@finite-state.bsky.socialJoin Finite State’s Larry Pesce and SAE Media Group at 12 PM ET today for Securing the Connected Vehicle Supply Chain with Agentic AI. 🚗
Register now: https://app.webinar.net/BGxgr6Rrbw7
#AutomotiveCybersecurity #ProductSecurity #ConnectedVehicles #AgenticAI
@helpnetsecurity.comENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities
📖 Read more: www.helpnetsecurity.com/2026/09/14/e...
#cybersecurity #cybersecuritynews #CyberResilienceAct #ENISA #CRA #productsecurity #EU #Europe
@finite-state.bsky.socialHow are cellular, satellite, LPWAN & hybrid connectivity reshaping connected devices?
🎥 Watch the replay with Finite State CSO Sharon Hagi: https://bit.ly/4xVuHdu
Heading to #EmbeddedWorld NA? Visit us at Booth #6110-F.
@finite-state.bsky.socialIt is live. ⏱️
As of today, CRA Article 14 applies.
Actively exploited vulnerability? 24 hours for an early warning. 72 hours for a fuller notification.
The clock starts when you become aware. https://bit.ly/4aZNOd6
@finite-state.bsky.socialFrom firmware risks to long-term product support, Larry Pesce’s Reddit AMA explored what product security looks like after a device ships. Security decisions made today can create risk for years.
Continue the conversation today: https://bit.ly/4cWLJQy.
@finite-state.bsky.socialCould you identify every vehicle that actually shipped with a vulnerable component? 🚗
Complete software inventory is foundational to product security.
Join Larry Pesce on Sept. 15 to explore how agentic AI can help.
Register: https://app.webinar.net/BGxgr6Rrbw7
@finite-state.bsky.social2 of 10. The SBOM. 📋
CRA reporting starts tomorrow. The SBOM requirement applies in 2027, but the dependency runs the other way.
You cannot report on a component you never documented.
https://finitestate.io/cra
@finite-state.bsky.social3 of 10. Vulnerability disclosure. 📩
CRA reporting starts Sept. 11. If a researcher’s report lands in an unmonitored inbox, your 24-hour clock may already be running.
Who owns your intake queue?
@finite-state.bsky.social4 of 10: Third-party components. 🔍 Applies 11 Dec 2027.
A supplier’s binary becomes your responsibility. Open-source exemptions do not travel with the code into your product.
Do you know what’s in your image?
@finite-state.bsky.social6 of 10: Secure by design and secure by default. 🔒 Applies 11 Dec 2027.
Two separate requirements, often treated as one.
The test: is your device secure out of the box, before anyone configures it?
@finite-state.bsky.socialCustomer success in action. ⭐
“I use Finite State for Binary Scanning and Vulnerability analysis. It has a straightforward FS-CLI and UI options.”
Thanks to Venkat for sharing your experience on G2. https://bit.ly/3TLMV1O
@compass-security.comFrom 11 September 2026, manufacturers selling digital products in the EU have 24 hours to report actively exploited vulnerabilities. ⏱️ Andreas Brombach explains what is reportable, and how to actually make those deadlines. blog.compass-security.com/2026/09/cra-...