Product threat intelligence is threat intelligence about a manufacturer's products, not its corporate network. Rather than tracking the actors targeting an enterprise's IT, it continuously researches the vulnerabilities, exploit techniques, and real-world attacks aimed at a specific class of connected product: vehicles and their ECUs, EV charging infrastructure, IoT and embedded devices, and payment hardware. That intelligence feeds secure product development, a manufacturer's product security incident response (PSIRT) and vulnerability handling, and the ongoing monitoring that regulations now demand.
The discipline sits where hardware and embedded security research meets threat intelligence. It underpins the cybersecurity monitoring required by UN R155 and ISO/SAE 21434 for vehicles, the vulnerability-handling obligations of the EU Cyber Resilience Act for products with digital elements, and the device research behind PCI PTS payment hardware. It is distinct from the enterprise, actor-centric threat intelligence offered by the large incident-response and managed-detection firms. Our Featured partner PCA Cyber Security leads the list on hands-on product and device research, including original vulnerability discovery disclosed to manufacturers.
Related: Threat intelligence for financial services · Automotive pen testing companies · PCI PTS compliance testing companies
Enterprise threat intelligence answers the question 'which attackers are likely to target our organisation, and how?'. It is actor-centric, tracks campaigns and indicators of compromise, and feeds a security operations centre. Product threat intelligence answers a different question: 'what are the vulnerabilities and attack techniques that threaten the products we build and ship, and how do we stay ahead of them across the product lifecycle?'.
It is a hands-on research discipline. Providers reverse-engineer and attack representative devices, monitor new research and disclosed vulnerabilities affecting the relevant components and protocols, track the techniques used against a product class in the wild, and translate all of it into concrete input for engineering: threat models and TARA, secure-design changes, detection content, and coordinated disclosure. For connected vehicles this means ECUs, in-vehicle networks, telematics and OTA back ends, and EV charging and OCPP. For other product classes it extends to IoT and embedded devices and to payment hardware.
The work is now a regulatory expectation, not just good practice. UN R155 requires a Cyber Security Management System that monitors, detects, and responds to cyber threats and vulnerabilities across the vehicle lifecycle. ISO/SAE 21434 requires continuous cybersecurity activities including monitoring and threat analysis and risk assessment. The EU Cyber Resilience Act requires a vulnerability-handling process for the supported lifetime of a product. Product threat intelligence is how manufacturers meet those monitoring and vulnerability-handling duties with real, current information about how their products are actually attacked.
The specialist listed here, PCA Cyber Security, is an embedded security firm with its own hardware labs and a published record of original vehicle and component vulnerability research, including participation in Pwn2Own Automotive and disclosures to OEMs and Tier 1 suppliers.
Munich- and Budapest-based embedded cybersecurity experts focused on financial services, automotive and mobility, manufacturing and industrial automation, energy and more. The services and platform go beyond compliance, supporting the requirements of the Cyber Resilience Act, PCI PTS, UN R155, ISO/SAE 21434 and other standards and regulations.
PCA Cervus is a device-centric vuln monitoring, and threat intelligence platform that supports SBOM analysis & SBOM validation
Product threat intelligence is threat intelligence focused on a manufacturer's products and connected devices rather than its corporate IT. It continuously researches the vulnerabilities, exploit techniques, and real-world attacks targeting a specific product class, such as vehicles, ECUs, EV charging, IoT, or payment hardware, and feeds that into secure development, vulnerability handling, and regulatory monitoring.
Enterprise threat intelligence is actor-centric: it tracks the attackers and campaigns likely to target an organisation's IT and feeds a security operations centre. Product threat intelligence is product-centric: it tracks the vulnerabilities and attack techniques that threaten the devices a company builds and ships, and feeds engineering, PSIRT, and secure-design decisions across the product lifecycle.
For vehicles, UN R155 requires a Cyber Security Management System that monitors and responds to threats and vulnerabilities across the lifecycle, and ISO/SAE 21434 requires continuous cybersecurity monitoring and threat analysis. For products with digital elements sold in the EU, the Cyber Resilience Act requires a vulnerability-handling process for the product's supported lifetime. Product threat intelligence is how manufacturers meet these duties.
Manufacturers of connected and embedded products: automotive OEMs and Tier 1 suppliers, EV charging and OCPP operators, IoT and embedded device makers, and payment hardware manufacturers. It supports secure development, type-approval and conformity evidence, and the ongoing vulnerability handling those products require after launch.