The OWASP Global AppSec Conference 2025 in Barcelona marked a pivotal moment for European software security, largely due to the looming deadlines of the EU Cyber Resilience Act (CRA). Among the most anticipated sessions at the SAMM User Day was the presentation by Dag Flachet, co-founder of Codific, titled “CRA, Are We Ready? A Structured Analysis of Industry Readiness.”
This talk provided a sobering data-driven reality check for organizations navigating the transition from voluntary security best practices to mandatory legal requirements. By leveraging the OWASP Software Assurance Maturity Model (SAMM), Flachet and his team mapped the current state of software security across various sectors to determine the actual level of industry CRA readiness. The conclusion was clear: while the roadmap is defined, the gap between current maturity and regulatory compliance remains significant.
Introduction: The New Era of Product Security
For years, application security has been treated by many organizations as a “best-effort” endeavor—a set of practices governed by internal risk appetite rather than external enforcement. The introduction of the Cyber Resilience Act (CRA) fundamentally changes this dynamic. As a regulation that mandates security-by-design, vulnerability handling, and long-term support for products with digital elements, the CRA introduces a CE-marking requirement that will effectively gate-keep access to the European market.
The 2025 SAMM User Day talk addressed the anxiety surrounding this shift. By using the benchmark data from the OWASP SAMM project, Dag Flachet explored whether the industry is merely “not yet there” or if we are facing a systemic failure to meet the baseline requirements of the CRA. The session highlighted that industry CRA readiness is not just a technical hurdle but an organizational maturity challenge that requires a structured, measurable approach.
The Legislative Context
The CRA came into force in late 2024, with a phased implementation culminating in full enforcement by December 2027. Under this regulation, manufacturers must ensure their products are released without known exploitable vulnerabilities and maintained with security patches for their entire lifecycle. Failure to comply can result in fines reaching €15 million or 2.5% of global turnover.
In his talk, Flachet emphasized that the CRA is “outcome-based” rather than “prescriptive.” This means it tells you what to achieve but not exactly how to do it. This is where OWASP SAMM becomes indispensable, providing the “how” through its five business functions: Governance, Design, Implementation, Verification, and Operations.
Evaluating Industry CRA Readiness: The Findings
The core of the presentation focused on an analysis of SAMM benchmark data compared against a “CRA-ready” maturity profile. Flachet presented a structured mapping of SAMM activities to specific CRA requirements, such as Article 10 (Obligations of manufacturers) and Annex I (Essential security requirements).
1. The Maturity Gap
The analysis revealed a stark reality: most industries are currently below the required maturity levels. Specifically, the “Verification” and “Design” functions showed the most significant deficiencies. While many companies have matured in “Governance” (writing policies and strategy), they often fail in the “Design” phase—particularly in Architecture Assessment and Threat Modeling.
To be “CRA-ready,” a product must undergo a thorough risk analysis during the design phase. Flachet noted that many organizations still treat security as a post-development check rather than an architectural foundation, which is a direct violation of the CRA’s “Secure by Design” mandate.
2. The Struggle of SMEs
A recurring theme in the talk was the disparity between large enterprises and Small to Medium Enterprises (SMEs). While Fortune 500 companies often have the resources to hire dedicated AppSec teams, SMEs struggle with the “overhead” of compliance. The benchmark data showed that SMEs are significantly behind in Requirement-Driven Testing and Environment Management, making their industry CRA readiness dangerously low as the 2027 deadline approaches.
3. Vulnerability Handling and Transparency
The CRA places heavy emphasis on vulnerability handling. Manufacturers must report actively exploited vulnerabilities to ENISA within 24 hours. Flachet’s analysis suggested that while automated SCA (Software Composition Analysis) tools are widely adopted, the process of managing these vulnerabilities—triaging, patching, and communicating with end-users—is often ad-hoc and undocumented.
Using OWASP SAMM as a Roadmap for Compliance
A major highlight of the talk was the introduction of the “CRA Flavor” of SAMM. Recognizing that organizations can be overwhelmed by the 90+ activities in SAMM v2.1, Flachet proposed a subset of activities that align directly with CRA obligations.
-
Secure by Design: Mapping to SAMM’s Threat Assessment and Security Architecture practices.
-
Vulnerability Management: Mapping to SAMM’s Security Testing and Incident Management practices.
-
Transparency and Support: Mapping to SAMM’s Education & Guidance and Education & Operations.
By focusing on these specific streams, organizations can prioritize their efforts to achieve maximum compliance impact with minimum resource waste.
The Role of Security Champions
Flachet argued that reaching industry CRA readiness is impossible through a centralized security team alone. He advocated for the “Security Champion” model, where developers within product teams are empowered to lead SAMM assessments and implementation. This distributed ownership ensures that security is integrated into the daily workflow rather than being an external blocker.
Relative Scoring: A Better Way to Measure Progress
One of the technical takeaways from the session was the shift toward relative scoring. Instead of aiming for a “Level 3” maturity across the board (which might be overkill for certain products), Flachet recommended that organizations set risk-based targets and measure “percent to target.” This approach aligns perfectly with the CRA’s requirement for “due diligence,” as it shows a clear, documented path toward risk mitigation.
Summary and Conclusion
The OWASP SAMM User Day talk at Barcelona 2025 served as a critical “call to action.” Dag Flachet’s analysis of industry CRA readiness suggests that while the industry is waking up to the realities of European regulation, the majority of software manufacturers are currently unprepared for the rigorous documentation and process requirements of the CRA.
Key Summary Points:
-
Data-Driven Reality: Benchmark data shows significant gaps in Architecture Assessment and Verification, two pillars of the CRA.
-
Strategic Mapping: OWASP SAMM is the most effective framework for interpreting the CRA’s outcome-based requirements into actionable technical tasks.
-
SME Risk: Smaller organizations are at higher risk of non-compliance and need to leverage open-source tools and community guidance to bridge the gap.
-
Process over Tools: Tools alone won’t solve CRA compliance; the regulation demands formal processes for vulnerability handling and secure development.
As we move toward 2027, the “CE” mark will become as much a symbol of software security as it is for physical product safety. Organizations that start their SAMM assessments today will not only find themselves compliant but will also gain a competitive edge by proving their commitment to product resilience.
