Speaker: Dr. Markus Hornsteiner

From December 2027, the Cyber Resilience Act makes product security mandatory for every product with digital elements. For machine and plant builders that means whoever ships a machine stays responsible for it across its entire expected lifetime, has to know which software is inside it, and must be able to respond to new vulnerabilities. That sounds like a job for IT. In practice it fails exactly where IT ends and the machine begins.

This talk shows why the established tools from software development do not work in plant engineering. A container scanner reads images and package manifests. A controller does not expose a file system; it gives you an engineering project file. Threat-modelling tools understand web servers and trust boundaries ...