Secure by design for manufacturers of connected products. Cyber Resilience Act preparation, grounded in offensive security and in automotive product life cycles.https://folhas.ioenhttps://folhas.io/en/articles/08-coordinated-disclosurehttps://folhas.io/en/articles/08-coordinated-disclosureThe reporting obligations towards the authorities are now applicable, but they are half of the circuit. Annex I, Part II demands the other half: a public channel for receiving vulnerability reports, with a policy, a point of contact and a process behind it. It costs little to set up, and there is a standard for almost everything.Fri, 11 Sep 2026 00:00:00 GMThttps://folhas.io/en/logbook/004-the-day-the-countdown-reached-zerohttps://folhas.io/en/logbook/004-the-day-the-countdown-reached-zeroThe reporting obligations of Article 14 became applicable today. What changes for those who already have products on the market, what we did with the advance notice, and why the OTA entry waits one more round.Fri, 11 Sep 2026 00:00:00 GMThttps://folhas.io/en/articles/07-cra-for-software-makershttps://folhas.io/en/articles/07-cra-for-software-makersThe most common misconception about the CRA is that it addresses device manufacturers. Software sold as a product is in. Pure SaaS is out, with one exception that catches a lot of people. And 'free of charge' does not mean 'non-commercial'.Wed, 05 Aug 2026 00:00:00 GMThttps://folhas.io/en/logbook/003-from-prototype-to-producthttps://folhas.io/en/logbook/003-from-prototype-to-productThe audit from entry 002 turned into a work plan. Four phases, what goes into each one, and where the money gets spent. A good part of it is not code.Wed, 05 Aug 2026 00:00:00 GMThttps://folhas.io/en/articles/06-what-automotive-already-learnthttps://folhas.io/en/articles/06-what-automotive-already-learntThe automotive sector was the first forced to treat cybersecurity as a product property across the life cycle, with UNECE R155/R156 and ISO/SAE 21434. Vehicles are outside the CRA precisely because of this, and it is also why they serve as a preview.Wed, 29 Jul 2026 00:00:00 GMThttps://folhas.io/en/logbook/002-the-prototype-meets-the-regulationhttps://folhas.io/en/logbook/002-the-prototype-meets-the-regulationWe applied to Aerodry, our prototype with two years of real operation, the same CRA analysis we offer clients. We describe the nine flaws with direct consequence. This is the report.Wed, 29 Jul 2026 00:00:00 GMThttps://folhas.io/en/articles/05-cra-and-redhttps://folhas.io/en/articles/05-cra-and-redSince August 2025, any radio equipment connected to the internet has had to meet the RED's cybersecurity requirements. The CRA will replace them, but until December 2027 the two regimes coexist, and work done under one does not automatically count under the other.Wed, 22 Jul 2026 00:00:00 GMThttps://folhas.io/en/articles/04-the-support-periodhttps://folhas.io/en/articles/04-the-support-periodThe CRA obliges every manufacturer to declare for how long it supports the product: as a rule, at least five years. It is an engineering, contracts and supplier decision disguised as a field on a form.Wed, 15 Jul 2026 00:00:00 GMThttps://folhas.io/en/logbook/001-starting-pointhttps://folhas.io/en/logbook/001-starting-pointFirst entry in the logbook of preparing our agri-IoT product for the CRA. Where we stand, what we have already decided, what we still don't know.Wed, 15 Jul 2026 00:00:00 GMThttps://folhas.io/en/articles/03-classifying-the-producthttps://folhas.io/en/articles/03-classifying-the-productDefault, important class I, important class II or critical. The product's category determines whether conformity is a self-assessment or a notified body, and the difference is measured in tens of thousands of euros and months of calendar.Wed, 08 Jul 2026 00:00:00 GMThttps://folhas.io/en/articles/02-the-24h-and-72h-reportshttps://folhas.io/en/articles/02-the-24h-and-72h-reportsFrom 11 September 2026, a manufacturer who learns of an actively exploited vulnerability in its product has 24 hours for the first alert. What gets reported, to whom, through where, and what to prepare beforehand.Wed, 01 Jul 2026 00:00:00 GMThttps://folhas.io/en/articles/01-sbom-for-embedded-firmwarehttps://folhas.io/en/articles/01-sbom-for-embedded-firmwareThe software bill of materials the CRA demands is not written by hand. For firmware, the only credible SBOM comes out of the build system, and binary scanning serves for what we did not build ourselves.Wed, 24 Jun 2026 00:00:00 GMT