Skip to main content
This guide follows the Get started checklist on the Overview page of a new workspace. By the end, Pharus watches your product, knows where its reports go, and has someone to page when an exploited vulnerability turns up.
Every new workspace starts with a 14-day trial of every software feature, with no card. See plans and features.
1

Create your account and company

Go to https://app.pharussecurity.com/sign-up and sign up with your work email, or with Microsoft or Google. Confirm your email address from the link Pharus sends you. Then set up the company in three short steps:
  • Company: the name, the main establishment and how many product families you have.
  • Routing: where your CRA reports go under Art. 14(7). Not sure yet? Continue, and set it later.
  • Pipeline: where your first SBOM will come from.
The company becomes your workspace, and you are its owner. Details: sign up.
2

Add a product family

A product family is what you sell, such as “Gateway G3”. On the Overview page, select Add a product family, or go to Settings → Product families and select Add product family. Give it a name and tick the member states where the product is made available. On the family’s page that opens next, check its reporting route: it inherits the company’s Art. 14(7) route unless you set its own.Details: product families and routing.
3

Send your first SBOM

Open SBOMs. Upload a CycloneDX or SPDX SBOM in JSON for the family, or follow Connect a pipeline to send one from every build in GitHub Actions, Azure DevOps or Dependency-Track. Pharus matches every component within seconds and lists the results under Vulnerabilities.Pipelines authenticate with an API token for the product family, created under Settings → API tokens by an owner or admin.Details: SBOMs, vulnerabilities and the API reference.
4

Add the on-call rota

The 24-hour clock doesn’t stop for weekends. Under Settings → On-call, choose who is paged when an exploited vulnerability matches, and a backup. Each person verifies their mobile number under Settings → Your profile before they can be paged.Details: on-call rota and paging. The rota is part of Core and Plus.
5

Invite a colleague

Under Settings → Members, invite the people who handle incidents with you. On Core and Plus, a determination needs a second person to approve it. Pharus is priced per product family, so there is no cost per seat.Details: members and roles.
6

Publish security.txt

Give researchers a way to report vulnerabilities to you. Under Settings → Disclosure, check your contact details and policy, then publish the generated security.txt on your own domain. Reports arrive in the Disclosure inbox.Details: disclosure page and security.txt.

​
What happens next

When a component in one of your SBOMs matches a vulnerability that CISA KEV or EUVD lists as exploited, Pharus opens an incident, starts the 24-hour clock and, on Core and Plus, pages whoever is on call. From there:
  1. Check the awareness time on the incident’s Overview tab, then record your determination on the Determination tab: was the vulnerability actively exploited in your product? See incidents and decision record.
  2. Check the route to your coordinating CSIRT. See routing.
  3. Paste the early warning into ENISA’s Single Reporting Platform and record the receipt. See SRP paste pack.
Every Monday, the weekly digest sums up new matches across your product families.
Practise before it’s real. A drill runs the whole filing as a tabletop exercise, without sending anything.

Key concepts

The words Pharus uses and how the pieces fit together.

Incidents

How incidents open, and what to do in the first 24 hours.