On 11 September, the first major reporting requirements of the EU Cyber Resilience Act are coming into force, meaning that manufacturers selling connected products in the EU will have to start reporting actively exploited vulnerabilities and serious incidents within 24 hours. But as Camellia Chan, CEO and Co-founder of X-PHY, points out, the new 24-hour timeline doesn’t guarantee resilience. The bigger challenge, she says, is spotting an attack quickly enough to act. “Reporting an incident quickly is crucial, but the clock doesn’t stop there. The sooner teams understand where an attack is happening, the sooner they can contain it and limit the impact on operations and user data. That means having security across the full technology stack, including at the hardware level.”