Does the Cyber Resilience Act Make Penetration Testing Mandatory?

No — and yet hardly any manufacturer will get by without structured security testing. Why both are true at the same time, and what question really matters.

“Does the Cyber Resilience Act now require penetration testing?” — we’ve been getting this question for months. The honest answer is: No. And yet, for most manufacturers, there is no way around structured security testing. Both are true at the same time — and it’s precisely in this apparent contradiction that the point lies, one that many companies are still underestimating in 2026.

The Cyber Resilience Act (Regulation (EU) 2024/2847) is deliberately method-neutral. It does not name any specific testing technique — neither “penetration test” nor “fuzzing” nor “DAST” appear as […]

Out-of-band management systems are standard equipment in modern data centers. They allow administrators to manage servers even when the actual operating system has long since stopped responding – from a reboot through firmware updates all the way to a complete re-installation. Every manufacturer relies on their own ecosystem here: HP on „HP Integrated Lights-Out“ (HP iLO), Dell on „integrated Dell Remote Access Controller“ (iDRAC), and Cisco on the “Cisco Integrated Management Controller” (Cisco IMC). The latter is used on the widely deployed Cisco UCS C-Series rack servers and S-Series storage servers.

These systems are especially attractive from an attacker’s perspective: whoever controls the management controller effectively sits „below” the operating system. The IMC can update the BIOS, configure SecureBoot, and thereby interact directly with the operating […]