Rune Hillebo Wiinberg & Johan Callmyr

Cybersecurity is becoming part of the product – are you ready?

For a long time, cybersecurity could be treated as something separate from product development. Build the product, make sure it works and then add the necessary protection. For connected products, that approach is becoming increasingly difficult. Products are communicating with other devices, cloud services and business systems. Software continues to evolve after a product has entered the market. At the same time, new vulnerabilities are constantly being discovered and cybersecurity requirements are becoming more demanding.

From a security feature to a way of working

The result is a fundamental shift: cybersecurity is becoming part of the product itself. And that means it needs to be considered from the first design decisions to the final day of the product's lifecycle.

What makes a product cybersecure?

The obvious answer might be technical features such as Secure Boot, encrypted storage, secure communication or access control. They are all important, depending on the product and its risks.

But cybersecurity is bigger than the sum of individual security features. Consider software updates. A product may support remote updates, but who decides when an update is needed? How is it tested? How do you know that the software being installed can be trusted? And how do you monitor new vulnerabilities after thousands of products have been deployed?

Suddenly, the question is not only about technology. It is about development processes, responsibilities, documentation, maintenance and collaboration across the organization.

Security starts with understanding the risks

There is no universal security architecture that works for every connected product.

A medical device handling sensitive patient data has different risks from an industrial controller. A connected consumer product faces different challenges from equipment operating in an isolated industrial environment. This is why a risk-based approach is so important.

A cybersecurity risk assessment can help map the product, identify potential attack surfaces and understand the consequences if something goes wrong. From there, teams can define the appropriate level of protection and prioritize the measures that create the most value.

It is a more practical approach than simply adding as many security features as possible. Because good cybersecurity is not about building the biggest wall. It is about understanding what you need to protect – and why.

Build security into the architecture

This is where security by design enters the picture. Instead of asking how to secure the product once it has been developed, security becomes one of the inputs to the architecture itself.

For an embedded product, this can involve establishing a Root of Trust and Secure Boot process, protecting keys and certificates, limiting access to critical functionality and ensuring that software can be securely updated.

It can also mean removing functionality. Every unnecessary interface, service or software component can potentially increase the attack surface. Sometimes the smartest security feature is simply not having a feature you do not need.

The product launch is only the beginning

One of the biggest changes in thinking comes after development.

A connected product may remain in operation for years. During that time, new vulnerabilities can emerge in operating systems, libraries, frameworks and other software components. The manufacturer therefore needs to know what is inside the product and have a way to react when something changes.

CVE monitoring – tracking known Common Vulnerabilities and Exposures – can help identify relevant security issues. But an alert alone does not solve anything. Teams also need processes to assess the vulnerability, understand the product risk, develop a mitigation and test an update.

This makes cybersecurity an ongoing lifecycle responsibility rather than a one-time development activity.

A challenge – and an opportunity

New cybersecurity requirements are undoubtedly creating more work for product companies. Existing architectures may need to change. Development processes may need to become more structured. Responsibilities that were once informal may need to be clearly defined and documented.

But there is another side to this development. Companies that understand their products, software and vulnerabilities gain better control over their product lifecycle. Secure update mechanisms can make products easier to maintain. Structured development processes can improve quality and traceability.

And as customers become more aware of cybersecurity, being able to demonstrate that security has been considered throughout the product lifecycle can become an important part of building trust.

Cybersecurity is moving from the edge of product development to its core. The interesting question is no longer whether connected products need cybersecurity. It is how we build products that can stay secure in a world that keeps changing.

explore

Cybersecurity Insights

See all our cases and insights

About the Authors

Rune Hillebo Wiinberg is Head of Cybersecurity at Prevas and has worked professionally with embedded and secure, connected products since 2007. With experience across energy, medical technology and defense, he advises customers at all levels of the organization, helping bridge business priorities, regulatory requirements and technical product development.

Johan Callmyr is a Software Architect with more than 20 years of experience in C++ and embedded device software. He combines technical expertise with his experience in software architecture, technical leadership, cybersecurity, and development in regulated environments like medtech. As a Software Architect and Software Lead, he helps customers build robust, secure, and safe software solutions for complex products.