Historically, for connected devices, the date that mattered was the ship date. Teams designed to a cost, hit a launch window, and treated security as something to add if the schedule allowed. Once a product left the factory, it became someone else's problem: the customer, the integrator, and the IT department. That model is ending, and the shift is showing up first not in the compliance department, but on the engineering roadmap. Four things that used to live in separate corners of a project have converged into a single, ongoing engineering obligation: device security, over-the-air (OTA) update delivery, lifecycle management, and regulatory compliance. None of them are new problems on their own. What's new is that they no longer end at launch, and they no longer sit neatly inside one team's job description. The scale of the problem is well documented. SonicWall's 2025 Cyber Threat Report found that IoT attacks rose 124% in 2024. Although attackers exploit new vulnerabilities within days, some organizations take 120 to 150 days to apply a critical patch. Most of those incidents don't start with a novel exploit; they start with a device nobody has touched since it shipped. In 2025, the FBI warned that criminals were exploiting end-of-life routers that no longer receive security updates and selling access to them as proxies. A month later, it flagged the BADBOX 2.0 botnet, which had infected millions of low-cost consumer devices, many compromised before they reached the buyer. That's the failure mode regulators are trying to design out of the market: not a single dramatic breach, but a slow accumulation of insecure, unmaintained devices sitting on networks indefinitely. Device security, OTA updates, lifecycle management, and compliance are now architectural decisions that must be made before the prototype is built. (Source: Getty Images) Why these four problems collapsed into one Device security used to mean a checklist: encrypt the storage, sign the firmware, and call it done. OTA updates were a nice-to-have that let a team push a bug fix without a truck roll. Lifecycle management was largely an IT operations concern. Compliance meant a one-time certification before a product hit the market. Regulation has rewritten those assumptions. The EU's Cyber Resilience Act (CRA), which entered into force in December 2024, requires connected products to be secure by design and by default, and places ongoing vulnerability-handling obligations on manufacturers throughout a product's support period. The CRA's reporting obligations for actively exploited vulnerabilities and severe security incidents took effect in September 2026, and they apply even to products already on the market. The bulk of the regulation's requirements take effect in December 2027. Under the EU's Radio Equipment Directive , cybersecurity requirements became mandatory in August 2025 for internet-connected wireless products, including cellular, Wi-Fi, and Bluetooth devices that reach the internet directly or through a gateway. Sector-specific rules add further layers: in the U.S., Section 524B of the Federal Food, Drug, and Cosmetic Act imposes comparable vulnerability-management and update obligations on connected medical devices. Together, they raise the bar, and the CRA goes furthest, turning what used to be a one-time gate into a standing commitment: manufacturers must find vulnerabilities in fielded devices, fix them, deliver the fix, and document the process for years after the product has shipped. The U.S. is moving in a related but distinct direction, favoring a voluntary labeling model, such as the FCC's emerging U.S. Cyber Trust Mark, over the EU's mandatory approach. The details differ, but the direction doesn't: buyers, regulators, and increasingly insurers are starting to expect evidence that a connected product will remain maintained years after it ships, not just that it was secure on day one. That single change cascades through the other three. A multi-yea