AIDA presses are designed and engineered using the most advanced industrial automation technologies available on the market. As the cybersecurity of a complex production system also depends on the individual components that comprise it, we continuously monitor the security advisories issued by our technology partners.

We encourage customers and IT/OT managers to consult the security portals (CERT/PSIRT) of the manufacturers of machine-installed components on a regular basis, particularly with regard to PLCs, HMIs and sensors:

To help us assess your report promptly, please provide the following information:

• Press serial number;

• Device type (e.g. PLC, HMI, drive, etc.);

• Device identification code;

• Firmware version;

• Full name;

• Company or organisation;

• Country;

• Email address for correspondence;

• Whether or not you wish to be publicly acknowledged as the discoverer of the vulnerability;

• Telephone number, if you wish to provide one.

A technical description should be included with the report and should cover at least the following aspects:

• How the application is configured, including the control architecture, machine network, installed options and modules;

• The operating environment of the machine, including its integration into a production line, connections to the plant network and any remote access arrangements;

• The potential impact of the vulnerability, with particular attention to functions relevant to personnel safety;

• A detailed description of the issue and, where possible, the steps required to reproduce it.

The internal vulnerability management procedure defines how reports are received, tracked and handled. Our PSIRT is also responsible for coordinating external communications relating to all products across the Group.

Every incoming report is reviewed by the PSIRT, which will respond to the reporter within five working days, where necessary requesting further information or clarification. If no response is received within 60 working days, the case will be closed.

Once the existence of the issue has been confirmed, we assess its severity and potential impact based on the information gathered, identify its root cause, and determine the most appropriate remediation measures.

The time required to process a report depends on the complexity of the case, as not all vulnerabilities require the same level of analysis and remediation effort. For this reason, we provide regular updates to the reporter, with no more than 30 working days between one update and the next.

To exchange confidential information with our PSIRT, you may use the following PGP public key: