Browse by cluster
32 guides
Cyber Resilience Act
Start with: Cyber Resilience Act requirements: a guide for device and firmware makers
29 guides
SBOM
Start with: Firmware SBOM: how to build one when you only have the binary
107 guides
Firmware vulnerabilities & fixes
Start with: OWASP Firmware Security Testing Methodology (FSTM), explained
66 guides
OT/ICS security
Start with: NIST SP 800-82 Rev. 3: the Guide to Operational Technology (OT) Security, explained
14 guides
PSIRT & disclosure
Start with: The FIRST PSIRT Services Framework, explained
33 guides
Medical & regulated devices
Start with: FDA premarket cybersecurity for medical devices: Section 524B explained
Start here
Cyber Resilience Act · Standards & regulation
Cyber Resilience Act requirements: a guide for device and firmware makers
What the EU Cyber Resilience Act requires from device makers: scope, roles, CRA deadlines, Annex I, product classes, fines and first steps.
7 min read Updated
SBOM · Standards & regulation
Firmware SBOM: how to build one when you only have the binary
How to build an SBOM for embedded firmware from binaries, choose CycloneDX or SPDX, use VEX to cut noise, and meet the Cyber Resilience Act SBOM duty.
11 min read Updated
OT/ICS security · Standards & regulation
NIST SP 800-82 Rev. 3: the Guide to Operational Technology (OT) Security, explained
What NIST SP 800-82 Rev. 3 actually covers: the broadened ICS-to-OT scope, typical OT threats and vulnerabilities, the SP 800-53 OT overlay, and how it differs from Rev. 2.
11 min read Updated
All guides
281 results
Medical & regulated devices · Standards & regulation
ANSI/AAMI SW96:2023 (medical device security risk management), explained
What ANSI/AAMI SW96:2023 covers: its security risk management process/plan/file structure inside the ISO 14971 framework, how it differs from AAMI TIR57 and TIR97, FDA's 2023 recognition, and why its primary text is paywalled.
6 min read Updated
SBOM · Standards & regulation
AI-BOM for embedded AI devices: what it is, and what CycloneDX and SPDX actually define
A regular SBOM lists software components; it says nothing about a model baked into a device's firmware. What an AI-BOM / ML-BOM actually inventories, how CycloneDX's ML-BOM (since v1.5) and SPDX 3.0's AIPackage profile define it, and what a firmware or device maker should start recording.
5 min read Updated
Cyber Resilience Act · Standards & regulation
Australia's smart device cyber security standards (Rules 2025), explained
Australia's mandatory Cyber Security (Security Standards for Smart Devices) Rules 2025, in force 4 March 2026: the three ETSI EN 303 645-derived requirements, which 'relevant connectable products' are covered, and the 5-year compliance-statement duty.
5 min read Updated
OT/ICS security · Standards & regulation
Australia's Security of Critical Infrastructure (SOCI) Act: cyber obligations, explained
What the Security of Critical Infrastructure Act 2018 actually requires: the 11 sectors, the Critical Infrastructure Risk Management Program (CIRMP), 12-hour/72-hour mandatory cyber incident reporting, and Enhanced Cyber Security Obligations for Systems of National Significance.
5 min read Updated
Medical & regulated devices · Standards & regulation
UN R155, UN R156 and ISO/SAE 21434: automotive cybersecurity and software updates explained
UN Regulation 155 (CSMS), UN Regulation 156 (SUMS) and ISO/SAE 21434: scope, EU mandatory dates, and how the standard and type-approval law fit together.
6 min read Updated
OT/ICS security · Protocol security
BACnet protocol security: why building automation runs unauthenticated, and what BACnet/SC changes
BACnet/IP, the protocol behind most commercial building automation, broadcasts commands in plaintext with no authentication by default. What ASHRAE Addendum 135-2016bj's BACnet/SC actually fixes, and what a decade of CISA advisories against Siemens, KMC Controls and SCADA Engine shows about where BACnet deployments actually fail.
5 min read Updated
Firmware vulnerabilities & fixes · Protocol security
Bluetooth Low Energy (BLE) security for IoT devices: why pairing and open GATT are still the real risk
BLE's own AES-CCM encryption is sound; real 2025-2026 CISA advisories and actual BlueZ/Zephyr CVEs show the exploitable gap is unauthenticated pairing and open GATT characteristics in firmware.
8 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
BSIMM16: the Building Security In Maturity Model, explained
BSIMM is a descriptive model built from 111 real firms' software security practices — 128 activities across 12 practices and 4 domains. What BSIMM16 (2026) actually measures, how it differs from a prescriptive framework like OWASP SAMM, and what its own 2026 data says about AI's effect on software security programs.
5 min read Updated
PSIRT & disclosure · Standards & regulation
Bug bounty programs for IoT and hardware vendors, explained
How a paid bug bounty program differs from a free vulnerability disclosure policy, what CISA's own federal directive says that distinction is, and what real IoT/hardware program scope, safe-harbor and payout terms look like — including a documented case where unclear scope turned a bounty into a legal dispute.
7 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
BusyBox vulnerabilities in embedded Linux firmware: identify, prioritise and fix
Why one BusyBox binary carries many CVEs, how to find its version and enabled applets in a firmware image, and how to prioritise and fix them.
9 min read Updated
Cyber Resilience Act · Standards & regulation
California SB-327: what the first US connected-device security law requires
What California's Security of Connected Devices law (SB-327, in force since 1 January 2020) actually requires: the 'reasonable security feature' standard, the unique/first-use password rule, scope, exemptions and enforcement — and why its brevity makes interpretation hard.
5 min read Updated
OT/ICS security · Protocol security
CAN bus security: what ISO 11898 does and doesn't protect in machines and vehicles
CAN — the broadcast bus Bosch released in 1986 and ISO standardized as ISO 11898 — has no authentication, encryption or message-origin field by design. What two real CISA ICS alerts found, what CAN FD and CAN XL change (and don't), and what machine builders should check first.
7 min read Updated
OT/ICS security · Protocol security
CC-Link IE TSN protocol security: the 2025–2026 CVE record, explained
CC-Link IE TSN is Mitsubishi Electric and the CLPA's flagship Ethernet/TSN industrial network for smart factories. Two Mitsubishi-disclosed CVEs in 2025 and 2026 show what happens when a deterministic fieldbus protocol built for speed, not authentication, meets a network attacker — and what mitigations actually exist today.
6 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
CIS Critical Security Controls v8.1, explained
CIS Critical Security Controls v8.1 explained: the 18 Controls, the 153 Safeguards, the cumulative IG1/IG2/IG3 Implementation Groups, and what changed from v8 to v8.1.
5 min read Updated
OT/ICS security · Standards & regulation
CISA BOD 23-02: what it requires, and what OT/ICS operators should take from an IT-only directive
CISA's Binding Operational Directive 23-02 gives federal civilian agencies 14 days to fix exposed management interfaces. It binds no one in OT/ICS or the private sector — but 2026's real PLC exposure incidents show exactly why the same pattern matters there too.
5 min read Updated
PSIRT & disclosure · Standards & regulation
CISA CIRCIA: critical infrastructure incident reporting, explained
What the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) requires: who counts as a covered entity, what a substantial cyber incident is, the proposed 72-hour/24-hour deadlines, and why none of it is mandatory yet as of November 2026.
7 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
CISA Cross-Sector Cybersecurity Performance Goals (CPGs), explained
CISA's Cross-Sector Cybersecurity Performance Goals, version 2.0: the GOVERN/Identify/Protect/Detect/Respond/Recover structure, how many goals exist, NSM-5 origin, and how CPGs differ from the NIST CSF.
6 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
CISA and NSA's 'Deploying AI Systems Securely' guidance, explained
The joint NSA/CISA/FBI/Five Eyes Cybersecurity Information Sheet published 15 April 2024: its deployment-environment, validation, access-control and monitoring best practices, who it's written for, and how the 2025 AI Data Security follow-up extends it.
9 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
CISA/FBI Product Security Bad Practices, explained
The CISA/FBI Product Security Bad Practices catalog (Version 2, January 2025): all 13 bad practices across product properties, security features and organizational process, the memory-safety roadmap deadline, and what changed since the October 2024 draft.
6 min read Updated
OT/ICS security · Standards & regulation
CISA Secure by Demand: 12 priority considerations for OT product buyers
What CISA's Secure by Demand joint guide (13 January 2025) tells OT owners and operators to require from manufacturers when buying PLCs, HMIs and RTUs: the 12 priority security elements, the ISA/IEC 62443 reference, and the April 2025 fact sheet.
6 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
CISA Secure by Design: the principles and the pledge, explained
CISA Secure by Design: the three core principles, and the seven measurable goals of the voluntary Secure by Design Pledge for software and device makers.
5 min read Updated
Firmware vulnerabilities & fixes · Protocol security
CoAP security: the amplification risk built into a constrained-device protocol
RFC 7252's CoAP runs over UDP with no security by default, and Shadowserver's internet-wide scans have repeatedly found hundreds of thousands of exposed CoAP hosts with a roughly 34x DDoS amplification factor. What CoAP's own security modes and OSCORE actually protect, and what real libcoap/Californium CVEs have found.
6 min read Updated
Cyber Resilience Act · Standards & regulation
CRA Annex I explained: essential cybersecurity requirements in plain English
A plain-English walk through Cyber Resilience Act Annex I: the product requirements in Part I and the 8 vulnerability handling duties in Part II.
12 min read Updated
Cyber Resilience Act · Standards & regulation
CRA Annex II: what manufacturers must tell the user, point by point
What Regulation (EU) 2024/2847's Annex II actually requires manufacturers to tell users — contact details, the vulnerability-reporting point of contact, support-period end date, and secure-use instructions — quoted from the regulation's own text.
10 min read Updated
Tools for these topics
Founded
2012
Reach
Clients in around 80 countries
Delivery model
Remote, worldwide
Vulnerability reports
PSIRT via [email protected], published security.txt
Questions about this page?