Iain Davidson, Head Of Product Marketing At Wireless Logic Ltd, On How The Cyber Resilience Act Will Reshape The IoT Security Landscape

“The Cyber Resilience Act (CRA) is one of the biggest shifts in product cybersecurity law that the IoT industry has seen. It makes security a legal condition of selling a connected product in Europe, not an optional bolt on. The last 12 months have demonstrated no shortage of evidence as to why this is so necessary. It seems not a day goes by without news of an outage or cyberattack.

“Amidst this threat landscape, the CRA requires security as a design requirement, running from the drawing board through to the end of support. Its reporting obligation, which has applied since 11 September 2026, also requires manufacturers to notify any actively exploited vulnerabilities and incidents that impact product security. This includes pre-existing deployments where products may have been designed and commercialized without security engineering ensured from day one. For example, legacy industrial sensors, older smart-building and consumer-facing connected products built on cost-down hardware and firmware that are rarely updated.

“The CRA’s product-centric focus means manufacturers will likely feel the biggest impact, as the regulation puts legal responsibility on them to make, and keep, connected products secure. As well as securing existing deployments, they must prepare to build in secure-by-default configuration, vulnerability handling processes, and a software bill of materials before a product ever reaches CE marking. Products must then continue to be supported, not shipped and forgotten.”

“OEMs carry the heaviest legal burden under the CRA, as ‘manufacturers’ directly responsible for conformity assessment and vulnerability reporting. They must now report actively exploited vulnerabilities and severe incidents. Tight reporting windows introduced by the CRA make device visibility and proactive threat detection crucial to ensure the audit-ready logs and evidence trails that regulators will expect.

“However, obligations also fall further along the supply chain than many realize. Device and solutions developers who integrate third-party components, including modules, firmware, and chipsets, may also fall under manufacturer obligations. As a result, they must separately notify upstream component makers of any vulnerabilities identified within their supply chain.

“Responsibility also lies with enterprises running IoT fleets, who must also ensure their supply chains are compliant, and be prepared to act quickly if a problem is reported. They must have their own monitoring in place to identify issues before customers or regulators do.

“In fact, enterprises should grasp the opportunity of the CRA to boost end-to-end IoT security. A CRA-compliant device is not, after all, the beginning and end of resilient IoT. Enterprises should monitor their IoT network behavior and flag any anomalous activity to shorten the time it takes to identify and respond to threats. Monitoring tools such as AI-driven anomaly and threat detection are helpful in supporting this.”

“The CRA looks to address vulnerabilities by demanding a more robust approach to security, across design, device monitoring, record-keeping, and reporting. The requirements also extend through the full product lifecycle: secure development, vulnerability handling, and mandatory security updates for the expected product lifetime. This means that compliance cannot be treated as a one-off exercise.

“Mandatory reporting requirements also force visibility in a way the industry has lacked. You can’t fix what is not measured, and up until now, many IoT vulnerabilities have gone unreported and unpatched. However, regulation by itself does not detect a breach, so real resilience will still depend on organizations ensuring they have monitoring and response capabilities in place to identify and address vulnerabilities in real time.

“Ultimately, under the CRA, the way the industry thinks about IoT security must shift to prioritizing built-in resilience from the outset. This means secure-by-design IoT, supported by strong authentication and monitoring, to ensure it is not only compliant, but also protected from compromise.”

As industries increasingly digitize, more of the critical functions we rely on daily depend on connected devices. With this expansion comes a need for increased vigilance across industries, particularly as more sophisticated attack techniques emerge. AI is making cybercrime cheaper, faster, and easier to scale, including through adaptive malware and automated phishing that evades traditional detection.

“But in light of heightened threats, AI and the IoT now go hand in hand: the IoT generates and captures vast quantities of data, and AI is ideally placed to analyze it.  This is particularly beneficial in elevating security solutions through AI-powered anomaly and threat detection (ATD). ATD shows promise in helping security teams identify threats like botnet activity and suspicious network traffic across tens of thousands of devices, if not more, more quickly, thereby improving resilience across entire IoT estates. This is because AI enables real-time analysis of behavior and can identify patterns and anomalies that would be impossible to detect manually at scale.

“As a result, AI-powered ATD can detect the beginning of a cyberattack, whether that be through anomalous behavior, such as suspicious IP, remote code execution, or abnormal port connection. It can even identify the attack type itself and trigger direct action in the form of incident referral or threat isolation. AI is ultimately transforming the efficiency, speed, and depth of response to increasingly sophisticated cyberthreats, reducing potential non-compliance and costly downtime, and showing real potential for enhancing device protection.”

“As deployments scale, often globally, many organizations still rely on connected devices that they ultimately cannot fully see, track, or govern. This expansion brings complexity without effective solutions and strategies in place.

“Device fleets likely carry different versions of firmware, components, and software. It is a challenge just to log and maintain such scale and variety, and this is made more difficult still when seeking to meet evolving regulatory and customer requirements around what should be recorded and how it should be maintained.

“IoT growth is forecast to rapidly increase, yet enterprises must now navigate an increasingly complex global connectivity environment, faced with varying regulations around cybersecurity, data sovereignty, and regulation, including evolving telecom policies that demand greater flexibility in how devices connect across different regions. The conversation around the IoT has therefore shifted from simply connecting devices to managing them across their full operational lifecycle.”

“Organizations must not believe they are immune to a cyberattack; we have seen these occur industry-wide in the last year, with the annual cost of cybercrime increasing worldwide, and set to reach approximately $16 trillion by 2029. This figure speaks for itself: no one must assume an attack will not happen, and organizations mustn’t underestimate the risk.

“With that in mind, the way we think about security must shift to prioritizing built-in resilience from the outset, and organizations should adopt a not if, but when mindset. As the threat landscape brings increasing risks to the IoT, resilience strategies must run across operations, systems, and connected assets, throughout the full device lifecycle. Resilience ultimately impacts regulatory exposure, accountability, operational continuity, and customer satisfaction, making it a clear business risk decision.

“In the IoT, building resilience can include implementing multi-factor authentication and visibility over the whole estate, as well as AI-driven ATD. Organizations must know what normal behavior looks like within the estate, what is connected, and where there may be blind spots. The challenge is no longer getting systems working; it is now proving continuity, building resilience, and being able to recover quickly in the instance of disruption, particularly as regulations like the CRA come into force and push further accountability onto organizations.”