EU Cyber Resilience Act ‘completely kills’ manual vulnerability triage

Independent security experts see the EU Cyber Resilience Act (CRA) reshaping international technology markets to emphasize cyber resilience from the ground up, thereby testing the operational capacities of technology vendors whose wares compete in those markets.

The EU CRA introduces mandatory reporting within 24 hours for any actively exploited vulnerabilities or severe incidents affecting products with digital elements. The reporting requirement, introduced Sept. 11, establishes an EU-wide product-security law for internet-connected hardware and software products that security experts see having broad implications beyond the EU.

Enterprise technologies such as security software, identity-management systems, operating systems, routers, firewalls, network management systems, VPNs, and more all fall within the scope of the regulation. The CRA establishes a legally binding EU regulation that applies even if a company is headquartered outside the EU.

Vincent Lomba, chief product security officer at Alcatel Lucent Enterprise, sees the CRA’s reporting rules turning security into a mandatory baseline for market entry anywhere given that its impact will extend beyond Europe and effect a wide range of technology markets, including the hardware running modern AI workloads.

“Manufacturers are currently prioritising raw processing power over built-in resilience,” says Lomba. “That can no longer be the case.”

Lomba adds: “In order to maintain European market access, global hardware and GPU providers must soon update their core architectures to integrate comprehensive cyber resilience from the ground up.”

The regulations mean that firms doing business in Europe will be obliged to build security directly into their products from the design phase, giving them a competitive advantage over those that don’t. That advantage will confer in particular to European firms, Lomba says.

“These rules will establish a new international benchmark. It will force tech suppliers around the world to up their resilience practices in order to continue to compete with the European supply chain,” he adds.

Other experts compared the rules introduced through the CRA to the changes that came with the adoption of the EU’s General Data Protection Regulation (GDPR).

“Overall, there are parallels to be drawn between the current state of the Cyber Resilience Act and the early days of GDPR rules,” says Artem Serebrov, director of product at PCA Cyber Security.

But that parallel may include follow-on effects that could undermine the very purpose of the legislation, Serebrov adds.

“Similarly, under GDPR, obligations to report data leakage were introduced without obligations to measure data loss,” he notes. “This invited companies to softly limit the extent to which they were monitoring data loss in the interest of avoiding hefty GDPR-related fines.”

Manual vulnerability triage rendered inadequate

One significant issue is that the information needed to file a CRA notification usually lives in five or six different places at once: security information and event management (SIEM) systems, threat feeds, known exploited vulnerability (KEV) alerts, scanner findings, asset inventories, and software bills of materials (SBOMs), none of which have been built to talk to one another on a readily compliant 24-hour timeline.

Joe Brinkley, director of offensive security research and community at penetration testing as a service vendor Cobalt, warns that the 24-hour reporting clock “completely kills manual triage” procedures for vendors obliged to comply with the new regulations.

“You just can’t expect an analyst to catch a KEV alert, manually grep a static SBOM, and then dig through SIEM logs to see if a box is actively taking fire,” he says.

Faced with tight reporting deadlines, vendors must wire these isolated silos of security alerts together — an operational follow-on obligation of the regulation.

“The second a vulnerability drops, the infrastructure needs to automatically query the SBOM, pinpoint the affected assets, and cross-reference live telemetry to confirm exploitation,” Brinkley advises. “If you don’t automate that discovery phase, your team is going to spend 23 hours hunting for ground truth across five different dashboards instead of actually pushing patches.”

Operational resilience put to the test

Louise Horton, head of UK government affairs at cybersecurity consultancy NCC Group, argues that reporting requirements introduced through the CRA will be the first real test of operational readiness for many organisations.

“Success will depend on having mature vulnerability management processes, visibility across products and dependencies, and the ability to identify, assess, and report security issues quickly and accurately,” Horton says.

“Those that are most prepared will have already embedded secure-by-design principles into product development and established strong governance across their software and supply chains,” Horton adds.

Rather than treating compliance as a series of isolated obligations, organisations should view these requirements as part of a broader cyber resilience strategy, Horton notes.

Heigor Freitas, head of region (UK and Europe) of industry group CREST, argues the EU CRA will strengthen the foundation of the digital ecosystem.

“It will encourage organisations within scope of the CRA, including software and hardware manufacturers, to strengthen processes, improve accountability, and embed security more consistently throughout their practices,” Freitas says.

That pressure, Cobalt’s Brinkley argues, will fall directly on their CISOs.

“It [CRA] rips vulnerability reporting right out of the legal department and drops it directly into live security ops,” Brinkley says. “That 24-hour window is brutal. If you lack absolute, real-time ground truth about your software supply chain, you are going to fail the requirement.”

CRA will drive a new baseline for visibility for enterprise security professionals as well, because they will need to have a much better understanding of their software and hardware infrastructure.

“Taking three days to figure out if you’re exposed to a zero-day is a luxury nobody has anymore,” Brinkley warns, adding that SBOMs will have to get agile.

“CISOs have to stop treating SBOMs and asset lists like dead compliance PDFs,” he says. “They need to be live data structures. You have to query them constantly through the engineering pipeline to drive immediate mitigation, rather than just using them to check a compliance box once a quarter.”