Engineering Blog for High Performance Insights

PRODUCT SECURITY BRIEF. This article discusses the impact when manufacturers of CRA impacted products transition. The EU Cyber Resilience Act hangs every obligation on a single role, the manufacturer, and says almost nothing about what happens when the company holding that role is sold, split, rebranded or wound up. In operational technology, where assets outlive the companies that made them, that silence is a liability someone is already carrying. Usually it is the buyer, a

SECURITY BRIEF: CRA secure-by-default essential requirement through the lens of protocols that the device supports. Protocol security does not behave like a product property. Every industrial protocol that has added cryptographic protection — PROFINET Security Classes 2 and 3, CIP Security on EtherNet/IP, the OPC UA secure channel — protects a session, and a session needs two capable endpoints. The security a plant actually achieves is set by the least-capable peer in each re

SECURITY BRIEF: In this posting we explore the operational aspects of deploying resolution of exploitable vulnerabilities by manufacturers in the field. This article is a companion to "The Four Clocks for Manufacturers" This edition addresses the asset owner and operator: the entity running the estate at the operations level, on whom NIS2’s risk-management measures and Article 23 reporting clocks bind directly (where in scope), and whose engineering obligations run through

CRA Article 14 compliance for manufacturers

POSITION NOTE: Through EU legislated CRA (Cybersecurity Resiliency Act) scope is product level, efforts are made to assert compliance by way of systems architecture - will this assertion hold water? We explore this question. In late 2025, EtherCAT Technology Group consortium announced that its protocol meets the requirements of the EU Cyber Resilience Act. The initial statement, from the EtherCAT Technology Group, was carefully qualified — the protocol was said to meet IEC