Boxfish Labs helps software vendors, product teams, startups, scaleups, SMEs, and connected-product organisations turn Cyber Resilience Act expectations into practical secure-by-design development, vulnerability handling, product-security governance, and lifecycle resilience.
Customers increasingly expect the products they buy to be secure by design, responsibly maintained, and supported when vulnerabilities emerge. Regulators are reinforcing that expectation through the Cyber Resilience Act (CRA), which establishes cybersecurity requirements for many products with digital elements made available in the European market.
For product companies, cybersecurity cannot be treated as a final testing step or a policy owned only by one technical specialist. It needs to be connected to product strategy, architecture, secure development, supplier selection, vulnerability management, updates, customer communication, support, and leadership oversight.
Boxfish Labs helps teams build a proportionate product-security programme before compliance becomes an emergency. We assess your product and development reality, identify the CRA-related questions and risks most relevant to you, and turn them into a practical roadmap that supports product trust, customer requirements, and more resilient growth.
The Cyber Resilience Act introduces cybersecurity requirements for many products with digital elements placed on the EU market. Applicability, classification, duties, and timelines depend on the product and role in the value chain. The practical direction is clear: manufacturers and other relevant economic operators need to take responsibility for cybersecurity across a product’s lifecycle.
For many organisations, readiness involves building or strengthening:
The right model should fit your product, customers, architecture, development maturity, risk profile, and available resources. It should be rigorous enough to build trust, but practical enough that teams can operate it consistently.
We help you establish a practical product and role inventory, understand relevant product characteristics and market context, identify the questions that require deeper legal analysis, and focus your security work on the risks that matter most.
We help embed security into product discovery, architecture, requirements, design, development, testing, release, and change management -so issues are addressed earlier, with less cost and disruption.
We help create practical routines for receiving, triaging, assessing, prioritising, fixing, documenting, disclosing, communicating, and learning from vulnerabilities.
We help map products, modules, services, libraries, open-source components, vendors, cloud dependencies, development tools, and supply-chain risks so teams can make more informed security and lifecycle decisions.
We help define leadership accountability, product and engineering responsibilities, security decision rights, escalation paths, risk acceptance, reporting, and evidence ownership.
We help turn product-security practices into credible customer, procurement, audit, investor, and partner responses -supported by clear documentation, governance, and evidence.
We design practical awareness, engineering guidance, interactive learning, simulations, and role-aware reinforcement so developers, product managers, support teams, and leaders can recognise and act on product-security responsibilities.
Identify the products with digital elements you provide, the product versions and support model, intended uses, users, markets, suppliers, distribution channels, development arrangements, and your role in the value chain.
Review architecture, assets, data flows, development practices, components, dependencies, access, testing, release processes, vulnerability handling, updates, support, incident response, policies, ownership, and current evidence.
Identify material threats, security weaknesses, supply-chain exposure, customer commitments, product risks, and likely regulatory or market expectations. Turn the findings into a proportionate roadmap with accountable owners and realistic sequencing.
Strengthen secure-by-design requirements, development and review routines, component governance, vulnerability management, disclosure, updates, supplier assurance, documentation, incident processes, and relevant awareness activities.
Product security continues after release. Review vulnerabilities, threats, component changes, supplier updates, customer feedback, incidents, support obligations, documentation, and control effectiveness throughout the product lifecycle.
Security requirements and risk decisions are addressed early in product design and architecture. Default settings, access, data handling, dependencies, interfaces, and operational controls are designed to reduce avoidable exposure.
A repeatable approach to integrating security into planning, design, implementation, review, testing, release, deployment, change, and maintenance. The appropriate activities depend on your product and risk profile.
Visibility and governance for libraries, open-source software, SDKs, APIs, build pipelines, external development, cloud platforms, model providers, firmware, and other components that can introduce security or availability risk.
Clear processes for receiving reports, monitoring sources, assessing severity, prioritising remediation, coordinating fixes, communicating with customers, publishing advisories where needed, and learning from recurring weaknesses.
A practical model for security updates, patching, version support, end-of-support decisions, customer communication, change management, and evidence that the product can be maintained securely over time.
Defined roles and accountability across leadership, product, engineering, security, support, legal, privacy, and suppliers. This includes decision-making authority, risk acceptance, escalation, reporting, and review.
A maintainable evidence base covering product scope, security requirements, risk assessments, architecture, components, testing, vulnerabilities, updates, supplier arrangements, decisions, and lifecycle activities.
Preparation for product-security incidents: detection, escalation, technical response, containment, recovery, customer communication, regulatory considerations, lessons learned, and improvement.
Get a focused CRA readiness assessment, product-security gap analysis, framework interpretation, risk roadmap, policy guidance, evidence review, and support for customer or stakeholder requirements.
Useful when
you need to understand the product-security work ahead, respond to a customer question, assess a new product, or launch a defined readiness project.
Gain ongoing senior cybersecurity leadership for product-security strategy, risk oversight, governance, secure-development priorities, vulnerability-management maturity, executive reporting, and continuous improvement.
Useful when
product cybersecurity needs sustained leadership and accountability across engineering, product, operations, suppliers, and leadership.
Map product data flows, cloud and SaaS dependencies, supplier concentration, data locations, third-country exposure, access patterns, recovery needs, and regional alternatives that affect resilience and customer trust.
Useful when
your product relies on cloud infrastructure, external platforms, AI services, data-intensive workflows, or suppliers that create critical availability and sovereignty dependencies.
Build security capability across the people who design, build, launch, support, and operate products. Use role-aware learning for secure development, vulnerability reporting, secure product decisions, incident response, and customer communication.
Useful when
product and engineering teams need practical security habits that go beyond generic corporate awareness training.
Connect product-security work with personal-data processing, privacy-by-design, DPIAs, vendor and processor arrangements, transparency, retention, breach response, and the GDPR obligations relevant to your product.
Useful when
your product processes personal data or product-security decisions overlap with privacy, customer-data, and contractual responsibilities.
Applicability depends on the product, its functions, how it is made available, and the organisation’s role in the value chain. The CRA covers many products with digital elements, but the exact interpretation can be nuanced. We can help establish a practical product inventory and readiness view; for formal legal interpretation, work with qualified legal counsel.
No. The CRA concerns products with digital elements and can be relevant beyond connected hardware. Software products, applications, components, and connected systems may all need to consider applicability and lifecycle cybersecurity responsibilities.
Not always. Smaller organisations can establish proportionate product-security roles, practices, and external support before they need a full dedicated team. The important point is clear ownership, repeatable processes, and the ability to manage risk throughout the product lifecycle.
ISO 27001 helps establish organisational information-security management, governance, risk management, and continuous improvement. CRA readiness focuses on cybersecurity requirements for products with digital elements throughout their lifecycle. An ISO 27001 programme can provide useful foundations, but it does not automatically cover all product-specific CRA expectations.
Yes. We can help design practical vulnerability intake, triage, severity assessment, remediation, communication, disclosure, record-keeping, and improvement processes that fit your product, customers, team, and support model.
We provide practical cybersecurity, governance, risk, privacy, human-factors, and implementation support. For formal legal interpretation or legal representation, consult qualified legal counsel. We can collaborate with your counsel to translate applicable requirements into usable product, engineering, and operational practices.
Tell us what you are building, how it is delivered, which components and suppliers you rely on, or what a customer has asked. We will help you identify the product-security priorities and next steps that matter most.
