top of page
Engineering Blog for High Performance Insights


The Role That Doesn’t Transfer - CRA manufacturer obligations across acquisitions, carve-outs, rebrands and insolvency
EXECUTIVE BRIEF. This article discusses the impact when manufacturers of CRA impacted products transition. The EU Cyber Resilience Act hangs every obligation on a single role, the manufacturer, and says almost nothing about what happens when the company holding that role is sold, split, rebranded or wound up. In operational technology, where assets outlive the companies that made them, that silence is a liability someone is already carrying. Usually it is the buyer, and usua
Scott Ludwick
5 days ago4 min read


i3X 1.0, Cyber Resilience Act, and the assurance gap in open industrial APIs
OT SECURITY BRIEF: We look into the security aspects of the recently introduced i3X 1.0 (Industrial Interoperability eXchange) In June 2026, CESMII froze version 1.0 of i3X — the Industrial Information Interoperability eXchange — and shipped it with an implementation guide, an OpenAPI definition, a Python client, a conformance test suite and an MCP server. Forty-four technology providers have publicly aligned behind it. The specification is small, MIT-licensed, and by severa
Scott Ludwick
Sep 1510 min read
bottom of page