EACG GmbH is a consulting and software company for software security and compliance, based in Frankfurt am Main. With TrustSource, EACG has developed its own platform for software composition analysis, SBOM management, and vulnerability and license compliance, which is in use at manufacturers and operators across Europe.

The Managed CVD offering is built on this platform: EACG acts as coordinator and takes over the entire coordinated vulnerability disclosure process for manufacturers that do not want to, or cannot, run their own PSIRT. This includes receiving and triaging reports, coordinating with security researchers and affected parties, embargo management, assigning vulnerability identifiers as a GCVE Numbering Authority, publishing machine-readable CSAF advisories, and s ...