Engineering Blog for High Performance Insights

PRODUCT SECURITY BRIEF. This article discusses the impact when manufacturers of CRA impacted products transition. The EU Cyber Resilience Act hangs every obligation on a single role, the manufacturer, and says almost nothing about what happens when the company holding that role is sold, split, rebranded or wound up. In operational technology, where assets outlive the companies that made them, that silence is a liability someone is already carrying. Usually it is the buyer, a

NEP SERVICES BRIEF: In this brief we look at key aspects that organizations need to build out to ensure that they are fully ready to conform to CRA (Cybersecurity Resiliency Act) a sustainable way. CRA compliance is looming for vendors and operators alike from now for reporting and in 15 months for product compliance. The ramification for non-compliant products is that they will lose their CE mark if they had it before. More importantly, substantial monetary penalties are

EXECUTIVE BRIEF: We look at required reporting becoming effective September 11, 2026 and what it means for the installed base. 24 h EARLY WARNING AFTER AWARENESS 72 h FULL NOTIFICATION VIA THE SRP €15M / 2.5% MAXIMUM FINE (GLOBAL TURNOVER) On 11 September 2026, the first operative obligation of the EU Cyber Resilience Act takes effect: manufacturers of products with digital elements sold into the EU must report actively exploited vulnerabilities and severe incidents to their

SECURITY BRIEF: Quantum computing will introduce cryptography challenges for Edge devices now and in the future. Here we look at this challenge relative to the OT environment. Quantum computing occupies an unusual position in the OT security conversation: it is simultaneously the reason current encryption will eventually fail and one of the technologies proposed to replace it. For OT and embedded environments, both sides of that story collide with the same structural problem