Topic starter
11/07/2026 8:45 pm
TL;DR: Global supply of connected devices is projected to rise from 7.740 billion today to 29 billion by 2030, while the EU Cyber Resilience Act would impose mandatory security requirements across the full product lifecycle, according to GlobalSign and the European Commission. The policy shift matters because device identity, certificate management, and vulnerability handling are becoming governance problems, not just engineering tasks.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Los dispositivos conectados al IoT serán más resistentes a la ciberdelincuencia”.
Key questions
Q: What breaks when connected devices lack lifecycle-enforced security?
A: Security breaks when trust is established at deployment but not maintained through updates, support, and retirement.
Q: When should organisations prioritise lifecycle governance over initial device hardening?
A: They should prioritise both, but lifecycle governance becomes decisive once devices leave the factory.
Q: What are the signs that connected device trust is failing?
A: Warning signs include unclear support windows, missing vulnerability documentation, inconsistent update availability, and devices that remain trusted after their security state has changed.
Practitioner guidance
- Map every device class to a lifecycle owner Assign clear accountability for planning, design, production, maintenance, and retirement so no connected device exists outside a managed trust chain.
- Use PKI for device-level trust Bind each device to a certificate-based identity that can support onboarding, authentication, rotation, and revocation across its supported life.
- Document vulnerability handling and support periods Record how active vulnerabilities, exploited incidents, and security updates are handled, and align that record with the product’s expected service life.
Bottom line: Connected device security is moving beyond initial hardening and into ongoing lifecycle governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:11 pm
Lifecycle enforcement is now the real security boundary for connected devices. The article shows that device security can no longer be judged at shipment or initial provisioning. Once support, updates, and vulnerability reporting become part of the requirement set, the control boundary moves to the whole product lifecycle. For security teams, that means governance has to track trust continuity from manufacturing through retirement.
A question worth separating out:
Q: How should teams govern connected device security under product regulations?
A: Teams should treat device security as a governed lifecycle with assigned ownership, documented vulnerabilities, and update obligations that continue after release. That approach aligns product engineering with compliance and gives security teams evidence they can actually audit.
👉 Read our full editorial: Connected device security is moving to lifecycle enforcement