ONEKEY Cybersecurity Report 2026: Supply Chain Plays Key Role in CRA Compliance

ONEKEY: Manufacturers must ensure transparency across all software components and systematically involve suppliers in vulnerability management

Duesseldorf, Germany, November 5, 2026 – With the Cyber Resilience Act (CRA), the European Union is making the cybersecurity of connected hardware and software a prerequisite for market access. For manufacturers, this means they must not only ensure the security of their own developments, but also consider and assess cybersecurity risks that enter their products through supplied software, firmware, upstream products, and other components. “This makes the supply chain a decisive factor for CRA compliance, both when third-party programs are used in a company’s own software and when purchased components with embedded software are integrated,” according to the latest “IoT & OT Cybersecurity Report 2026.” The report by Duesseldorf-based cybersecurity specialist ONEKEY is based on a survey of 200 industrial companies in Germany on the preparation, implementation, and impact of the EU regulation to strengthen the protection of connected devices, machines, and systems against hacker attacks.

Modern digital products consist only partly of in-house developed software. Operating systems, open-source libraries, communication modules, software development kits, containers, cloud components, and firmware from suppliers often make up a large part of the finished product. This creates multi-tier dependencies: a directly integrated software library may in turn contain further components that the manufacturer may not even be aware of. As a result, a single vulnerability can affect numerous products and product versions across multiple supply tiers.

“The Cyber Resilience Act puts an end to the notion that responsibility for insecure software components can simply be passed on to the supplier,” explains Jan Wendenburg, CEO of ONEKEY. “Anyone who brings a product to the European market under their own name must control the cybersecurity risks of the entire product. To do so, the manufacturer needs reliable information about which components are actually included, where they come from, and which product versions are affected when a new vulnerability is discovered.”

Manufacturers Are Responsible for the End Product

The CRA requires manufacturers to exercise due diligence when integrating third-party components. They must ensure that the components used do not compromise the security of the finished product.

As ONEKEY’s “IoT & OT Cybersecurity Report 2026” shows, 25.8 percent of German industrial companies already actively and consistently require CRA compliance from their suppliers. Another 33.3 percent say they are pursuing this approach “partially,” meaning they still have gaps in their supply chain with regard to the Cyber Resilience Act. Among the companies surveyed, 20.8 percent have not yet taken any action in this direction. “In no case do supplier certifications or contractual assurances replace the manufacturer’s own risk assessment,” Jan Wendenburg makes clear.

The same applies to freely available open-source components. Manufacturers need to know which version they are using, whether known vulnerabilities exist, and how newly published security flaws affect their own product. This becomes particularly problematic with older libraries or components that are no longer maintained and for which there is no longer a reliable contact person or any updates.

Manufacturers should therefore check, as early as the supplier selection stage, which security and development processes the supplier has in place, whether software components and dependencies are documented in a traceable manner, how quickly the supplier provides information about new vulnerabilities, who provides security updates and for how long, how security-relevant changes are communicated, and whether components can be clearly assigned to specific product and firmware versions. In addition, obligations to cooperate, provide information, and deliver updates should be set out in contracts.

According to the “IoT & OT Cybersecurity Report 2026,” the supplier side presents a very mixed picture with regard to the new EU cybersecurity regulation. Not even one-fifth of suppliers (17.5 percent) have consistently prepared for it and deliver the necessary information. Another 44.2 percent take the CRA requirements into account at least partially. A further 13.3 percent of suppliers are barely prepared, and for 25.0 percent, manufacturers do not know where their CRA preparations stand.

“With suppliers from Asia in particular, European manufacturers often find that the Cyber Resilience Act is hardly known or is regarded as a purely European matter. That is a misconception: all suppliers that sell products or components in Europe must meet the CRA requirements themselves. If products or components from abroad are built into another product and also sold in Europe, the manufacturer must also demonstrate CRA conformity for the new end product. Missing SBOMs, unclear software versions, or unregulated security updates can thus directly become a compliance and market access risk,” warns ONEKEY CEO Jan Wendenburg.

SBOM Becomes the Inventory of the Software Supply Chain

A central instrument for the transparency required by the CRA is the Software Bill of Materials, or SBOM for short. It records the software components contained in a product and their relationships.

In practice, however, it is not enough to generate a component list once and file it away. An SBOM must match the software version actually shipped, be assigned to a specific product version, and be updated whenever relevant changes occur. Otherwise, the result is merely a snapshot that is of little use for subsequent vulnerability analysis.

Additional difficulties arise when suppliers provide SBOMs in different formats, with inconsistent naming, or without clear version information. Some lists only cover directly used components and ignore deeper dependencies. Others contain parts that were used during development but are no longer present in the shipped product. Manufacturers must therefore consolidate and verify the information supplied and compare it with the actual binary or firmware version.

New Vulnerabilities Continuously Change the Risk Landscape

A component assessed as secure at market launch may be affected by a newly discovered vulnerability months or years later. Supply chain transparency must therefore be combined with continuous vulnerability management. Manufacturers need processes that automatically match new security advisories against the affected components, product versions, and installed device fleets.

However, not every vulnerability that is theoretically mapped to a product is actually exploitable in that specific product. Key factors include the configuration, the context of use, and whether the affected function is included or reachable at all. Supplementary VEX information—Vulnerability Exploitability eXchange—can document whether and why a known vulnerability affects a particular product. This makes it possible to prioritize alerts and remediation measures.

“An SBOM creates visibility, but compliance only comes about when companies translate this information into operational processes,” explains Jan Wendenburg. “They must assess new vulnerabilities, identify affected products, document decisions in a traceable manner, and provide security updates in good time when needed. It is precisely this link between software inventory, risk assessment, and response that is the real challenge in complex supply chains.”

Contract Management Alone Is Not Enough

The CRA is also likely to change business relationships between manufacturers and suppliers. In the future, manufacturers will need not only technical specifications, prices, and delivery dates, but also reliable security information. Corresponding requirements should already be taken into account in procurement, supplier selection, and contract design.

Useful provisions include, for example, agreements on machine-readable SBOMs, reporting channels for vulnerabilities, response times, security updates, support periods, and the passing on of relevant information from upstream supply tiers. Equally important is a defined procedure in case a component is no longer maintained or the supplier ceases operations.

Automated Analysis Instead of Manual Spreadsheets

For extensive product portfolios and regularly updated firmware, manually maintained spreadsheets quickly reach their limits. ONEKEY helps manufacturers identify software components in binary and firmware files, import and validate existing SBOMs, and consolidate information from different sources. The ONEKEY Product Cybersecurity & Compliance Platform supports standardized formats such as CycloneDX and SPDX and allows enrichment with VEX and VDR information.

In addition, ONEKEY continuously monitors product versions for known and previously unknown vulnerabilities. Automated impact assessments help distinguish theoretical matches from actually relevant risks and prioritize measures. This allows product development, Product Security Incident Response Teams, compliance officers, and product management to work from a shared data set.

Time Pressure Is Mounting

The CRA reporting obligations for actively exploited vulnerabilities and severe security incidents have been in effect since September 11, 2026. As of December 11, 2027, the main product and manufacturer obligations will apply in full. New products with digital elements must then generally be CRA-compliant when they are first made available on the EU market.

However, building robust supply chain transparency cannot be accomplished in the short term. Missing information must be obtained from suppliers, product versions recorded, SBOMs validated, and responsibilities assigned. In addition, technical and organizational processes are needed for vulnerability assessment, updates, documentation, and reporting.

“Companies should not wait until the final conformity assessment,” warns Jan Wendenburg. “Those who only discover shortly before market entry that key components cannot be identified or that the supplier cannot provide sufficient security information risk delays, costly rework, and, in the worst case, loss of market access. CRA compliance in the supply chain must therefore begin with purchasing.”