Part #6 of our Human Written CRA series unpacks Annex I Part I requirement 2(d): from MFA and machine-to-machine TLS to unauthorized access reporting, surface reduction, and substantial modification triggers.

The European Commission has officially released its guidance to support the implementation of the Cyber Resilience Act (CRA).

Here is a breakdown of the key takeaways from the Commission’s release and what it means for your automated compliance strategy.

The CRA sets the legal rules for product cybersecurity — EN 40000 is the technical blueprint for meeting them. Here's how the four-part standard works and why it matters for your compliance strategy.

Blog #5 in our Human Written CRA expert series: The EU Cyber Resilience Act flips security responsibility onto manufacturers. Learn what “secure by default” really demands for configurations, updates, features, and data collection.

Blog #4 in our Human Written CRA expert series: What's actually running in your product? Most teams don't know. Learn how to generate an SBOM — from source code to binaries — and why the CRA requires it.

Blog #3 in our Human Written CRA expert series: What “no known exploitable vulnerabilities” actually means under the CRA—and how SBOMs, risk assessment, and automation help you meet the new security and reporting duties.

Blog #2 in our Human Written CRA expert series: Turn CRA’s abstract risk assessment requirement into a concrete, 3‑step process: define scope, identify assets, and prioritize risks by likelihood and impact to guide secure product design.

Blog #1 in our Human Written CRA expert series: Learn how to tell if CRA applies to your product by clarifying intended purpose, core and essential functions, and mapping product boundaries, components, and external dependencies.

Test of Things, a cybersecurity startup, has just raised a €1.2 million pre-seed funding round to help connected product manufacturers to automate cybersecurity testing and compliance management.

A research-backed look at 16 IoT cybersecurity requirements—where they align, where they clash, and how to build one practical, testable baseline for secure, compliant connected products.

New research shows most IoT vulnerabilities are not in the device, but in cloud backends, web frontends, and mobile apps—revealing why HTTP and injection flaws drive real-world IoT attacks.

September 2026 triggers 24‑hour vulnerability reporting under the EU CRA. See why that date, not 2027, is your real deadline—and how to get ready in time.

IoT compliance has evolved from a checkbox to a strategic imperative. Learn how specialized compliance management tools transform regulatory burden into competitive advantage for IoT manufacturers.

Discover how to translate IoT vulnerabilities into concrete financial risk, avoid costly recalls and fines, and turn product security into a high-ROI, board-level investment decision

The EU Cyber Resilience Act doesn't just regulate IoT hardware—it includes your backend too. Learn when cloud platforms become part of your product and what compliance requirements you must meet.

Test of Things is end-to-end connected system cybersecurity compliance and testing platform covering devices, back-ends and for example mobile applications.
Stay compliant continuously and ship with confidence.

IEC 62443-4-1 provides a proven framework for IIoT and OT manufacturers to meet most EU CRA requirements. Learn how this secure development lifecycle standard accelerates your CRA compliance journey.

The EU CRA introduces strict 24/72-hour vulnerability reporting for manufacturers, demanding rapid response, proactive testing, and transparent communication—or risk heavy fines and lost trust.

Why IoT company boards must treat cybersecurity as a core fiduciary duty. Any oversight is no longer optional in today's risk-driven regulatory landscape

The core challenge? Scaling security to match your product's complexity.

If your team is still relying on manual, point-in-time penetration testing, every new product variant, every minor firmware update, and every regional configuration change adds exponential overhead. This leads to a dangerous trade-off: compromising on the depth or frequency of testing to meet tight launch deadlines.

What do EU CRA fines really mean for your business? This post reveals the true financial risks of non-compliance—and the steps smart IoT companies take to stay protected. Find out how to avoid penalties before it’s too late