// Cybersecurity
If you believe you have found a security vulnerability in an ITEM product, write to cybersecurity@item.to.it. We will confirm receipt within 5 working days, work with you on a fix, and agree with you when the vulnerability is made public.
Scope
This policy covers:
- vision systems and other products with digital elements that ITEM S.r.l. places on the market, including the software and firmware they run;
- security updates and the tools ITEM provides to install them;
- the website www.item.to.it.
It does not cover third-party products that ITEM resells without modification, or services provided by other companies. If a vulnerability you found in an ITEM product originates in a third-party component (for example the operating system or an NVIDIA library), report it to us anyway: we will coordinate with the component’s maintainer.
How to report
Send an email to cybersecurity@item.to.it, in Italian or English. Please include:
- the product name and, if you know them, the model and software version;
- a description of the vulnerability and of its possible impact;
- the steps needed to reproduce it, or a proof of concept;
- whether you know of the vulnerability being exploited;
- how we can contact you, and whether you want to be credited by name.
Please do not include personal data of third parties, and do not send the details through other channels such as social media or general contact forms. If you need to send sensitive material, ask us in your first email and we will agree on a secure way to exchange it.
What happens after you report
| Step | When |
|---|---|
| We confirm we received your report | Within 5 working days |
| We tell you whether we can reproduce it and how we assess its severity | Within 15 working days |
| We keep you informed of progress on the fix | At least every 30 days until the fix is available |
| We tell you when the fix is available and agree the publication date with you | When the fix is released |
If a vulnerability is being actively exploited, we act immediately and notify the competent authorities as required by Regulation (EU) 2024/2847 (Cyber Resilience Act), through the ENISA Single Reporting Platform to CSIRT Italia. We do not share your identity with the authorities without your consent, unless the law requires it.
Coordinated disclosure and credit
We ask you to keep the vulnerability confidential until a fix is available and we have agreed on a publication date. We aim to make fixes available within 90 days of your report. If we need more time, we will explain why and agree a new date with you. If you believe users are at serious risk and we are not acting, tell us before publishing; you may also contact CSIRT Italia, which can act as coordinator.
When we publish a security advisory, we credit the person who reported the vulnerability, unless you prefer to remain anonymous. ITEM does not offer financial rewards for reports.
Good-faith research
We welcome research done in good faith. We ask you to:
- test only on equipment you own or are authorised to test, never on systems installed at our customers’ sites;
- access, modify or keep only the data strictly needed to show the vulnerability, and delete it once the report is closed;
- avoid actions that could cause damage, service interruptions or safety hazards; our systems often run on industrial machinery and vehicles;
- not use social engineering, physical attacks or denial-of-service tests.
If you follow this policy, ITEM will consider your research authorised, will not start legal action against you for it, and will not file a complaint with the authorities. This commitment cannot bind third parties, such as our customers or the owners of other systems involved.
Security updates and advisories
Each ITEM product has a support period, stated in its documentation and on its product page. During the support period ITEM provides security updates free of charge and informs customers when an update fixes a vulnerability.
Once a fix is available, ITEM publishes a security advisory on www.item.to.it/en/cybersecurity/advisories with the affected products and versions, the severity, the fixed version and the measures customers can take. Customers can ask to receive advisories by email at cybersecurity@item.to.it.
Policy details
| Item | Detail |
|---|---|
| Published by | ITEM S.r.l., Torino |
| Contact | cybersecurity@item.to.it |
| Languages for reports | Italian, English |
| Machine-readable contact | www.item.to.it/.well-known/security.txt |
| Version | 1.0 |
ITEM may update this policy. The current version is always the one published on this page; earlier versions are available on request.