The EU Cyber Resilience Act (Regulation (EU) 2024/2847) sets mandatory cybersecurity requirements for products with digital elements placed on the EU market, covering hardware, software, and connected devices. Reporting obligations apply from 11 September 2026 and the full regulation from 11 December 2027, with non-compliance fines reaching the higher of EUR 15 million or 2.5% of global turnover. Manufacturers must demonstrate secure-by-default configuration, a documented vulnerability handling process, and software bill of materials (SBOM) transparency, with conformity assessment scaled to product risk class.
Supporting CRA compliance is a mix of disciplines: gap analysis against Annex I, secure engineering or re-engineering of the product and its update mechanism, SBOM and vulnerability-handling process design, security testing of the product and its back-end services, and, for higher-risk classes, conformity assessment and certification. These are not all the same job. The firms listed here cover the security testing that evidences the CRA's essential requirements, rather than full compliance engineering, so they suit teams that already have a compliance lead and need the testing done.
Related: Cyber Resilience Act overview · Automotive pen testing companies
UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.
Cybersecurity division of the Thales Group, with ANSSI, CREST, FedRAMP 3PAO, and NATO-cleared personnel. Defence, government, and critical infrastructure penetration testing worldwide.
Frankfurt-based European payment security specialist holding the full set of PCI credentials (QSA, PFI, ASV, P2PE). Manual-first penetration testing for fintechs, acquirers, and regulated enterprises.
Vienna-headquartered Austrian cybersecurity consultancy with a prolific Vulnerability Lab research program and deep expertise in IoT and embedded systems security across the DACH region.
Berlin-headquartered German cybersecurity consultancy with 30+ years of BSI IT-Grundschutz experience. Trusted by federal agencies, DAX corporations, and critical infrastructure operators.
Munich- and Budapest-based embedded cybersecurity experts focused on financial services, automotive and mobility, manufacturing and industrial automation, energy and more. The services and platform go beyond compliance, supporting the requirements of the Cyber Resilience Act, PCI PTS, UN R155, ISO/SAE 21434 and other standards and regulations.
The CRA (Regulation (EU) 2024/2847) is the first EU-wide regulation setting mandatory cybersecurity requirements for products with digital elements. It applies to manufacturers, importers, and distributors placing hardware or software on the EU market, requiring secure-by-default design, a vulnerability handling process across the product lifecycle, SBOM transparency, and conformity assessment proportionate to the product's risk classification.
The CRA entered into force on 11 December 2024. Vulnerability and incident reporting obligations apply from 11 September 2026, and the full set of requirements applies from 11 December 2027. Manufacturers are using the window before those dates to run gap assessments, re-engineer products, and build the documentation needed to demonstrate conformity.
Support ranges from CRA readiness and gap analysis against Annex I, through secure-by-default engineering, SBOM generation, and vulnerability-handling process design, to security testing of the product, its update mechanism, and its back-end services. For 'important' and 'critical' product classes that need third-party assessment, some firms also coordinate conformity assessment and certification, often with legal partners.
The CRA does not name penetration testing explicitly, but security testing is the practical way to demonstrate that a product meets the essential requirements in Annex I, particularly risk management and the absence of known exploitable vulnerabilities. Manufacturers typically test the product itself, its update mechanism, and associated back-end services, and document the results as part of the technical file.