PACOM is committed to protecting the security and privacy of its customers. We welcome responsible security research and work to address reported vulnerabilities promptly and transparently across all PACOM products, including Unison, S1000 Series hardware, 8000S Series hardware, VIGIL CORE, GMS, EMCS, firmware, mobile apps, and cloud services.

Reporting Vulnerabilities

If you identify a security vulnerability in a PACOM product, please report it using one of the following channels:

Unison Product Only:

• Email: security.unison@pacom.com
• PGP Key: https://pacomgroup.com/pgp-key/

All Other PACOM Products:

• Email: security.incident@pacom.com

Details to Include in Incident Notification

To assist with investigations, where possible please provide the following details with the incident notification.

• Product version
• Steps to reproduce
• Security impact
• Any logs
• Relevant configuration details
• Whether exploitation has been observed
• When the issue was first observed
• Any known indicators of compromise
• Reporter contact details for follow-up

Rules of Engagement

• Testing must be performed on systems you own or are authorized to assess.
• Reports based on configurations that differ from PACOM’s published Hardening Guides may not qualify for investigation.
• Testing must not disrupt production systems or violate applicable laws.

Our Response Process

• Acknowledgment: We acknowledge receipt of valid reports and begin triage.
• Investigation: Our Product Security Incident Response Team (PSIRT) reviews the issue and determines impact.
• Resolution: Confirmed vulnerabilities are addressed as quickly as possible.
• Communication: We keep the reporters informed throughout the process.
• Disclosure: After a fix is released, PACOM may publish details in product release notes and may acknowledge the reporter, unless anonymity is requested.

Confidentiality

We request that researchers keep vulnerability details confidential until a fix is available and customers have had time to apply it.

Regulatory Compliance

PACOM supports coordinated vulnerability disclosure practices and complies with applicable requirements under the EU Cyber Resilience Act (CRA), including notifications to relevant authorities where required.