News from the Wire

ONEKEY Cybersecurity Report 2026: Supply chain plays key role in CRA compliance

Thursday, November 05, 2026 — 17:43:33 (UTC)

ONEKEY Cybersecurity Report 2026: Supply Chain Plays Key Role in CRA Compliance

ONEKEY: Manufacturers must ensure transparency across all software components and systematically involve suppliers in vulnerability management

Düsseldorf, Germany, November 5, 2026 – With the Cyber Resilience Act (CRA), the European Union is making the cybersecurity of connected hardware and software a prerequisite for market access. For manufacturers, this means they must not only ensure the security of their own developments, but also consider and assess cybersecurity risks that enter their products through supplied software, firmware, upstream products, and other components. “This makes the supply chain a decisive factor for CRA compliance, both when third-party programs are used in a company’s own software and when purchased components with embedded software are integrated,” according to the latest “IoT & OT Cybersecurity Report 2026.” The report by Düsseldorf-based cybersecurity specialist ONEKEY is based on a survey of 200 industrial companies in Germany on the preparation, implementation, and impact of the EU regulation to strengthen the protection of connected devices, machines, and systems against hacker attacks.

Modern digital products consist only partly of in-house developed software. Operating systems, open-source libraries, communication modules, software development kits, containers, cloud components, and firmware from suppliers often make up a large part of the finished product. This creates multi-tier dependencies: a directly integrated software library may in turn contain additional components that the manufacturer may not even be aware of. As a result, a single vulnerability can affect numerous products and product versions across multiple supply tiers.

“The Cyber Resilience Act puts an end to the notion that responsibility for insecure software components can simply be passed on to the supplier,” explained Jan Wendenburg, CEO of ONEKEY. “Anyone who brings a product to the European market under their own name must control the cybersecurity risks of the entire product. To do so, the manufacturer needs reliable information about which components are actually included, where they come from, and which product versions are affected when a new vulnerability is discovered.”

Manufacturers Are Responsible for the End Product

The CRA requires manufacturers to exercise due diligence when integrating third-party components. They must ensure that the components used do not compromise the security of the finished product.

As ONEKEY’s “IoT & OT Cybersecurity Report 2026” shows, 25.8 percent of German industrial companies already actively and consistently require CRA compliance from their suppliers. Another 33.3 percent say they are pursuing this approach “partially,” meaning they still have gaps in their supply chain with regard to the Cyber Resilience Act. Among the companies surveyed, 20.8 percent have not yet taken any action in this direction. “In no case do supplier certifications or contractual assurances replace the manufacturer’s own risk assessment,” emphasized Jan Wendenburg.

The same applies to freely available open-source components. Manufacturers need to know which version they are using, whether known vulnerabilities exist, and how newly published security flaws affect their own product. This becomes particularly problematic with older libraries or components that are no longer maintained and for which no reliable point of contact or security updates are available.

Manufacturers should therefore check, as early as the supplier selection stage, which security and development processes the supplier has in place, whether software components and dependencies are documented in a traceable manner, how quickly the supplier provides information about new vulnerabilities, who provides security updates and for how long, how security-relevant changes are communicated, and whether components can be clearly assigned to specific product and firmware versions. In addition, obligations to cooperate, provide information, and deliver updates should be set out in contracts.

According to the “IoT & OT Cybersecurity Report 2026,” the supplier side presents a very mixed picture with regard to the new EU cybersecurity regulation. Not even one-fifth of suppliers (17.5 percent) have consistently prepared for it and deliver the necessary information. Another 44.2 percent take the CRA requirements into account at least partially. A further 13.3 percent of suppliers are barely prepared, and for 25.0 percent, manufacturers do not know where their CRA preparations stand.

“With suppliers from Asia in particular, European manufacturers often find that the Cyber Resilience Act is hardly known or is regarded as a purely European matter. That is a misconception: all suppliers that sell products or components in Europe must meet the CRA requirements themselves. If products or components from abroad are built into another product and also sold in Europe, the manufacturer must also demonstrate CRA conformity for the new end product. Missing SBOMs, unclear software versions, or unregulated security updates can thus directly become a compliance and market access risk,” warned ONEKEY CEO Jan Wendenburg.

SBOM Becomes the Inventory of the Software Supply Chain

A central tool for the transparency required by the CRA is the Software Bill of Materials, or SBOM for short. It records the software components contained in a product and their relationships.

In practice, however, it is not enough to generate a component list once and file it away. An SBOM must match the software version actually shipped, be assigned to a specific product version, and be updated whenever relevant changes occur. Otherwise, the result is merely a snapshot that is of little use for subsequent vulnerability analysis.

Additional difficulties arise when suppliers provide SBOMs in different formats, with inconsistent naming, or without clear version information. Some lists only cover directly used components and ignore deeper dependencies. Others contain parts that were used during development but are no longer present in the shipped product. Manufacturers must therefore consolidate and verify the information supplied and compare it with the actual binary or firmware version.

New Vulnerabilities Continuously Change the Risk Landscape

A component assessed as secure at market launch may be affected by a newly discovered vulnerability months or years later. Supply chain transparency must therefore be combined with continuous vulnerability management. Manufacturers need processes that automatically match new security advisories against the affected components, product versions, and installed device fleets.

However, not every vulnerability that is theoretically mapped to a product is actually exploitable in that specific product. Key factors include the configuration, the context of use, and whether the affected function is included or reachable at all. Supplementary VEX information—Vulnerability Exploitability eXchange—can document whether and why a known vulnerability affects a particular product. This makes it possible to prioritize alerts and remediation measures.

“An SBOM creates visibility, but compliance only comes about when companies translate this information into operational processes,” Jan Wendenburg explained. “They must assess new vulnerabilities, identify affected products, document decisions in a traceable manner, and provide security updates in good time when needed. It is precisely this link between software inventory, risk assessment, and response that is the real challenge in complex supply chains.”

Contract Management Alone Is Not Enough

The CRA is also likely to change business relationships between manufacturers and suppliers. In the future, manufacturers will need not only technical specifications, prices, and delivery dates, but also reliable security information. Corresponding requirements should already be taken into account in procurement, supplier selection, and contract design.

Useful provisions include, for example, agreements on machine-readable SBOMs, reporting channels for vulnerabilities, response times, security updates, support periods, and the passing on of relevant information from upstream supply tiers. Equally important is a defined procedure in case a component is no longer maintained or the supplier ceases operations.

Automated Analysis Instead of Manual Spreadsheets

For extensive product portfolios and regularly updated firmware, manually maintained spreadsheets quickly reach their limits. ONEKEY helps manufacturers identify software components in binary and firmware files, import and validate existing SBOMs, and consolidate information from different sources. The ONEKEY Product Cybersecurity & Compliance Platform supports standardized formats such as CycloneDX and SPDX and allows enrichment with VEX and VDR information.

In addition, ONEKEY continuously monitors product versions for known and previously unknown vulnerabilities. Automated impact assessments help distinguish theoretical matches from actually relevant risks and prioritize measures. This allows product development, Product Security Incident Response Teams, compliance officers, and product management to work from a shared data set.

Time Pressure Is Mounting

The CRA reporting obligations for actively exploited vulnerabilities and severe security incidents have been in effect since September 11, 2026. As of December 11, 2027, the main product and manufacturer obligations will apply in full. New products with digital elements must then generally be CRA-compliant when they are first made available on the EU market.

However, building robust supply chain transparency cannot be accomplished in the short term. Missing information must be obtained from suppliers, product versions recorded, SBOMs validated, and responsibilities assigned. In addition, technical and organizational processes are needed for vulnerability assessment, updates, documentation, and reporting.

“Companies should not wait until the final conformity assessment,” warned Jan Wendenburg. “Those who only discover shortly before market entry that key components cannot be identified or that the supplier cannot provide sufficient security information risk delays, costly rework, and, in the worst case, loss of market access. CRA compliance in the supply chain must therefore begin with purchasing.”

ONEKEY is the leading European specialist in Product Cybersecurity & Compliance Management and part of the investment portfolio of PricewaterhouseCoopers Germany (PwC). The unique combination of the automated ONEKEY Product Cybersecurity & Compliance Platform (OCP) with expert knowledge and consulting services provides fast and comprehensive analysis, support, and management to improve product cybersecurity and compliance from product purchasing, design, development, production to end-of-life.

Critical vulnerabilities and compliance violations in device firmware are automatically identified in binary code by AI-based technology in minutes – without source code, device, or network access. Proactively audit software supply chains with integrated Software Bills of Materials (SBOMs) generation. "Digital Cyber Twins" enable automated 24/7 post-release cybersecurity monitoring throughout the product lifecycle.

The integrated ONEKEY Compliance Wizard already supports compliance with requirements from IEC 62443-4-2, ETSI EN 303 645, UNECE R155, and many other standards and regulations.

As part of the EU-funded CRACoWi (Cyber Resilience Act Compliance Wizard) project, ONEKEY is collaborating with 13 European partners to develop an AI-powered assistant for the automated implementation of the EU Cyber Resilience Act (CRA).

The solution will guide companies through the entire compliance process—from the initial CRA scope assessment to the generation of the required Declaration of Conformity.

The Product Security Incident Response Team (PSIRT) is effectively supported by the integrated automatic prioritization of vulnerabilities, significantly reducing the time to remediation.

Leading international companies in Asia, Europe and the Americas already benefit from the ONEKEY Product Cybersecurity & Compliance Platform (OCP) and ONEKEY Cybersecurity Experts.

Further information: ONEKEY GmbH, Sara Fortmann, email: sara.fortmann@onekey.com, Toulouser Allee 19A, 40211 Düsseldorf, Germany, web: onekey.com

PR Agency: euromarcom public relations GmbH, Mühlhohle 2, 65205 Wiesbaden, Germany, email: team@euromarcom.de, web: www.euromarcom.de

Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.

Source: Company press release.

Categories: Reports and research