Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

by Darron Antill, CEO Device Authority Across the automotive and wider manufacturing industry, conversations around PKI and key management have moved from technical design discussions to board-level priorities. Regulatory frameworks such as UNECE WP.29, ISO 21434, and the emerging EU Cyber Resilience Act are fundamentally reshaping how OEMs and supply chain partners must think about cryptographic control.

The EU Cyber Resilience Act (CRA) establishes mandatory cybersecurity requirements for most products with digital elements placed on the EU market. It raises the baseline for secure-by-design/default engineering and, critically, makes post-market security support and evidence production a compliance obligation.

Automotive engineering teams are being asked to deliver faster, with less tolerance for failure. Software-defined vehicle programmes, secure OTA rollouts, zonal and service-oriented architectures, and continuous feature delivery are now baseline expectations. In parallel, regulatory pressure is increasing — from WP.29 (R155/R156), ISO/SAE 21434, and the forthcoming EU Cyber Resilience Act — tightening requirements around software integrity, traceability, and lifecycle governance.

Everywhere you look, your wrist, your home, your car, smart devices quietly gather data. The Internet of Things (IoT) has evolved from a novelty into the backbone of daily life. From smart thermostats that learn your schedule to industrial sensors tracking performance in real time, connected devices are reshaping how we live, work, and interact. But with that progress comes peril. Each device represents a potential breach point; every upload, update, or firmware oversight can expose personal information.

As IoT and operational technology environments expand, organisations are discovering that a large portion of their device estate simply cannot be secured using traditional methods. Many devices cannot run agents, cannot be patched regularly, or cannot tolerate downtime. In 2025, this reality is no longer the exception—it is the norm.

The rapid expansion of connected devices has fundamentally changed how organisations operate. From smart sensors and industrial controllers to gateways, cameras, and embedded systems, IoT has become integral to modern business. Digital transformation is accelerating the adoption of IoT technologies, increasing the attack surface and making IoT security a critical component of modern cybersecurity strategies.

For more than three decades, cybersecurity innovation and investment have followed a familiar rhythm. Each major wave—network security, endpoint security, identity, cloud, and data—spawned new platform winners and reshaped the M&A landscape. Today, we stand at the threshold of the next foundational shift. The digital and physical worlds have converged to such an extent that machines—not humans—are the primary operators of enterprise networks.

By 2026, the idea of a fixed security perimeter is no longer realistic. Organisations now operate across cloud platforms, industrial environments, remote sites, and edge locations, often supported by tens or hundreds of thousands of connected devices. These devices are not users in the traditional sense, yet they authenticate, communicate, update, and make decisions autonomously.