What is the Cyber Resilience Act?
The Cyber Resilience Act (CRA) is a European Union regulation (EU 2024/2847) that came into force in 2024. It establishes mandatory cybersecurity requirements for all products that contain software and are sold in the EU, from consumer devices to industrial machinery.
In simple terms: if a product connects to a network, processes data, or contains software, its manufacturer is now legally responsible for its cybersecurity. Not just at the time of sale, but throughout the product's entire lifetime.
The CRA covers three main areas:
Security by design
Products must be built with security from the start, not added later.
Transparency
Manufacturers must be open about the components in their products and any known vulnerabilities.
Vulnerability handling
Manufacturers must have a clear, documented process to find, fix, and communicate security issues.
The CRA applies to Bystronic products sold in the European Union. Full compliance is required from December 2027.
What Bystronic Is Doing
Bystronic manufactures laser cutting systems, bending machines, and the BySoft software suite used to operate them. All of these are products with digital elements under the CRA.
We are committed to building and maintaining secure products. Concretely, this means:
During development, every Bystronic software product is scanned for known vulnerabilities in its components before it is released. No release goes out with unresolved security issues above a defined severity threshold. Our development teams follow documented secure coding standards and use dedicated security tooling throughout the development lifecycle.
After release, we monitor for newly discovered vulnerabilities in the components our products use. When a vulnerability is found (by our teams, by external researchers, or by customers) we act on it, communicate it, and provide fixes.
For our customers, we maintain a clear channel to report potential security issues and a defined process to respond to them. This page is part of that commitment.
We publish security advisories for confirmed vulnerabilities affecting our products.
Which Products Are Covered?
This policy applies to all Bystronic products with digital elements, including:
| Product | Scope |
|---|---|
| BySoft CAM suite (BySoft CAM, BySoft CAM Bend Robot and all their related components and systems) | All versions under active support |
| On-premise management software (BySoft Shop Floor, BySoft Workcenter Terminal) | All versions under active support |
| SaaS platforms (BySoft Business, BySoft Insight) | All active versions |
| Laser cutting machines (BySoft Cell Control Cut + PLC + automation) | All models under active support |
| Bending machines (BySoft Cell Control Bend or Bend Robot + PLC) | All models under active support |
| Tube machines (BySoft Cell Control Tube + PLC) | All models under active support |
| Storage systems (BySoft Cell Control Storage + PLC) | All models under active support |
| Bystronic cloud services and remote connectivity | All active services |
If you are unsure whether your Bystronic product or version is covered, contact your Bystronic representative or reach out at the address below.
How to Report a Vulnerability
If you believe you have found a security vulnerability in a Bystronic product or service, we want to hear from you.
Please include as much of the following as you can. The more detail you provide, the faster we can investigate:
- The product name and version affected
- A description of the potential vulnerability
- Steps to reproduce the issue, if possible
- What you think the impact could be
- Your contact details (so we can follow up with you)
You do not need to be a security professional to report. If something seems wrong or unexpected in the behaviour of a Bystronic product, particularly anything that could allow unauthorised access or data exposure, please report it. We would rather investigate a false alarm than miss a real issue.
What Happens After You Report
Once we receive your report, here is what you can expect:
Acknowledgement
We will confirm that we have received your report and let you know it is being investigated. If we need additional information, we will ask at this stage.
Investigation
Our security team will assess the report to determine whether the issue is valid and, if so, how severe it is. We evaluate severity using the industry-standard CVSS scoring system. This phase typically takes between a few days and a few weeks, depending on the complexity of the issue.
We will keep you updated on our progress.
Resolution
If a vulnerability is confirmed, we will develop and test a fix. We will solve it as soon as possible based on the severity of the reported incident.
If a fix is not possible, we will put interim protective measures in place and communicate them to affected customers.
Notification to Authorities
If a vulnerability is confirmed as actively exploited, the CRA requires Bystronic to notify the European Union Agency for Cybersecurity (ENISA) and the relevant national cybersecurity authority within 24 hours. We fulfil this obligation as part of our regulatory compliance.
Security Advisory and Fix Release
When a fix is ready, we will:
- Release the security update through the standard Bystronic update channels
- Publish a security advisory describing the vulnerability, the affected versions, and how to apply the fix
- Notify customers who may be affected directly where we have the contact information to do so
Coordinated Disclosure
We follow a coordinated disclosure approach: we ask that reporters give us reasonable time to investigate and fix the issue before publishing details publicly. In return, we commit to acting promptly and keeping reporters informed throughout the process.
If you discover that a vulnerability is being actively exploited before we have been able to release a fix, please let us know immediately so we can escalate our response.
Your Protections as a Reporter
Bystronic is committed to working collaboratively with security researchers and customers who report vulnerabilities in good faith.
If you report a potential security issue to us honestly and responsibly, meaning you do not exploit the vulnerability beyond what is necessary to demonstrate it and you do not disclose it publicly before giving us a reasonable opportunity to respond, we will not take legal action against you.
We appreciate the contribution of everyone who helps make our products safer.