244 results
OWASP Top 10:2025: the 10 categories, explained
The official OWASP Top 10:2025 categories, what changed from the 2021 edition, and the data behind the rankings — straight from OWASP's own published methodology and category pages.
4 min read Updated
OWASP Top 10 CI/CD Security Risks, explained
What the OWASP Top 10 CI/CD Security Risks project (CICD-SEC-1 through CICD-SEC-10) actually documents — flow control, pipeline identity, dependency chain abuse, Poisoned Pipeline Execution, PBAC and artifact integrity — and how it maps onto SLSA, in-toto and SBOM controls for a firmware build pipeline.
5 min read Updated
OWASP Top 10 for LLM Applications, explained
The OWASP GenAI Security Project's Top 10 risks for large language model applications (2026 edition): the ten items, what changed from 2025, and how it fits alongside OWASP's other Top 10s.
4 min read Updated
PCI DSS v4.0.1: the 12 requirements, explained
What PCI DSS v4.0.1 actually requires: the 6 goals, 12 requirements, and the 51 new requirements that became mandatory on 31 March 2025 — plus what changed from v3.2.1.
5 min read Updated
PROFIBUS DP security: a 1989 serial fieldbus with no authentication, still running 71 million devices
PROFIBUS DP, standardized in IEC 61158 Type 3, predates PROFINET by over a decade and has no authentication, encryption or session concept in its base protocol. What PI's own technical documentation does and doesn't say about security, what published research found, and why RS-485 wiring changes the practical response.
8 min read Updated
PROFINET protocol security: the DCP weakness behind a decade of CISA advisories
PROFINET runs a large share of the world's factory floors on Ethernet, and its Discovery and Configuration Protocol (DCP) has no authentication. What PI's three Security Classes actually add, what a decade of CISA advisories against Siemens PROFINET devices shows about real failures, and the segmentation controls that compensate.
5 min read Updated
How to set up a PSIRT and vulnerability disclosure process for a hardware product company
Step-by-step: set up a PSIRT and vulnerability disclosure process for a device or hardware company, aligned with ISO/IEC 29147, ISO/IEC 30111, FIRST and the EU Cyber Resilience Act.
4 min read Updated
UK PSTI and the US Cyber Trust Mark: what device makers must do in each market
A side-by-side guide to the UK's mandatory PSTI product security rules and the US voluntary Cyber Trust Mark: scope, requirements, penalties and status.
5 min read Updated
UK PSTI statement of compliance: the document every manufacturer must draw up
The exact Schedule 4 contents of a UK PSTI statement of compliance, who must issue and keep one, and for how long, under the Security Requirements Regulations 2023.
4 min read Updated
The Purdue Model for OT/ICS network architecture, explained
What the Purdue Model actually is: its 1990s manufacturing origin, the Level 0-5 hierarchy plus the Level 3.5 industrial DMZ, and why CISA and NIST still reference it even as cloud and remote access erode strict segmentation.
6 min read Updated
S7comm protocol security: why Siemens S7 PLCs keep showing up in CISA advisories
S7comm, the protocol Siemens S7 PLCs speak over TCP port 102, was built with no authentication for an era of isolated plant networks. What CISA's August 2026 joint advisory on AI-assisted S7 exploitation actually found, what S7CommPlus changes, and what an asset owner should check first.
4 min read Updated
SBOM Minimum Elements: what a compliant SBOM must contain
What the 2026 CISA/NSA/FBI-led Minimum Elements for a Software Bill of Materials actually requires: the 17 data fields, 6 practices and processes, and what changed from the 2021 NTIA version.
6 min read Updated
Secure boot and hardware root of trust, explained
What secure boot and a hardware root of trust actually are: how a chain of trust runs from immutable ROM through bootloader to OS/firmware image, where TPMs, secure elements, Arm TrustZone and TCG DICE fit, and how the pieces relate to NIST SP 800-193, SP 800-147 and CRA expectations.
6 min read Updated
CISA's Secure Software Development Attestation Form, explained
What the federal self-attestation form under OMB M-22-18 actually required, the three ways to satisfy it, and why OMB's January 2026 memo M-26-05 made it optional rather than mandatory.
4 min read Updated
Singapore's Cybersecurity Labelling Scheme for IoT (CLS(IoT)), explained
CSA Singapore's CLS(IoT) — the 4-tier/4-asterisk consumer IoT security label, the mandatory Level 1 for Wi-Fi routers, and the mutual recognition deals with Finland, Germany, South Korea and the UK.
4 min read Updated
SLSA explained: supply-chain levels for software artifacts
What SLSA v1.2's Build and Source tracks require at each level, who maintains the framework, and how it relates to firmware SBOM and secure build evidence.
4 min read Updated
SPDX 3.0, explained: what changed for SBOMs
What SPDX 3.0 (released April 2024) actually changed from SPDX 2.x — the nine-profile model, the RDF-based data graph, the new Security and AI profiles with built-in VEX relationships, and where it stands next to CycloneDX and ISO/IEC 5962.
5 min read Updated
SSVC: Stakeholder-Specific Vulnerability Categorization, explained
CISA and Carnegie Mellon SEI's SSVC decision-tree model for vulnerability prioritization — the decision points, CISA's Track/Track*/Attend/Act outcomes, and how it differs from CVSS scoring.
4 min read Updated
Thread protocol security: what the mesh actually protects, and where commissioning breaks
Thread Group's own marketing calls Thread's security 'bank-grade,' built on a network-wide key, DTLS-protected commissioning and, since 2024, certificate-based TCAT. But a peer-reviewed test of OpenThread-based networks found the commissioning step itself could be jammed, password-guessed or hijacked to recover that same network key. What device makers and Matter integrators actually need to verify.
6 min read Updated
TISAX (automotive supply chain information security assessment), explained
What TISAX actually is: ENX's VDA ISA-based assessment, the AL1-AL3 assessment levels, the 0-5 maturity scale, label validity, and the 2026 ISA2027 catalogue transition suppliers need to track.
6 min read Updated
TSA Pipeline Security Directives: what covered operators must do
What TSA's two pipeline cybersecurity directive series actually require: 24/7 coordinators and incident reporting under SD-01, and the Cybersecurity Implementation/Incident Response/Assessment Plans under SD-02C/SD-02D, with current effective dates.
5 min read Updated
UDS (ISO 14229) security: the protocol that can reflash an ECU, and what guards it
UDS — ISO 14229, run over ISO 15765-2 CAN transport — is the service set a dealer tool uses to read trouble codes and reflash ECU firmware. Its SecurityAccess (0x27) seed-key gate has a documented history of weak OEM implementations. What the Jeep Cherokee research actually found about it, what a 2024 academic paper demonstrated on a real truck, and what NHTSA recommends.
11 min read Updated
UL 2900-1 (software cybersecurity for network-connectable products), explained
UL 2900-1 (ANSI/CAN/UL 2900-1, Edition 2, December 2023) — its three requirement areas, what it explicitly excludes, the UL Cybersecurity Assurance Program (UL CAP) built on it, and its August 2017 FDA recognition for medical device premarket submissions.
5 min read Updated
UL 2900-2-1 (software cybersecurity for healthcare and wellness systems), explained
UL 2900-2-1 (ANSI/CAN/UL 2900-2-1, Edition 1, September 2017, revised September 2023) — the healthcare-specific companion to UL 2900-1, its scope over medical devices and wellness products, and its June 2018 FDA recognition for premarket submissions.
4 min read Updated
Questions about this page?