sbom

A laptop screen showing cybersecurity compliance documents and a software inventory for the EU Cyber Resilience Act
Cybersecurity

When Software Grows a Legal Spine: Inside the EU’s Cyber Resilience Act

For years, building secure software in Europe meant following your own conscience — or your customer’s contract. You could ship a container image with no software inventory, patch vulnerabilities on whatever schedule suited you, and disclose flaws only if you felt like it. Good teams did better than that anyway, because it was good engineering. But nothing in EU law forced anyone to. The Cyber Resilience Act (CRA) changes that calculus: it takes practices security-conscious teams already knew were “best practice” and turns them into conditions for selling a product in Europe at all.

Diagram of software supply chain security controls across build, registry, and runtime
Software Development

Why Scanning Every Commit Is Not Enough: A Practical Guide to Software Supply Chain Security

Imagine a team that runs automated vulnerability scans on every pull request, enforces code review for every merge, and ships containers with confidence. Then one morning, their staging environment starts behaving strangely—not because of anything their developers wrote, but because a base image they pulled two weeks ago silently contained a compromised library. The scan passed. The code review passed. The trust assumption that broke everything was made before a single line of their own code was written.

Scroll to Top