Mobile specialists for EN 18031, UK PSTI and the CRA
Security evidence for your app and connected device: which rules apply, what to fix first, and something solid to show customers. Customers and distributors already ask how you handle security, and the rules and standards behind EN 18031, UK PSTI and the EU Cyber Resilience Act make it a legal question too.
Research-led, with original data. We study the chips, SDKs and libraries that real mobile apps and connected devices are built on, and find what generic scans and checklists can miss.
- SDK dataPrivate data on thousands of mobile SDKs and libraries, checked for warning signs so we can spot trouble before it reaches yours.
- 100+real mobile apps we’ve analysed as shipped, so we know where flaws tend to hide.
- 5,000+app publishers and 500+ connected-device apps we measure every month, every figure dated.
For app and software teams selling in the EU or the UK, and makers of connected devices whose app is part of the product.
How we help
- Know which rules applyWhich of EN 18031, UK PSTI and the CRA apply to your product, and what each asks of you.
- What needs fixing, and whyIn plain words, with the reason each point matters, so your team can plan the work.
- Answers when customers askSomething solid to point to when a customer or distributor asks how you handle security.
Engineering evidence, not legal advice or a conformity assessment.
Original research
What we found when we checked
We measure what app publishers and connected-device makers publish about security, and whether the vulnerability alerts app teams rely on fire when they should.
-
Vulnerability management ·
0 of 10
known-exploited flaws in six libraries that app packages bundle have an advisory naming a Maven, Swift or pub package
So Dependabot had nothing to alert on for native Android, iOS or Flutter projects.
-
Connected devices ·
69.9%
of connected-device apps had no published way to report a security flaw that we could find
306 of the 438 apps whose result we could determine.
-
CRA readiness ·
About 1 in 8
small publishers in Europe’s App Store charts publish any way to report a vulnerability
12.1%, against 50.0% of large publishers.
What we cover
Security and compliance for mobile apps and connected products first, and the engineering around them.
Laws and standards
- Cyber Resilience ActGuides, data and a free scope checker for app and software teams.Read the guides →
- EN 18031 / REDWhat the EU’s radio-equipment cybersecurity rules ask of a connected device’s app and cloud.Read the guide →
- UK PSTIThe three security requirements for connectable products sold in the UK, and the statement of compliance.Read the guide →
- Product Liability DirectiveWhat the EU’s revised liability rules mean for software and app teams.Read the guides →
Engineering
Live Intelligence
Real-time data views built on SDL’s own pipelines.
Security Patch Impact
When a patch is mandatory, see which real downstream projects actually break, not just whether the CVE exists.
More intelligence coming
More views are on the way.