Shifting left for a secure product lifecycle

Why security must start at design

Cybersecurity threats are no longer an afterthought, they are a defining factor in the success, safety, and longevity of connected products. Regulations such as the EU Cyber Resilience Act (CRA), the Radio Equipment Directive (RED), and the FDA cybersecurity guidance for medical devices emphasize one crucial point: security must be built in from the start.

This is the foundation of secure-by-design. Rather than bolting on security as products near release, shifting left means integrating secure development practices at the earliest stages of product design. From secure coding practices to architectural decisions that consider long-term resilience, this approach ensures products can withstand threats throughout their lifecycle.

Secure-by-design in practice

Standards like IEC 81001-5-1 for MedTech, EN 18031 for RED, and IEC 62443-4 for Industrial Automation compliance formalize these expectations. They require developers to not only adopt secure design but also demonstrate it through rigorous practices, including:

• Static code analysis (for example, IAR C-STAT): Ensuring compliance with secure coding rules to reduce vulnerabilities at the source.
• Threat modeling and risk assessment: Identifying attack vectors early in the development process.
• Software bill of materials (SBOM): Delivering transparency into all components, a requirement in CRA and RED.
• Vulnerability-free releases: Products must not ship with publicly known exploitable vulnerabilities.

By embedding these practices into development workflows, organizations ensure compliance and strengthen the trustworthiness of their products.

Extending security across the product lifecycle

Security, however, does not stop at launch. Regulations explicitly require ongoing vulnerability handling, incident reporting, and long-term support, including providing updates for at least 5 years and documentation for up to 10 years.

This is where secure provisioning comes into play. Provisioning securely during manufacturing ensures device identities, cryptographic keys, and certificates are protected from day one. Beyond manufacturing, lifecycle security includes:

• Software security updates updates: Securely delivering critical patches and upgrades in the field.
• Identification and authentication: From manufacturing onward, provisioned keys and certificates safeguard product identity, securing communication, storage, and updates, while simplifying cloud onboarding and lifecycle security.
• Vulnerability disclosure & incident response: Meeting regulatory requirements with clear processes for handling and reporting.

Together, secure-by-design and secure provisioning form the backbone of an end-to-end security strategy that protects connected devices from initial design through deployment and all the way to decommissioning.

Regulatory drivers raising the bar

Global regulations now mandate this lifecycle view:

• EU CRA: Covers all connected devices, demanding secure-by-default design, ongoing updates, SBOMs, and incident handling.
• EU RED update: Focused on wireless products, requiring conformity with EN 18031 security standards.
• FDA Medical Device Cybersecurity Guidance: Enforces secure design, post-market monitoring, and patchability.
• IEC 81001-5-1: A standard dedicated to MedTech software lifecycle security, aligned with international expectations.
• IEC 62443: A standard dedicated to Security for Industrial Automation and Control Systems (IACS), which has now become a backbone security standard.

These frameworks make it clear: organizations that fail to adopt Secure-by-Design and Secure Provisioning risk regulatory penalties, reputational damage, and potential product recalls.

Framing security solutions for customers

For engineering teams and decision-makers, secure-by-design and the secure product lifecycle offer an approachable way to understand and act on security. Instead of abstract compliance checklists, they represent a clear, customer-friendly framework:

• Design phase: Build it securely and protect the software package for production.
• Transport phase: Transport it securely from development to production.
• Production phase: Provision it securely.
• Operational phase: Maintain and update securely.

This framing allows companies to communicate value more clearly to their customers and partners while meeting stringent global requirements.

Summary

Shifting left for security is no longer optional, it is a regulatory expectation and a competitive advantage. By adopting secure-by-design principles and extending them with secure provisioning across the entire lifecycle, organizations can not only comply with CRA, RED, FDA, and IEC standards but also build products that earn long-term trust.

Security is not a feature. It is a foundation. And it must endure from the first line of code to the last day a product is in the field.

At IAR, we see the secure product lifecycle as a practical framework that helps embedded teams move from concept to compliance with confidence. With the IAR platform as an enabler, combining secure development tools, provisioning capabilities, and lifecycle security practices, organizations can lift embedded security to the level regulators, customers, and the market now demand.

Explore how IAR enables a secure product lifecycle at https://www.iar.com/embedded-development-tools/embedded-security .