Germany bolsters Cybersecurity Workforce to prepare for EU Cyber Resilience Act

Germany is strengthening its cybersecurity preparedness as manufacturers across Europe accelerate efforts to comply with the European Union’s Cyber Resilience Act (CRA). The legislation introduces mandatory cybersecurity requirements for hardware and software products with digital elements, placing greater responsibility on manufacturers to integrate security into the entire product lifecycle; for instance, from initial design and development to production, deployment, maintenance and end-of-support.

According to a survey conducted by cybersecurity company ONEKEY, German manufacturers are significantly increasing the allocation of IT resources to cybersecurity. The findings indicate that a substantial proportion of IT personnel are expected to become involved in security-related activities, reflecting the growing importance of vulnerability management, secure product development and regulatory compliance.

The shift comes as connected devices, industrial systems and Internet of Things (IoT) products increasingly become targets for sophisticated cyberattacks. Modern manufacturing environments depend heavily on interconnected operational technology (OT), industrial control systems (ICS), embedded software, cloud platforms and machine-to-machine communication. While this connectivity improves automation and operational efficiency, it also expands the attack surface available to threat actors.

The CRA seeks to address these risks by introducing a security-by-design approach. Manufacturers must conduct cybersecurity risk assessments and incorporate appropriate security controls during product development rather than attempting to address vulnerabilities only after a product has reached the market. The regulation also requires manufacturers to establish processes for identifying, managing and remediating vulnerabilities throughout the product’s support period. 

For manufacturers, compliance could require major changes to existing software-development and product-engineering workflows. Security testing may need to become integrated into the software development lifecycle through practices such as secure coding, dependency analysis, penetration testing, vulnerability scanning, threat modelling and software composition analysis. Companies will also need greater visibility into third-party and open-source components because vulnerabilities in a single software dependency can potentially compromise an entire connected product.

The CRA introduces specific reporting requirements as well. From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents affecting products with digital elements. An early warning must generally be submitted within 24 hours of becoming aware of an actively exploited vulnerability or qualifying incident, followed by a more detailed notification within 72 hours. 

This regulatory framework is particularly significant for Germany because of the country’s large industrial and manufacturing base. Automotive systems, industrial machinery, smart devices, medical technology and other connected products increasingly combine physical components with complex software ecosystems. Consequently, cybersecurity is becoming an engineering requirement rather than solely an IT function.

The European Union is also responding to a broader threat landscape involving cyber-criminal groups, ransomware operators and sophisticated state-linked threat actors. By requiring manufacturers to build security into products and maintain vulnerability-handling processes throughout their lifecycle, the CRA aims to improve the overall resilience of Europe’s digital supply chain.

For German manufacturers, the transition is therefore likely to involve not only additional cybersecurity personnel, but also organizational changes, stronger security governance and closer collaboration between IT, engineering, product development and compliance teams. The objective is to ensure that connected products entering the European market are not only functional and innovative, but also resilient against an increasingly sophisticated cyber threat environment, including those powered by AI.