The ITSPmagazine Podcast

Cybersecurity in Italy: ITASEC 2025 Recap & Future Outlook with Professor Alessandro Armando

Cybersecurity is no longer a niche topic—it’s a fundamental pillar of modern society. And in Italy, ITASEC has become the go-to event for bringing together researchers, government officials, and industry leaders to tackle the biggest security challenges of our time.

Although we weren’t there in person this year, we’re diving into everything that happened at ITASEC 2025 in this special On Location recap with Professor Alessandro Armando. As Deputy Director of the Cybersecurity National Laboratory at CINI and Chairman of the Scientific Committee of the SERICS Foundation, Alessandro has a front-row seat to the evolution of cybersecurity in Italy.

This year’s event, held in Bologna, showcased the growing maturity of Italy’s cybersecurity landscape, featuring keynotes, technical sessions, and even hands-on experiences for the next generation of security professionals. From government regulations like DORA (Digital Operational Resilience Act) to the challenges of AI security, ITASEC 2025 covered a vast range of topics shaping the future of digital defense.

One major theme? Cybersecurity as an investment, not just a cost. Italian companies are increasingly recognizing security as a competitive advantage—something that enhances trust and reputation rather than just a compliance checkbox.

We also discuss the critical role of education in cybersecurity, from university initiatives to national competitions that are training the next wave of security experts. With programs like Cyber Challenge.IT, Italy is making significant strides in developing a strong cybersecurity workforce, ensuring that organizations are prepared for the evolving threat landscape.

And of course, Alessandro shares a big reveal: ITASEC 2026 is heading to Sardinia! A stunning location for what promises to be another exciting edition of the conference.

Join us for this insightful discussion as we reflect on where cybersecurity in Italy is today, where it’s headed, and why events like ITASEC matter now more than ever.

🎙️ Stay connected with us—subscribe to On Location with Sean Martin and Marco Ciappelli for more in-depth conversations from the world of cybersecurity, technology, and beyond!

Guest: Professor Alessandro Armando. University of Genoa | Deputy Director of the Cybersecurity National Laboratory at CINI and Chairman of the Scientific Committee of the SERICS Foundation | On LinkedIn: https://www.linkedin.com/in/alessandro-armando-67505913/

Hosts:

Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber] | On ITSPmagazine:  https://www.itspmagazine.com/sean-martin

Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast & Audio Signals Podcast | On ITSPmagazine: https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli

____________________________

This Episode’s Sponsors

HITRUST: https://itspm.ag/itsphitweb

____________________________

Resources

Website: https://itasec.it

____________________________

Catch all of our event coverage: https://www.itspmagazine.com/technology-and-cybersecurity-conference-coverage

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit: https://www.itspmagazine.com/redefining-cybersecurity-podcast

To see and hear more Redefining Society stories on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-society-podcast

Want to tell your Brand Story Briefing as part of our event coverage? Learn More 👉 https://itspm.ag/evtcovbrf

Want Sean and Marco to be part of your event or conference? Let Us Know 👉 https://www.itspmagazine.com/contact-us

⬥GUEST⬥

Allie Mellen, Principal Analyst,  Forrester | On LinkedIn: https://www.linkedin.com/in/hackerxbella/

⬥HOST⬥

Host: Sean Martin, Co-Founder at ITSPmagazine and Host of Redefining CyberSecurity Podcast | On ITSPmagazine: https://www.itspmagazine.com/sean-martin

⬥EPISODE NOTES⬥

In this episode, Allie Mellen, Principal Analyst on the Security and Risk Team at Forrester, joins Sean Martin to discuss the latest results from the MITRE ATT&CK Ingenuity Evaluations and what they reveal about detection and response technologies.

The Role of MITRE ATT&CK Evaluations

MITRE ATT&CK is a widely adopted framework that maps out the tactics, techniques, and procedures (TTPs) used by threat actors. Security vendors use it to improve detection capabilities, and organizations rely on it to assess their security posture. The MITRE Ingenuity Evaluations test how different security tools detect and respond to simulated attacks, helping organizations understand their strengths and gaps.

Mellen emphasizes that MITRE’s evaluations do not assign scores or rank vendors, which allows security leaders to focus on analyzing performance rather than chasing a “winner.” Instead, organizations must assess raw data to determine how well a tool aligns with their needs.

Alert Volume and the Cost of Security Data

One key insight from this year’s evaluation is the significant variation in alert volume among vendors. Some solutions generate thousands of alerts for a single attack scenario, while others consolidate related activity into just a handful of actionable incidents. Mellen notes that excessive alerting contributes to analyst burnout and operational inefficiencies, making alert volume a critical metric to assess.

Forrester’s analysis includes a cost calculator that estimates the financial impact of alert ingestion into a SIEM. The results highlight how certain vendors create a massive data burden, leading to increased costs for organizations trying to balance security effectiveness with budget constraints.

The Shift Toward Detection and Response Engineering

Mellen stresses the importance of detection engineering, where security teams take a structured approach to developing and maintaining high-quality detection rules. Instead of passively consuming vendor-generated alerts, teams must actively refine and tune detections to align with real threats while minimizing noise.

Detection and response should also be tightly integrated. Forrester’s research advocates linking every detection to a corresponding response playbook. By automating these processes through security orchestration, automation, and response (SOAR) solutions, teams can accelerate investigations and reduce manual workloads.

Vendor Claims and the Reality of Security Tools

While many vendors promote their performance in the MITRE ATT&CK Evaluations, Mellen cautions against taking marketing claims at face value. Organizations should review MITRE’s raw evaluation data, including screenshots and alert details, to get an unbiased view of how a tool operates in practice.

For security leaders, these evaluations offer an opportunity to reassess their detection strategy, optimize alert management, and ensure their investments in security tools align with operational needs.

For a deeper dive into these insights, including discussions on AI-driven correlation, alert fatigue, and security team efficiency, listen to the full episode.

⬥SPONSORS⬥

LevelBlue: https://itspm.ag/attcybersecurity-3jdk3

ThreatLocker: https://itspm.ag/threatlocker-r974

⬥RESOURCES⬥

Inspiring Post: https://www.linkedin.com/posts/hackerxbella_go-beyond-the-mitre-attck-evaluation-to-activity-7295460112935075845-N8GW/

Blog | Go Beyond The MITRE ATT&CK Evaluation To The True Cost Of Alert Volumes: https://www.forrester.com/blogs/go-beyond-the-mitre-attck-evaluation-to-the-true-cost-of-alert-volumes/

⬥ADDITIONAL INFORMATION⬥

✨ More Redefining CyberSecurity Podcast: 

🎧 https://www.itspmagazine.com/redefining-cybersecurity-podcast

Redefining CyberSecurity Podcast on YouTube:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

Interested in sponsoring this show with a podcast ad placement? Learn more:

👉 https://itspm.ag/podadplc

Guest:
Robin Hamilton

Website: https://www.aroundrobin.com
LinkedIn: https://www.linkedin.com/in/robinhamilton123/

_____________________________

Host: Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast & Audio Signals Podcast

Website: https://www.marcociappelli.com

_____________________________

Episode Title: 🎙️✨ 
From Newsroom to Lens: Robin Hamilton’s Journey Through Documentary Filmmaking and Social Activism

Episode Intro:
Hey everybody, Marco here, and welcome back to another episode of Audio Signals. Today, we're diving deep into the heart of storytelling—but from a compelling perspective that bridges journalism and visual creativity: documentary filmmaking. My guest today is Robin Hamilton, an Emmy-award-winning filmmaker and former journalist who passionately blends her craft with advocacy to inspire meaningful social transformation.

Robin's journey is truly captivating. Her films highlight powerful yet often overlooked figures who have significantly shaped history and society, bringing crucial attention to race, social justice, and women's contributions. Through heartfelt projects like This Little Light of Mine: The Legacy of Fannie Lou Hamer, she sheds light on historical figures whose stories resonate deeply today, reminding us of ongoing battles for civil rights, voting rights, and human dignity.

In our conversation, Robin shares the evolution of her storytelling approach—from quick-hit news reporting to the immersive world of documentaries. We explore how she discovers compelling stories like that of Odessa Madre, dubbed the "Black Al Capone" of 1950s Washington D.C., revealing complexities that challenge societal expectations and question how talent can flourish—or falter—based on opportunities provided. As Robin explains, choosing the right visuals, music, and narrative angles is critical in creating documentaries that truly engage, inspire, and provoke thoughtful reflection.

We'll discuss Robin's meticulous creative process, from initial inspiration to final production, and her bold decision to direct her films independently, driven by passion rather than convention. We’ll also explore why authentic storytelling matters so much to her—and how it can profoundly move audiences.

It's all about stories, storytellers, and using narratives to ignite meaningful change—one compelling film at a time.

Ready to explore the impact of storytelling through documentaries? Let's dive in.

_____________________________

For more podcast stories from Audio Signals: 
https://www.itspmagazine.com/audio-signals

Watch the video version on-demand on YouTube: https://www.youtube.com/playlist?list=PLnYu0psdcllQvnJ8eHUlVX8AuyhehtexA

Are you interested in advertising your brand on ITSPmagazine?
👉 https://www.itspmagazine.com/advertise

Guest: Scott “Shagghie” Scheferman, Artist: Raw. Analogue Techno. | On LinkedIn: https://www.linkedin.com/in/scottscheferman/ | Bandcamp: https://highsage.bandcamp.com/

Host: Sean Martin, Co-Founder at ITSPmagazine and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

The latest episode of Music Evolves brings a fascinating discussion with Scott “Shagghie” Scheferman, a longtime cybersecurity professional and electronic music creator. Host Sean Martin sits down with Scheferman to explore the intersection of creativity, technology, and music—challenging the traditional definitions of hacking and how it applies to the artistic process.

The Hacker Mindset in Music

Scheferman, who has spent decades working in cybersecurity, explains how his approach to music is deeply influenced by the hacker mindset. Traditionally associated with computers and networks, hacking is about problem-solving, exploration, and pushing boundaries. For Scheferman, that same mentality extends to music—whether modifying effects pedals beyond their intended use, experimenting with modular synthesizers, or applying unconventional methods to sound creation.

This perspective reframes the way we think about creativity: hacking isn’t just breaking things—it’s about finding new ways to build. In music, that could mean repurposing technology, combining analog and digital tools, or embracing unexpected results to drive innovation.

The Role of Technology in Music Creation

A core theme of the conversation is how technology shapes the way music is created and experienced. From the early days of analog synthesizers to today’s AI-driven tools, technology has always played a role in expanding musical possibilities. Scheferman describes his studio setup, filled with modular synthesizers, custom effects pedals, and digital sequencing tools, as an evolving playground for sound experimentation.

One of the key takeaways is that while technology can enable creativity, it can also introduce constraints. Whether it’s the frustration of a technical failure or the overwhelming options provided by AI-driven music tools, technology isn’t just a tool—it’s a collaborator. Sometimes, the best results come from working within limitations or intentionally breaking the rules.

AI, Automation, and the Future of Music

The conversation also touches on artificial intelligence and its growing role in music composition. AI tools can generate melodies, suggest chord progressions, and even simulate human-like performances. But does AI-enhanced music lose something essential?

Scheferman shares his thoughts on where technology ends and artistry begins. While AI can assist in generating ideas or automating tedious processes, it doesn’t replace the human connection to music. He sees AI as a tool for acceleration rather than substitution—something that can help musicians explore new ideas but should not dictate creative choices.

This is particularly relevant when it comes to live performance and improvisation. A computer can generate perfect beats and sequences, but can it capture the spontaneous interplay between musicians, the imperfections that make a performance feel alive? That’s still an open question.

The Human Element in Sound

Beyond the technical aspects, Scheferman and Martin discuss the emotional power of music. Whether it’s an acoustic guitar, an electrified soundscape, or a fully synthesized production, music has the ability to transport listeners to different states of mind.

They reflect on how people connect with sound—how live performances create an irreplaceable energy, how vinyl records provide a tactile experience that digital streaming lacks, and how technology might change the way future generations perceive and create music. The question remains: as digital tools become more dominant, will we continue to crave raw, unprocessed sound?

A Collaboration of Sound and Emotion

As the episode wraps up, Scheferman shares a track he created with his wife, Kati Rockit, blending electronic production with rock-influenced vocals. Their collaboration highlights another key theme of the episode—music as dialogue. Whether between humans and technology or between two creative partners, the best results often come from interplay, not isolation.

This episode of Music Evolves is a must-listen for anyone interested in how technology and creativity intersect. It challenges assumptions about what it means to be a musician in the digital age and invites listeners to rethink how they interact with sound.

🎧 Listen to the full conversation to hear more about hacking music, pushing creative boundaries, and the future of AI-driven sound.

Are you interested in sponsoring this show or placing an ad in the podcast?

Sponsorship 👉 https://itspm.ag/annual-sponsorship

Ad Placement 👉 https://itspm.ag/podadplc

Katy Rokit - Forgotten Dance Mix (Techno meets Pop Electronica): https://katyrokit.bandcamp.com/track/the-forgotten-forgetaboutit-dance-mix

Highsage - Sloane vs. Aliens (my kid's voice vs. algo filtering, tape delays, drum machine and euro rack - live performance): https://highsage.bandcamp.com/track/sloane-vs-martians

"Open" - Just a man with his 303, 808 and some strings... - "like a breeze that opens the door with a funk that shuts the window" (live cut): https://highsage.bandcamp.com/track/open

More from Music Evolves: https://www.seanmartin.com/music-evolves-podcast

Music Evolves on YouTube: https://www.youtube.com/playlist?list=PLnYu0psdcllTRJ5du7hFDXjiugu-uNPtW

On Location with Sean and Marco: https://www.itspmagazine.com/on-location

ITSPmagazine YouTube Channel: https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

Guests: 

Ari Luis Halos, Assistant Professor, University of the Philippines Open University

On LinkedIn | https://www.linkedin.com/in/ari-luis-halos-897b2113/

Charnylle T. Antiporda, Founder of Juan Lift

Hosts: 

Alejandro Juárez Crawford

On ITSPmagazine  👉 https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/alejandro-juarez-crawford

Miriam Plavin-Masterman

On ITSPmagazine  👉 https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/miriam-plavin-masterman

______________________

Episode Introduction

In this new What if Instead? conversation, Professor Ari Luis Halos is joined by his former student Charnylle T. Antiporda, now founder of Juan Lift. Ari and Nylle explore the transformative power of connecting diverse talents to create meaningful opportunities for people with disabilities (PWDs). They highlight Juan Lift’s mission to empower PWDs by offering remote work opportunities, emphasizing the importance of bridging the gap between those with valuable skillsets and those in need of their expertise.

Join us for an insightful conversation on how we can foster more connections and unlock hidden potential for individuals with often-overlooked abilities.

______________________

Resources

Juan Lift - Rebel Base: https://app.rebelbase.co/project/3993

Hope Across Borders: https://hopeacrossborders.org/

______________________

Episode Sponsors

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

______________________

For more podcast stories from What If Instead? Podcast with Alejandro Juárez Crawford and Miriam Plavin-Masterman, visit: https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/alejandro-juarez-crawford and https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/miriam-plavin-masterman

Host | Matthew S Williams

On ITSPmagazine  👉 https://itspmagazine.com/itspmagazine-podcast-radio-hosts/matthew-s-williams

______________________

This Episode’s Sponsors

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

______________________

Episode Notes

The James Webb Space Telescope (JWST) is the most complex and powerful space observatory ever deployed. What it has discovered since it commenced operations has been nothing short of groundbreaking! However, many of these discoveries were unexpected and confounded astronomers. But this is the purpose of Webb, which is designed to investigate the biggest questions we have about the nature of the Universe.

______________________

Resources

Webb Space Telescope - Home: https://webbtelescope.org/home

______________________

For more podcast Stories from Space with Matthew S Williams, visit: https://itspmagazine.com/stories-from-space-podcast

Artificial intelligence continues to shape the future of healthcare, and this year’s HIMSS Global Conference 2025 reflected both the momentum and the uncertainties surrounding its adoption. In a conversation with Robert Havasy, Senior Director, Connected Health at HIMSS, the discussion focused on how AI, interoperability, and regulatory policy are influencing healthcare delivery, patient engagement, and the broader industry landscape.

AI in Healthcare: From Concept to Implementation

Generative AI has moved beyond the hype stage, embedding itself into real-world applications. Oracle’s announcement of an AI-driven electronic health record (EHR) platform signals a shift in how hospitals and healthcare systems are rethinking data management. However, the conversation is no longer just about the technology itself—it’s about how governments, regulatory bodies, and healthcare institutions will set guardrails to ensure AI’s responsible and effective use.

The Role of Policy in Shaping AI’s Future

While AI adoption surges, regulatory uncertainty remains a key challenge. The Biden administration had proposed executive orders and regulations to guide AI’s role in healthcare, but with political shifts and differing global regulatory approaches, the direction remains unclear. HIMSS has observed that different regions—the U.S., Europe, and Asia—may take separate paths in AI governance, raising questions about whether a unified best-practice framework will emerge or if multiple regulatory approaches will lead to diverging standards.

Interoperability and the Shift Back to Customization

For years, healthcare institutions moved away from building their own systems in favor of purchasing standardized EHR solutions from dominant industry players. Now, there’s a return to in-house development, driven by the need for flexibility, adaptability, and deeper AI integration. At the same time, interoperability remains a hurdle, as institutions seek to make AI work across disparate systems while maintaining security and compliance.

The Patient’s Role in AI-Driven Healthcare

AI’s potential to close the information gap between patients and providers is one of the most promising developments. From personal health monitoring through wearables to AI-powered tools that help individuals interpret medical research and their own health data, the patient’s role in healthcare decision-making is evolving. The ability for AI to synthesize complex medical data and provide insights in real-time is reshaping how people engage with their health, making them more active participants in their care.

What’s Next?

As HIMSS 2025 highlighted, AI in healthcare is not a distant vision—it’s happening now. The question is no longer whether AI will be a part of healthcare, but rather how it will be implemented, regulated, and integrated into existing frameworks to maximize its benefits while mitigating risks. The conversation with Robert Havasy underscores the critical need for collaboration between healthcare providers, policymakers, and technologists to ensure AI delivers on its promise while keeping patients at the center of the equation.

Listen to the full episode for deeper insights into how AI, interoperability, and patient-centered care are shaping the future of healthcare.

Guest: Robert Havasy, Senior Director, Connected Health at HIMSS | On LinkedIn: https://www.linkedin.com/in/rhavasy/

Hosts:

Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber] | On ITSPmagazine:  https://www.itspmagazine.com/sean-martin

Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast & Audio Signals Podcast | On ITSPmagazine: https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli

____________________________

This Episode’s Sponsors

HITRUST: https://itspm.ag/itsphitweb

____________________________

Resources

Learn more and catch more stories from HIMSS 2025 coverage: https://www.itspmagazine.com/himss-2025-health-technology-and-cybersecurity-event-coverage-las-vegas

HIMSS 2024 Cybersecurity Report: https://www.himss.org/resources/himss-healthcare-cybersecurity-survey/

____________________________

Catch all of our event coverage: https://www.itspmagazine.com/technology-and-cybersecurity-conference-coverage

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit: https://www.itspmagazine.com/redefining-cybersecurity-podcast

To see and hear more Redefining Society stories on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-society-podcast

Want to tell your Brand Story Briefing as part of our event coverage? Learn More 👉 https://itspm.ag/evtcovbrf

Want Sean and Marco to be part of your event or conference? Let Us Know 👉 https://www.itspmagazine.com/contact-us

Guest:
Guest: Sara Daw 

👉 https://www.linkedin.com/in/saradaw

📌 Sara’s latest book, Strategy and Leadership as Service: How the Access Economy Meets the C-Suite
_____________________________

Host: Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society & Technology Podcast

Visit Marco's website 👉 https://www.marcociappelli.com 
_____________________________

This Episode’s Sponsors

BlackCloak 👉 https://itspm.ag/itspbcweb

_____________________________

Show Notes Blog:

Let’s talk about work. Not just jobs, but the way we structure work itself. Because let’s be honest—technology has completely changed how we collaborate, build careers, and define success. So why are we still clinging to outdated employment models?

In this episode of Redefining Society & Technology, I sit down with Sara Daw, author of Strategy and Leadership as a Service, to explore how the rise of fractional C-suite roles is challenging the traditional concept of employment.

For decades, work has been synonymous with full-time jobs, rigid schedules, and corporate hierarchies. But that model doesn’t fit today’s world. Instead, we’re seeing an unbundling of jobs, where businesses are accessing expertise on demand rather than keeping people on a payroll. Sara has been at the forefront of this shift, helping companies integrate fractional executives—CFOs, CMOs, CISOs—who work across multiple businesses rather than committing to just one.

But this isn’t just about executives. The gig economy isn’t limited to freelancers anymore. As technology enables remote collaboration, AI-driven automation, and decentralized work structures, we’re seeing a fundamental shift in how value is created. More and more professionals are choosing flexibility, autonomy, and variety over traditional employment, and businesses are learning how to build relationships without the security blanket of long-term contracts.

And here’s the key question: Is this shift making work better, or just more fragmented?

Technology has made this model possible, but psychology plays a huge role, too. Sara’s research dives into psychological ownership—the idea that people can feel deeply connected to an organization, even without a formal employment contract. It’s about trust, autonomy, and the sense of belonging we create outside of traditional job structures.

So where does this all lead? Will companies fully embrace this model, or will they cling to the office-first, full-time mentality? And what happens when Gen Z—who grew up in a fully digital world—reshapes the workforce even further?

Let’s rethink employment, leadership, and what it truly means to work in the digital age. Join me in this conversation with Sara Daw.

📌 Sara’s latest book, Strategy and Leadership as Service: How the Access Economy Meets the C-Suite, is a practical alternative vision of the future of work that is being adopted by businesses globally. Sara’s research focuses on what holds relationships together for the long-term in the absence of traditional employment contracts. Her work has been featured in The Sunday Times, Global Finance, Forbes and more outlets.  

📌 Keywords: future of work, fractional employment, gig economy, leadership, digital transformation, workforce evolution, remote work, C-suite strategy, employment disruption, technology & society

____________________________

Listen to more Redefining Society & Technology stories and subscribe to the podcast:
👉 https://redefiningsocietyandtechnologypodcast.com

Watch the webcast version on-demand on YouTube:
👉 https://www.youtube.com/playlist?list=PLnYu0psdcllTUoWMGGQHlGVZA575VtGr9

Are you interested Promotional Brand Stories for your Company and Sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/advertise-on-itspmagazine-podcast

⬥GUEST⬥

Sarah Fluchs, CTO at admeritia | CRA Expert Group at EU Commission | On LinkedIn: https://www.linkedin.com/in/sarah-fluchs/

⬥HOST⬥

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber] | On ITSPmagazine: https://www.itspmagazine.com/sean-martin

⬥EPISODE NOTES⬥

The European Commission’s Cyber Resilience Act (CRA) introduces a regulatory framework designed to improve the security of digital products sold within the European Union. In a recent episode of Redefining CyberSecurity, host Sean Martin spoke with Sarah Fluchs, Chief Technology Officer at admeritia and a member of the CRA expert group at the EU Commission. Fluchs, who has spent her career in industrial control system cybersecurity, offers critical insights into what the CRA means for manufacturers, retailers, and consumers.

A Broad Scope: More Than Just Industrial Automation

Unlike previous security regulations that focused on specific sectors, the CRA applies to virtually all digital products. Fluchs emphasizes that if a device is digital and sold in the EU, it likely falls under the CRA’s requirements. From smartwatches and baby monitors to firewalls and industrial control systems, the regulation covers a wide array of consumer and business-facing products.

The CRA also extends beyond just hardware—software and services required for product functionality (such as cloud-based components) are also in scope. This broad application is part of what makes the regulation so impactful. Manufacturers now face mandatory cybersecurity requirements that will shape product design, development, and post-sale support.

What the CRA Requires

The CRA introduces mandatory cybersecurity standards across the product lifecycle. Manufacturers will need to:

• Ensure products are free from known, exploitable vulnerabilities at the time of release.
• Implement security by design, considering cybersecurity from the earliest stages of product development.
• Provide security patches for the product’s defined lifecycle, with a minimum of five years unless justified otherwise.
• Maintain a vulnerability disclosure process, ensuring consumers and authorities are informed of security risks.
• Include cybersecurity documentation, requiring manufacturers to provide detailed security instructions to users.

Fluchs notes that these requirements align with established security best practices. For businesses already committed to cybersecurity, the CRA should feel like a structured extension of what they are already doing, rather than a disruptive change.

Compliance Challenges: No Detailed Checklist Yet

One of the biggest concerns among manufacturers is the lack of detailed compliance guidance. While other EU regulations provide extensive technical specifications, the CRA’s security requirements span just one and a half pages. This ambiguity is intentional—it allows flexibility across different industries—but it also creates uncertainty.

To address this, the EU will introduce harmonized standards to help manufacturers interpret the CRA. However, with tight deadlines, many of these standards may not be ready before enforcement begins. As a result, companies will need to conduct their own cybersecurity risk assessments and demonstrate due diligence in securing their products.

The Impact on Critical Infrastructure and Industrial Systems

While the CRA is not specifically a critical infrastructure regulation, it has major implications for industrial environments. Operators of critical systems, such as utilities and manufacturing plants, will benefit from stronger security in the components they rely on.

Fluchs highlights that many security gaps in industrial environments stem from weak product security. The CRA aims to fix this by ensuring that manufacturers, rather than operators, bear the responsibility for secure-by-design components. This shift could significantly reduce cybersecurity risks for organizations that rely on complex supply chains.

A Security Milestone: Holding Manufacturers Accountable

The CRA represents a fundamental shift in cybersecurity responsibility. For the first time, manufacturers, importers, and retailers must guarantee the security of their products or risk being banned from selling in the EU.

Fluchs points out that while the burden of compliance is significant, the benefits for consumers and businesses will be substantial. Security-conscious companies may even gain a competitive advantage, as customers start to prioritize products that meet CRA security standards.

For those in the industry wondering how strictly the EU will enforce compliance, Fluchs reassures that the goal is not to punish manufacturers for small mistakes. Instead, the EU Commission aims to improve cybersecurity without unnecessary bureaucracy.

The Bottom Line

The Cyber Resilience Act is set to reshape cybersecurity expectations for digital products. While manufacturers face new compliance challenges, consumers and businesses will benefit from stronger security measures, better vulnerability management, and increased transparency.

Want to learn more? Listen to the full episode of Redefining CyberSecurity with Sean Martin and Sarah Fluchs to hear more insights into the CRA and what it means for the future of cybersecurity.

⬥SPONSORS⬥

LevelBlue: https://itspm.ag/attcybersecurity-3jdk3

ThreatLocker: https://itspm.ag/threatlocker-r974

⬥RESOURCES⬥

Inspiring Post: https://www.linkedin.com/posts/sarah-fluchs_aaand-its-official-the-cyber-resilience-activity-7250162223493300224-zECA/

Adopted CRA text: https://data.consilium.europa.eu/doc/document/PE-100-2023-INIT/en/pdf

A list of Sarah's blog posts to get your CRA knowledge up to speed:

1️⃣ Introduction to the CRA, the CE marking, and the regulatory ecosystem around it: https://fluchsfriction.medium.com/eu-cyber-resilience-act-9e092fffbd73

2️⃣ Explanation how the standards ("harmonised European norms, hEN") are defined that will detail the actual cybersecurity requirements in the CRA (2023): https://fluchsfriction.medium.com/what-cybersecurity-standards-will-products-in-the-eu-soon-have-to-meet-590854ba3c8c

3️⃣ Overview of the essential requirements outlined in the CRA (2024): https://fluchsfriction.medium.com/what-the-cyber-resilience-act-requires-from-manufacturers-0ee0b917d209

4️⃣ Overview of the global product security regulation landscape and how the CRA fits into it (2024): https://fluchsfriction.medium.com/product-security-regulation-in-2024-93ddc6dd8900

5️⃣ Good-practice example for the "information and instructions to the user," one of the central documentations that need to be written for CRA compliance and the only one that must be provided to the product's users (2024): https://fluchsfriction.medium.com/how-to-be-cra-compliant-and-make-your-critical-infrastructure-clients-happy-441ecd859f52

⬥ADDITIONAL INFORMATION⬥

✨ More Redefining CyberSecurity: 

🎧 https://www.itspmagazine.com/redefining-cybersecurity-podcast

Redefining CyberSecurity Podcast on YouTube:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

Interested in sponsoring this show with an ad placement in the podcast? Learn more:

👉 https://itspm.ag/podadplc

The Wondrous Vegetable Shop

With the arrival of spring, beneath the soft mantle of the earth, tubers and roots began to awaken. The carrots stretched their orange tips with their green tufts. The round and plump potatoes whispered among themselves.

“I can feel the warmth of the sun even down here,” said a deep red beetroot. “Doesn’t it seem like the perfect moment to show ourselves to the world?”

“You’re right!” an enthusiastic onion replied. “Enough of staying down here! I want to shine on the shelves of a beautiful shop.”

So, they began their journey toward the surface. The earth gently parted to let those cheerful and determined roots pass through. Once they emerged, they started strolling carefree among the olive trees of the Tuscan hills, chatting happily about their new adventure.

Along their path, some sparrows hopped on the branches and, seeing the lively and chatty group, immediately chirped: “Chirp, chirp, chirp! Where are you going, fragrant vegetables?”

“To find the most special shop in town and put ourselves on display,” they replied.

A farmer, who had cultivated with passion for many years and cared deeply about the quality of his produce, noticed them and gently gathered them. He placed them in a basket and took them to a shop in Sesto Fiorentino, well known for its dedication to the finest products of the land.

Above the shop’s window, the sign read: THE WONDROUS VEGETABLE SHOP.

In baskets lovingly arranged, the carrots displayed their vibrant orange color, the potatoes gleamed, and even the onions proudly showed off their shining hues. The radishes giggled and happily put themselves on display as well.

Customers couldn’t resist such a spectacle of colors and scents and stopped, enchanted, saying: “What spectacular vegetables! Now this is a well-stocked and high-quality shop!”

The vegetables were delighted to be appreciated and purchased—they knew they would bring flavors and smiles to every kitchen with delicious dishes. Full of taste and nutrients, they were happy to be healthy and wholesome ingredients for everyone, from the youngest to the oldest, bringing to the table the joy and warmth of a meal shared with family and friends, following Italian tradition.

And so, buon appetito to everyone!
________________________________________________________________________

Each story is currently written and narrated in both Italian and English.

The translation from Italian (the original language) to English and the reading of the stories are performed using Generative Artificial Intelligence — which perhaps has a touch of magic... We hope it has done a good job!

If you like it, make sure to tell your friends, family, and teachers, and subscribe to this podcast to stay updated. You’ll be able to read or listen to new stories as soon as they become available.

Visit us On The Official Website https://www.storiesottolestelle.com/