Security mailbox overflowing? We find the report that counts.
Ever since your reporting address appeared in your security.txt, the mailbox has filled up with begging e-mails asking for bounties, unverified scanner reports and machine-written "vulnerability reports". CRA Response Center monitors the mailbox, brings the genuine reports to the top and alerts your people only for those. Everything else stays where it is, sorted and not deleted. The AI is hosted in Germany, and your e-mails never go to OpenAI, Anthropic or Google.
EUR 190 per month including VAT, cancellable monthly. For manufacturers of machinery, devices and software.
What arrives in the security mailbox
A security.txt is meant to be found, by security researchers and customers. Programs that harvest addresses find it just as easily. Four kinds of e-mail make up the bulk.
- Beg bounty
Critical vulnerability found on your website, do you offer a reward?
A run-of-the-mill finding such as missing DMARC or a missing HTTP header, dressed up as a security vulnerability, with a request for money. - Scanner report
[Scan Report] 14 issues found on your domain
Tool output attached without any verification of its own, without steps to reproduce and without a described impact. - AI-written report
Remote code execution in your firmware update process
Fluent, long and full of technical terms, but describing invented functions or versions that do not exist in your product. - Advertising
Penetration test at our trade fair price
Offers, directories, trade fairs. Nothing to do with a vulnerability, but sent to the address that has just become easy to find.
In 2025, only around 5 per cent of the submissions received by the open-source project curl were valid reports, and each one tied up several people for between half an hour and three hours. There are no public figures for the mailboxes of small and medium-sized manufacturers. But with the reporting obligation under Article 14 and the reporting address required by Annex I, many manufacturers' mailboxes are becoming discoverable by machines for the first time.
Why a spam filter and the delete key are not enough
The obvious answer is a stricter filter. For a security mailbox, it is the wrong one.
The genuine report often looks like spam
A customer writes politely, in a foreign language and without technical terms: after logging in, they can see another operator's devices. A begging e-mail, by contrast, sounds urgent and technical. Filter by tone and you discard exactly the wrong e-mail.
Receipt creates an obligation
The 24-hour deadline starts with awareness, not with receipt. According to the Commission guidance on the Cyber Resilience Act, however, receipt does trigger the obligation to start the initial assessment immediately. An e-mail that sits in the spam folder for three days has not been assessed immediately.
Nothing may be lost
BSI TR-03183-3, the technical guideline of the German Federal Office for Information Security, requires that incoming reports are not closed by a single person, so that no valid vulnerability gets lost. A filter that silently rejects or deletes e-mails runs counter to that.
The problem grows
The better known your reporting address, the more e-mails you receive. Anyone who goes through 40 e-mails by hand every morning will eventually miss the one that matters. And at night, nobody is looking.
How CRA Response Center separates what is important from the rest
Two stages, one clear rule: if in doubt, an e-mail counts as important.
- MonitorVia forwarding or with read-only access through Microsoft 365, Google or IMAP. The tool never replies, and never moves or deletes anything.
- Fixed rulesMail from authorities, claimed exploitation, extortion, notices from suppliers and unreadable e-mails are always important. This cannot be switched off.
- AI hosted in GermanyRecognises indications of vulnerabilities in your products, even in clumsy English, in German or alongside a demand for money. Runs at our hosting provider; no e-mail text goes to OpenAI, Anthropic or Google. It can only escalate.
- AlertSMS and e-mail only for what is important. Bug bounty, advertising and customer queries sit below with a tag; nobody gets woken up for those.
Only a person can downgrade, only one e-mail at a time, and their name is recorded in the history. Important e-mails get the Article 14 deadlines as soon as someone confirms awareness. The sample screens show what this looks like when it matters.
Frequently asked questions
Does the tool replace our spam filter?
No. It only monitors and changes nothing in your mailbox. Ideally, set the security mailbox's spam filter to flag and sort e-mails, but never to reject them. The guide Spam in the security mailbox explains how.
What if the AI misses a genuine report?
The fixed rules set the floor: claimed exploitation, mail from authorities and extortion always go to the top, whatever the AI thinks. On top of that, the AI escalates anything that sounds like a vulnerability, and an unclear e-mail counts as important. Everything else remains visible in the tool and can be filtered by tag.
Will a begging e-mail with a genuine vulnerability be filtered out?
No. A demand for money does not make an e-mail unimportant. If it describes a serious vulnerability in your product or claims exploitation, it goes to the top. Only minor findings with no recognisable impact end up under Bug bounty.
Does the tool reply to senders?
No, you write the replies yourself, from your own mailbox. Many beg bounty e-mails can be dealt with by one sentence in your coordinated vulnerability disclosure policy: that you do not pay bounties. The security.txt generator provides a draft.
Where are our e-mails stored?
The tool and the AI run at a hosting provider in Germany. Your e-mails never go to OpenAI, Anthropic, Google or any other AI provider, and are never used to train AI models. E-mail texts are stored encrypted and deleted after fixed periods; the original stays in your mailbox. A data processing agreement (DPA) under Article 28 GDPR is included.
Read less, miss nothing.
CRA Response Center finds the report that counts and wakes your people only for that. With AI hosted in Germany: your e-mails never go to OpenAI, Anthropic or Google. EUR 190 per month including VAT, with the first 30 days free.