaround research where needed
- 03
Support & lifecycle operations
- structured case intake
- root cause and dependency analysis
- status tracking until the agreed completion
- documented actions and decision basis
- 04
Upstream interaction
- create issues according to each project's rules
- report security findings exclusively via private disclosure channels
- maintainer and community communication on your behalf, where approved
- bring requests for existing patches or solutions to the community; forward solutions found to you for decision, without development of our own
- 05
Evidence & pilot evaluation
- case and action log
- weekly status report
- final report with operating model, lessons and rollout recommendation
- Pilot Operating Model
Service channels, roles, severity, escalation, approvals.
- Managed OSS Register
Inventory and SBOM basis with lifecycle status.
- Case & Triage Log
Handled cases, findings, actions, status.
- Upstream Evidence
Permissible issues, disclosures, community requests and contacts as evidence.
- Weekly Status
Short operations and risk report per week.
- Pilot Final Report
Results, evaluation, gaps and rollout recommendation.
- technical contacts and approvals
- required artefacts and access
- authorisation to communicate with upstream projects on your behalf
- timely decisions on security, release and patch questions
- 24/7 on-call
- unlimited ticket or engineering capacity
- feature development or patches of our own
- guaranteed acceptance of issues or release dates of external projects
- legal advice or penetration tests
- production infrastructure operation outside the agreed scope
AFTERWARDS More cases, security triage and patch research: Secure Upstream Operations Program. ↓
Secure Upstream Operations Program
Extended operation with security triage, patch research on your behalf and delivery of existing patches where available.
Organisations with several products that need vulnerability and lifecycle cases handled and evidenced continuously.
Agreed handling of defined open-source lifecycle, security and upstream cases in an extended scope, including research of existing patches and delivery where available.
- 01
Secure operating baseline
- inventory and SBOM consolidation
- criticality and severity model
- security disclosure and approval process
- roles, escalation and communication paths
- 02
Continuous lifecycle & security triage
- vulnerability and CVE assessment
- EOL, release and maintainer monitoring
- technical reproduction and root cause analysis
- risk and action prioritisation
- 03
Patch research on your behalf
- record the commissioned patch need and affected versions
- search for existing patches
- document sources, availability and open points
- no development of our own patches, pull requests or workarounds
- 04
Delivery of available patches
- deliver existing patches where available
- hand over origin, affected version and status traceably
- state missing availability explicitly
- no guarantee of availability or remediation
- 05
Evidence, governance & steering
- ongoing case and research register
- fortnightly steering
- security and lifecycle evidence pack
- final report and handover into a possible continuous operating model
- Secure Operations Playbook
Service, security, disclosure, approval and escalation processes.
- Managed OSS/SBOM Register
Ongoing component, lifecycle and risk status.
- Security & Triage Evidence
Findings, decisions, actions and evidence.
- Upstream Case Pack
Documented research, sources, availability status and open points.
- Available patches
Researched, existing patches where available. No development of our own, no availability guarantee.
- Steering Reports
Fortnightly updates for management and engineering.
- Final Evidence & Rollout Report
Evaluation of results, risks and recommendation for continuous operation.
- technical contacts and short approval paths
- version and environment details for each case; test or build access only for separately agreed reproductions
- external project communication only where agreed and approved in the engagement
- timely decisions on disclosure, patch and release
- required access and artefacts
- 24/7 SOC or NOC operation
- unlimited engineering capacity
- patch, pull request, feature or architecture development of our own
- guaranteed patch availability or remediation
- testing, integration, installation and rollout of patches as an automatic service
- guaranteed results from community or maintainers
- legal advice or binding licence opinions
- penetration tests or complete secure code audits
- operation of your production systems outside the agreed scope
AFTERWARDS Subsequent continuous operation or further areas are agreed separately.
Trust Assessment or package 1?
Both are scoped reviews with a report. They differ in breadth and subject.
| Trust Assessment | Governance & Risk Check | |
|---|---|---|
| SUBJECT | one agreed product or release | one organisational unit with up to 3 products |
| BASIS | provided artefacts and evidence | artefacts, access and up to 3 workshops |
| FOCUS | evidence: what is evidenced for this release? | baseline: inventory, governance, risks, ownership |
| RESULT | Trust Report | Inventory/SBOM Pack, Risk Register, Governance Map, 90-day plan |
| TYPICAL DURATION | after scoping | 4–6 weeks |
For public-sector buyers
All three packages are available as standard service descriptions with a fixed reference scope, acceptance criteria and client obligations. They are independent deliverables and are neither artificially split nor combined. Whether and which procurement routes apply is assessed by the respective contracting authority.
Frequently asked questions about the packages.
What do the packages cost?
Each package has a fixed price for the described reference scope. We state it in the quote after the introductory call, together with scope, contribution and acceptance criteria. Deviations from the reference scope are scoped beforehand.
Do I have to start with package 1?
No. Each package can be used on its own. The Operations Pilot can start from an existing inventory basis or set up a light baseline itself.
How fast do you respond to a case?
We handle cases Monday to Friday from 9 am to 5 pm German time, except on public holidays. Binding response or resolution times apply only after a separate agreement covering service channel, priorities and confirmed capacity.
Do you develop patches or pull requests?
No. In package 3 we search for existing patches and deliver them where available. Development of our own patches or pull requests is not included in any package, and we do not guarantee availability or remediation.
Can you guarantee results with open-source projects?
No. Whether a project accepts an issue, when it publishes a release or how it responds to a report is decided by the maintainers. We document our steps and results traceably.
Which package fits your case?
In the introductory call we clarify occasion, scope and the sensible starting point. You then receive a scoped quote.