Protect your build environments and report on time.
The Cyber Resilience Act (CRA) makes cybersecurity a condition for selling hardware and software in the EU. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents within 24 hours, and from December 2027 products must meet the CRA’s security requirements in full. Helm protects the environments where your products are built and gives you the record each report needs.
Until now, the security of connected products in the EU has largely been left to the market. The CRA changes that. It makes manufacturers responsible for the security of their hardware and software across its whole life, from design to the last security update.
The first obligations already apply. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities in their products, and severe incidents that affect product security, through ENISA’s single reporting platform. The duty also covers products already on the market. Breaches of the CRA’s core requirements can bring fines of up to €15 million or 2.5% of worldwide turnover.
For a manufacturer, a ransomware attack on the systems where products are developed, built and updated is no longer only an IT problem. If it touches the security of what you ship, it starts the CRA’s 24-hour clock.
The Cyber Resilience Act, Regulation (EU) 2024/2847, entered into force on 10 December 2024. It applies to products with digital elements sold in the EU, from connected machines and devices to software, and to their manufacturers, importers and distributors. Products covered by their own sector rules, such as medical devices and vehicles, are largely outside it.
Its core requirements ask for security by design and by default, a process for handling vulnerabilities, security updates throughout a support period, a software bill of materials and a conformity assessment before the CE mark.
CRA reporting runs on three deadlines. An early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report, 14 days after a fix is available for a vulnerability, or one month after the notification for a severe incident. NIS2 covers how organisations run their security, while the CRA covers the products they make.
Meeting those deadlines depends on knowing quickly what happened in your own environment. That is where Helm fits in.
Helm does not certify your products. It protects the environments behind them and gives you the facts the CRA asks for.
If you make connected products. Your development, build and release environments hold source code, builds and update packages. Helm protects the file servers and shares where they live, detects active encryption in under a second and isolates the compromised accounts and devices on fixed, readable rules, with no AI in containment.
Helm then verifies systems are clean before work resumes, so you do not release from a compromised environment. Its timestamped record gives you the facts for the 24-hour, 72-hour and final reports.
If you buy security tools. The CRA applies to them too, so ask your suppliers how they meet it. Helm is a product with digital elements and is being prepared for the CRA, with secure development, vulnerability handling and security updates. [TBC]
The CRA asks manufacturers to stand behind the security of what they sell, and to report fast when it is threatened. Helm keeps the environments behind your products under control during an attack and gives you the record to report from, so releases stay on track.
Many CRA manufacturers are also industrial firms facing ransomware on the factory floor. To discuss your CRA readiness, talk to us.
