From 11 September 2026, every software manufacturer selling into the EU has to report an actively exploited vulnerability within 24 hours of becoming aware of it. Not 24 business hours. Twenty-four hours.
In 2026, the Cyber Resilience Act (CRA) is no longer a future deadline, it is the operational reality for every organization in the European market. With mandatory security requirements for products with digital elements, compliance has shifted from a “nice-to-have” to a fundamental license to operate.
When it comes to software security, the debate between open-source and proprietary models isn’t about which one claims to be safer. It’s about transparency, maintenance and how quickly issues are resolved.