13–16 OctMeet us at 35.BI-MU, Milan Hall 24, stand A60C Book 15 minutes
Cyber Resilience Act · Machinery Regulation · NIS2

Turn CRA compliance into a process that runs every day

The CRA asks two things of every product. Shield Lifecycle covers both.

  • Before the sale: the evidence for the CE marking
  • After the sale: every new vulnerability checked, exploited ones reported, until the end of support
See the demoCheck 2027: 7 questions, 3 minutes
Three dates

Your machine runs software. EU law makes you responsible for its security.

  1. 11 Sep 2026 In force CRA reporting duty Report actively exploited vulnerabilities and severe incidents within 24 hours. It also covers products already on the market.
  2. 20 Jan 2027 105 days left Machinery Regulation applies Cybersecurity becomes an essential health and safety requirement for CE marking of machines.
  3. 11 Dec 2027 430 days left CRA applies in full Every new product with digital elements needs an SBOM, vulnerability handling and security updates.

Each date links to its regulation, with the official text. All three side by side.

Per delivered machine, not per model

Same model, same customer. One machine is exposed, the other is not.

A critical vulnerability hits a VPN gateway. One X-200 has it and drops to 68. The other was delivered with a different gateway and stays at 90.

CVE-2026-•••• · CVSS 9.1 New Affects VPN gateway GW-A · FW 2.4
  • PLC FW 2.9
  • HMI FW 17.0
  • GW-A FW 2.4
  • TLS 3.0.x
  • Linux 5.15-rt

GW-A 2.4 is inside and can be reached through remote maintenance.

X200-2024-001 Exposed · customer notice drafted
  • PLC FW 2.9
  • HMI FW 17.0
  • GW-B FW 5.1
  • TLS 3.0.x
  • Linux 5.15-rt

Delivered with GW-B. The CVE does not apply.

X200-2024-002 No active CVE
Same model, same line, different parts inside. Exposed means the vulnerable part is in this machine and can be reached through its network.

Vulnerable is not the same as exposed.

Start from your problem

Which one are you?

I build machines

Your machines run software you did not write

When a component has a vulnerability, you must know which delivered machines are exposed and tell the customer.

Keep every machine CRA-ready I build software products

A 24-hour reporting duty, and no security team

The CRA asks for an SBOM, vulnerability handling and fast reporting, every day.

See what the CRA asks I run a plant

Segment the OT network without stopping production

Old machines, flat networks and auditors who ask for NIS2 and IEC 62443 evidence.

Segment on the switches you have

Photos generated with AI.

The product line

Find what is exposed. Protect it. Prove it.

Shield Lifecycle on a monitor: the technical file of one product and its EU declaration of conformity.
Cyber Resilience Act

Shield Lifecycle

Know every day which machines you shipped are exposed to a new vulnerability, and tell your customer in time.

Explore Shield Lifecycle
The Edge Shield models together.
Machinery Regulation · IEC 62443

Edge Shield

Reduce the attack surface of the machine. Micro-segment and inspect its traffic, without touching the network or the PLC program.

Explore Edge Shield
The Edge SDN console on a monitor.
NIS2 · IEC 62443

Edge SDN

See and segment the whole OT network from one console, without stopping production.

Explore Edge SDN

Talk to us

Tell us who you are and what you need. We answer fast, usually within one working day.

Talk to usSee the demo

Meet us at 35.BI-MU, fieramilano Rho, 13–16 October 2026

Background photo generated with AI.