Last Update: August 17, 2026

This policy outlines the requirements for properly reporting, receiving, tracking, evaluating, resolving, and responding to security incidents and potential vulnerabilities reported by customers, business partners, and public sources related to Cognex products, services, or solutions.

1. Security Incident & Vulnerability Reporting
For general security concerns about Cognex products, please visit the Cognex Trust Center.

Cognex customers and business partners should follow the existing support processes in MyCognex to open a support case. Please prefix the Subject with “Security Incident:” or “Security Vulnerability:”. Other public sources, including vendors or security researchers, should contact the Cognex Product Security Incident Response Team (PSIRT) by submitting a form to report any security incidents or potential vulnerabilities related to Cognex products, services, or solutions.

The Cognex PSIRT manages investigation, internal coordination, disclosure, and reporting of security vulnerabilities. To help assess the case efficiently, we encourage, we encourage you to provide the following information:

• Contact information (name and email address) and availability, company affiliation (if applicable)
• Affected product including model and software version number(s)
• Detailed description of the issue with steps to reproduce, including proof-of-concept scripts and screenshots of evidence
• Evaluation of the severities (CVSS Score if possible)
• Maturity of exploits and current level of awareness

A coordinated vulnerability disclosure will provide the best protection to Cognex customers. Do not disclose the vulnerability or extracted data to any third parties or publicly without Cognex’s authorization.

2. Acknowledgment & Initial Investigation
The Cognex PSIRT will promptly acknowledge receipt of the reported case and collaborate with you to gather the required technical information, evaluate the impact, and determine an appropriate treatment plan. When the initial investigation is complete, results will be delivered to you along with the treatment plan (if any) and public disclosure, where applicable.

3. Security Risk Assessment

Cognex uses the latest version of the Common Vulnerability Scoring System (CVSS) calculator to assess vulnerabilities based on exploitability, impact, and environmental factors. We encourage you to provide your CVSS score evaluation for the vulnerabilities you report.

4. Treatment, Disclosure, and Reporting
The Cognex PSIRT will work with the relevant Cognex functions and teams in accordance with Cognex’s internal Product Vulnerability Management Policy and this policy to establish a treatment plan based on the nature of the incident or vulnerability, the affected products and their lifecycle stage, and, if applicable, a reporting and disclosure plan.

5. Security Updates
Cognex customers and business partners can download security updates and access product release notes on the Cognex Support site.

Last Updated: August 17, 2026
This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information in this document or materials linked to this document is at your own risk. Cognex reserves the right to change or update this document at any time without notice.

Internal Reference Policy: Product Vulnerability Management Policy

Owning Function: Cognex Information Security