CRA and legacy products: are your vulnerability processes ready?

TL;DR: The EU Cyber Resilience Act shifts product security from new development to retroactive support obligations, forcing manufacturers to track SBOMs, reachability, disclosure and reporting across older shipped products as well as current releases, according to Finite State. The real challenge is not finding more vulnerabilities, but making defensible decisions fast enough to satisfy regulators and customers.

Editorial analysis by NHI Mgmt Group, based on content published by Finite State: “CRA Flips the Timeline: Why Retroactive Vulnerability Management Is the Real Challenge”.

Key questions

Q: What breaks when CRA obligations reach legacy products with no current SBOM?

A: The failure mode is evidentiary, not just operational.

Q: Why does the EU Cyber Resilience Act make vulnerability management a regulatory issue?

A: Because the manufacturer, not the end user, is now responsible for knowing what is inside supported products and for explaining how known vulnerabilities are handled.

Q: How do security teams know which application vulnerabilities matter most?

A: Prioritise flaws that are externally reachable, have known exploit patterns, or expose sensitive identity material such as credentials, sessions, or privileged APIs.

Practitioner guidance

• Define a legacy product inventory Create a complete inventory of every supported product, release and firmware build that could fall under CRA obligations, including long-tail products and embedded versions.
• Reconstruct shipped binaries before triage Use binary analysis to rebuild component inventories where source code and historic SBOMs are missing, so older releases can be assessed with evidence.
• Add reachability to remediation decisions Classify vulnerabilities by whether the affected code path is actually reachable in the shipped product, not just by CVSS or EPSS.

Bottom line: CRA shifts product vulnerability management from a release-time task to a full support-lifecycle obligation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →