The conversation around cybersecurity is evolving. For years, organizations have acknowledged the importance of building secure products, yet in many cases security was still treated as a later-stage requirement, added during testing, after deployment, or in response to incidents.

That approach is no longer sufficient.

With increasing digital dependence across industry, government, and society, software and connected products are expected to be secure from the start and remain secure throughout their operational life. This is why the recent draft Secure by Design and Default Playbook released by ENISA, the European Union Agency for Cybersecurity, is both timely and highly relevant.

The draft playbook is now open for consultation and aims to provide practical guidance, particularly for SMEs, on how to integrate security into engineering, product management, and release processes in a realistic and repeatable way.
Its central message is clear: security must become operational, measurable, and continuous.

 

A Practical Shift from Principle to Execution

Secure by Design and Secure by Default are not new concepts. Many organizations already recognize the need for secure architectures, least privilege access, secure coding practices, patch management, and resilient product lifecycles.

What makes the ENISA initiative valuable is its practical orientation.

Rather than focusing only on policy aspirations, the playbook translates core principles into an actionable playbook, covering areas such as:

• Threat modelling and trust boundaries
• Identity and authentication architecture
• Attack surface minimization
• Logging, monitoring, and alerting
• Vulnerability and patch management
• Supply chain controls
• Secure defaults for deployed products
• Automated maintenance and updates
• Recovery and ownership lifecycle controls

This implementation focus is particularly important for organizations that need guidance they can integrate into existing workflows without adding unnecessary complexity.

In short, the market does not need more abstract cybersecurity slogans. It needs methods that teams can apply.

 

Product Security Extends Beyond Development

While secure coding and architecture remain foundational, real-world product security extends far beyond the development phase.

A secure product can still be exposed if software is distributed through untrusted channels, if update mechanisms lack integrity controls, if access rights are poorly governed, or if lifecycle processes fail to keep pace with new vulnerabilities.

That is why modern product security must also include:

• Trusted software delivery
• Controlled access to software assets and features
• Entitlement and usage governance
• Integrity-protected update mechanisms
• Secure onboarding and provisioning
• Operational monitoring
• End-of-life controls and decommissioning processes

Strong security principles need strong operational execution. Technology and process must work together throughout the lifecycle of the product – not only during coding.

This is increasingly relevant in environments where software is continuously updated, deployed across distributed infrastructures, or embedded into industrial systems with long support horizons.

 

How We Approach Secure Product Lifecycle Management

At Wibu-Systems, we see every day that protecting software products requires a holistic perspective.

Security must be embedded into the Secure Software Development Lifecycle (Secure SDLC), but it must also continue through release, delivery, activation, operation, maintenance, and retirement.

To strengthen this lifecycle approach, our internal governance includes dedicated structures such as the Wibu Product Security Board (Wibu-PSB) and the Wibu Product Security Incident Response Team (Wibu-PSIRT).

 

Wibu-PSB: Strengthening Secure Development

Our Product Security Board supports the Secure SDLC through structured security oversight, including:

• Threat modelling
• Security engineering practices
• Security testing and validation
• Continuous improvement of product security processes

This helps ensure that security considerations are embedded early and revisited throughout product evolution.

 

Wibu-PSIRT: Coordinated Vulnerability Response

Our Product Security Incident Response Team focuses on the evaluation, coordination, and communication of vulnerabilities and security incidents affecting our own products as well as relevant third-party components.

This capability is increasingly important in a software ecosystem where dependencies, libraries, and supply chain exposure must be managed proactively.

Security is not static. Products evolve, risks evolve, and response readiness matters.

 

Bringing Secure by Design into Industrial Reality: ENFORCERS

The lifecycle dimension of cybersecurity becomes even more critical in Operational Technology (OT) and industrial environments.

Manufacturing, automation, and connected production systems increasingly depend on software components, gateways, cloud services, and remote update capabilities. At the same time, these systems often operate in complex infrastructures where downtime, compromise, or delayed patching can have significant operational and economic consequences.

This is one of the motivations behind ENFORCERS: Enhanced Cooperation for Cybersecurity, a European project coordinated by Wibu-Systems and supported under EU funding mechanisms.

The project focuses on closing the loop between:

• Incident detection
• Coordinated response
• Secure software updates
• Trusted data exchange
• Lifecycle resilience across industrial environments

 

Building Trust Across Heterogeneous Networks

A major challenge in OT is that software components often need to move across partially trusted or heterogeneous networks before reaching devices in the field.

ENFORCERS addresses this by strengthening the robustness of software distribution and data exchange across network infrastructures and cloud environments, helping ensure that automation systems remain trustworthy throughout their lifecycle.

This includes work on:

• Secure update distribution flows
• Automated mitigation workflows
• Incident coordination mechanisms
• Threat intelligence sharing
• Trusted execution controls at endpoints

 

Digital Elements and Secure Elements at the Edge

Another key project objective is the use of Digital Elements anchored in Secure Elements (SE), particularly at OT edges where trust boundaries shift and where secure online updates are essential.

These trusted anchor points can help ensure that only authentic, authorized software is deployed and executed under approved conditions.

This reflects a broader market reality: Secure by Design increasingly requires hardware-backed trust, policy enforcement, and controlled software execution in the field.

 

A Shared Direction for Europe’s Cybersecurity Future

ENISA’s playbook and projects such as ENFORCERS point in the same strategic direction.

Cybersecurity maturity is no longer defined solely by perimeter defense or isolated product testing. It increasingly depends on whether organizations can create trustworthy digital products that remain secure across their full lifecycle.
That means combining:

• Secure engineering
• Secure defaults
• Trusted software supply chains
• Update integrity
• Operational visibility
• Coordinated incident response
• Lifecycle governance

For software vendors, manufacturers, and industrial operators alike, this is becoming the new baseline.

 

From Guidance to Action

We welcome ENISA’s initiative to turn cybersecurity principles into practical guidance and to invite industry participation through public consultation.

Frameworks matter. Standards matter. But execution matters most.

Secure by Design succeeds when it is not only written into policies, but built into products, processes, and platforms that organizations can trust every day.