The latest European Commission guidance on the Cyber Resilience Act sends a clear message to manufacturers of connected products: cybersecurity must be designed in from the start, maintained throughout the product lifecycle, and supported by demonstrable processes for risk management, vulnerability handling and ongoing support.

For organizations building, deploying and managing connected devices, this is a significant shift. The CRA is not simply another compliance exercise. It reflects a broader market reality that connected products can no longer rely on fragmented security controls, manual processes or assumptions of trust. Security has to be continuous, operational and scalable.

That matters especially in IoT and OT environments, where products often have long lifespans, depend on complex supply chains, rely on third-party components and remote services, and may remain in use for many years after deployment.

RSAC remains the cybersecurity event. It is where the industry gathers to compare notes, pressure-test assumptions, spot the next wave of market change and, just as importantly, build the partnerships that will shape what comes next.

This year in San Francisco, that energy was unmistakable.

There was real buzz across the city, from the show floor and executive meetings to the side events and industry gatherings that increasingly define RSAC week. For Device Authority, it was another valuable opportunity to meet new contacts, deepen existing relationships and explore partnerships that can help us move faster in a market that is changing rapidly.

One thing is yet again clear after this year’s event: cybersecurity is not standing still. It is consolidating, converging and accelerating.

by Darron Antill, CEO Device Authority

Across the automotive industry, conversations around PKI and key management have moved from technical design discussions to board-level priorities.

Regulatory frameworks such as UNECE WP.29, ISO 21434, and the emerging EU Cyber Resilience Act are fundamentally reshaping how OEMs and supply chain partners must think about cryptographic control. At the same time, vehicle architectures are becoming increasingly software-defined, connected, and supply-chain dependent.

Device Authority, a leader in identity and key lifecycle automation for connected devices, today announced it has secured a significant new automotive customer as well as expanded an existing automotive deployment, as manufacturers move to bring cryptographic key management under direct OEM ownership to strengthen cybersecurity, simplify mandatory compliance, reduce supply chain risk and comply with new market expansion.

The EU Cyber Resilience Act (CRA) establishes mandatory cybersecurity requirements for most products with digital elements placed on the EU market. It raises the baseline for secure-by-design/default engineering and, critically, makes post-market security support and evidence production a compliance obligation.

Automotive engineering teams are being asked to deliver faster, with less tolerance for failure.

Software-defined vehicle programmes, secure OTA rollouts, zonal and service-oriented architectures, and continuous feature delivery are now baseline expectations. In parallel, regulatory pressure is increasing — from WP.29 (R155/R156), ISO/SAE 21434, and the forthcoming EU Cyber Resilience Act — tightening requirements around software integrity, traceability, and lifecycle governance.

None of these forces are new in isolation. What is new is how they converge on an area that’s often under-designed: Cryptographic Key Management.

Agentless IoT security enables identity-based protection for devices that can’t run software agents. Learn how it secures IoT and OT at scale.

The rapid expansion of connected devices has fundamentally changed how organisations operate. From smart sensors and industrial controllers to gateways, cameras, and embedded systems, IoT has become integral to modern business. Digital transformation is accelerating the adoption of IoT technologies, increasing the attack surface and making IoT security a critical component of modern cybersecurity strategies. Yet as these environments grow, a dangerous reality has emerged: many organisations no longer know exactly what is connected to their networks.

For more than three decades, cybersecurity innovation and investment have followed a familiar rhythm. Each major wave—network security, endpoint security, identity, cloud, and data—spawned new platform winners and reshaped the M&A landscape. Today, we stand at the threshold of the next foundational shift. The digital and physical worlds have converged to such an extent that machines—not humans—are the primary operators of enterprise networks. They power manufacturing lines, drive vehicles, control energy infrastructure, guide medical systems, and increasingly act autonomously through embedded AI.